Architecture: Control Panel — Kubernetes

[curtisdelicata]

Implementation epic

Deliver the Kubernetes capability in the Control Panel application repository as an independently owned, testable module. The domain specification remains authoritative for business behavior; API, Filament 5, and Livewire 4 are one-to-one presentation packages and must not move business rules into presentation code.

Source specifications

• Domain / feature: https://github.com/liberusoftware/documentation/blob/main/features/control-panel/kubernetes.md
• API: https://github.com/liberusoftware/documentation/blob/main/api/control-panel/kubernetes.md
• Filament 5: https://github.com/liberusoftware/documentation/blob/main/filament/control-panel/kubernetes.md
• Livewire 4: https://github.com/liberusoftware/documentation/blob/main/livewire/control-panel/kubernetes.md
• Shared architecture: https://github.com/liberusoftware/documentation/blob/main/MODULES.md, https://github.com/liberusoftware/documentation/blob/main/API.md, https://github.com/liberusoftware/documentation/blob/main/FILAMENT.md, https://github.com/liberusoftware/documentation/blob/main/LIVEWIRE.md, https://github.com/liberusoftware/documentation/blob/main/TESTING.md, https://github.com/liberusoftware/documentation/blob/main/DOCUMENTATION.md

Specification details

Domain

Control Panel: Kubernetes

Canonical independent module specification

Domain module: control-panel-kubernetes
Application: Control Panel
Capability group: Module plan
Source scope: CONTROL-PANEL.md
Architecture: MODULES.md · TESTING.md · API.md · FILAMENT.md · LIVEWIRE.md

1. Purpose

The Kubernetes module owns Clusters, nodes, namespaces, RBAC, workloads, ingress, Helm, storage, autoscaling, upgrades, and multi-cluster views. It is the authoritative boundary for this capability and must remain independently installable, testable, versioned, enabled, and reusable across compatible Liberu applications.

2. Full feature scope

• Clusters: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Nodes: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Namespaces: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• RBAC: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Workloads: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Ingress: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Helm: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Storage: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Autoscaling: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Upgrades: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.
• Multi-cluster views: implement the complete lifecycle, validation, permissions, failure handling, audit evidence, and operator/user feedback required by this capability.

3. Ownership and boundaries

• Own the capability's domain rules, policies, actions, queries, events, persistence, migrations, configuration, audit semantics, and failure recovery.
• Expose stable contracts, immutable DTOs/read models, commands, queries, and past-tense domain events where other modules have a legitimate integration need.
• Consume identity, organizations/teams, authorization, settings, files, notifications, queues, localization, currency, and observability from the shared foundation rather than duplicating them.
• Never depend on an application's App\ classes, another module's private tables/models, a provider SDK in provider-neutral code, or an optional presentation framework.
• Keep Filament, Livewire, and HTTP API logic in matching one-to-one presentation packages when those surfaces are required.

4. Implementation strategy

Domain model

• Define aggregates, entities, value objects, enums, invariants, lifecycle states, and transition rules using the terminology in this specification.
• Make invalid states unrepresentable where practical and enforce remaining invariants at every mutation boundary.

API contract

Control Panel: Kubernetes API

Canonical one-to-one API module specification

API package: module-control-panel-kubernetes-api
Matching domain module: control-panel-kubernetes
Application: Control Panel
Source feature: Kubernetes
Architecture: API.md · MODULES.md · TESTING.md

1. Purpose and ownership

This optional API presentation package exposes approved HTTP operations for the Kubernetes domain module. It presents exactly one independent module, delegates all authoritative behavior to that module's public actions/queries/policies, and contains no other module's API logic.

The domain capability includes:

• Clusters
• nodes
• namespaces
• RBAC
• workloads
• ingress
• Helm
• storage
• autoscaling
• upgrades
• multi-cluster views

Installation does not expose every capability automatically. The host application selects this package, API version, audiences, route groups, and operations in its API manifest.

Filament surface

Control Panel: Kubernetes Filament

Canonical one-to-one Filament 5 implementation

Filament package: module-control-panel-kubernetes-filament
Matching domain module: control-panel-kubernetes
Application: Control Panel
Source feature: Kubernetes
Architecture: FILAMENT.md · MODULES.md · TESTING.md

1. Purpose and ownership

This optional Filament 5 presentation package presents exactly one independent domain module. It contributes reusable resources, pages, widgets, schemas, tables, infolists, and actions to application-owned panels while delegating authorization, validation, tenancy, persistence, and business rules to the control-panel-kubernetes public boundary. It must not contain another module's UI or depend on application App\ classes.

2. Module-specific surfaces

• Clusters: resource/table/form/action or page behavior for this module's authorized workflow.
• Nodes: resource/table/form/action or page behavior for this module's authorized workflow.
• Namespaces: resource/table/form/action or page behavior for this module's authorized workflow.
• RBAC: resource/table/form/action or page behavior for this module's authorized workflow.
• Workloads: resource/table/form/action or page behavior for this module's authorized workflow.
• Ingress: resource/table/form/action or page behavior for this module's authorized workflow.
• Helm: resource/table/form/action or page behavior for this module's authorized workflow.
• Storage: resource/table/form/action or page behavior for this module's authorized workflow.
• Autoscaling: resource/table/form/action or page behavior for this module's authorized workflow.
• Upgrades: resource/table/form/action or page behavior for this module's authorized workflow.
• Multi-cluster views: resource/table/form/action or page behavior for this module's authorized workflow.

3. Filament 5 implementation

Livewire surface

Control Panel: Kubernetes Livewire

Canonical one-to-one Livewire 4 implementation

Livewire package: module-control-panel-kubernetes-livewire
Matching domain module: control-panel-kubernetes
Application: Control Panel
Source feature: Kubernetes
Architecture: LIVEWIRE.md · MODULES.md · TESTING.md

1. Purpose and ownership

This optional Livewire 4 presentation package provides interactive server-driven components for exactly one independent domain module. Components coordinate public queries/actions and presentation state; they do not own persistence, authorization decisions, tenancy, business rules, or theme identity. The package has no dependency on application App\ classes or another module's internals.

2. Module-specific interactions

• Clusters: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Nodes: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Namespaces: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• RBAC: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Workloads: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Ingress: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Helm: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Storage: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Autoscaling: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Upgrades: interactive component state, validation feedback, loading, and failure recovery for this domain capability.
• Multi-cluster views: interactive component state, validation feedback, loading, and failure recovery for this domain capability.

3. Livewire 4 implementation

Acceptance criteria

• Domain ownership, boundaries, data lifecycle, permissions, tenancy, events, failure recovery, telemetry, and migrations match the domain specification.
• API routes/operations/events, versioning, authentication, authorization scopes, validation, idempotency, errors, pagination, rate limits, and observability match the API specification.
• Filament package identity, panel/resource/page/widget inventory, authorization, tenancy, navigation, theme integration, accessibility, and cache/discovery behavior match the Filament specification.
• Livewire package identity, aliases, component inventory, state/actions/events, loading/failure states, authorization, tenancy, accessibility, and lifecycle behavior match the Livewire specification.
• Unit, feature, contract, architecture, security, compatibility, migration/upgrade, and presentation tests cover allowed, denied, invalid, duplicate, concurrent, wrong-tenant, partial-failure, and recovery paths as applicable.
• README, changelog, runbook, API/presentation documentation, release notes, and adoption/upgrade guidance are complete.

Explicit exclusions

Do not implement unrelated independent modules, application App namespace coupling inside reusable packages, private cross-module table/model access, provider SDK leakage into provider-neutral code, or business authorization solely in UI/API presentation layers.