Skip to content

Architecture

Reference architectures and design guidance for building on GRN.CLOUD. Product pages tell you what exists; this section tells you how to put it together and why one shape is better than another.

The platform in one picture

flowchart TB
    subgraph Site["Regional site — Netherlands"]
        subgraph AZ1["Zone A"]
            N1["Worker nodes"]
        end
        subgraph AZ2["Zone B"]
            N2["Worker nodes"]
        end
        subgraph AZ3["Zone C"]
            N3["Worker nodes"]
        end
        CP["Hosted control plane<br/>HyperShift"]
        CEPH[("Ceph<br/>replicated across zones")]
    end
    CP --- N1 & N2 & N3
    N1 & N2 & N3 --- CEPH

Three independent availability zones per site, each with its own power, cooling, uplinks and network fabric. The control plane runs as pods rather than on dedicated nodes.

Principles worth designing around

One control plane. A VM, a container, a function and a served model are all objects in the same API. Design across them freely — the boundary you are used to between "VM infrastructure" and "container platform" does not exist here.

Isolation is per workload. Namespace, dedicated cluster or dedicated bare metal is a placement decision, not an account decision. The manifests do not change.

Everything is in Git. Network policy, storage claims and workload definitions are the same kind of artifact as your application code, reviewed the same way.

Portable by construction. CNCF-conformant APIs throughout. What you build here runs on another conformant cluster.

Reference architectures

Scaffold status

This section is the home for worked reference architectures. Phase 1 establishes the structure; each architecture below is added as a full page with diagrams, manifests and trade-offs.

Planned entries:

Architecture Covers
Isolated private network UDN private subnets with gated egress — see the worked example
Multi-zone HA application Topology spread, PDBs, replicated storage
AI inference platform Gateway, self-hosted models, GPU partitioning, observability
Agent platform Gateway plus MCP servers plus sandbox, and the trust boundaries between them
Hybrid connectivity Submariner, BGP EVPN and site-to-site VPN