Private Cloud Accelerator · Apache 2.0

Your hardware.
Cloud-native.
In an afternoon.

CloudBedrock is a fully open source reference architecture and bootstrap toolchain that turns bare metal, colocation, or on-prem servers into a production-grade private cloud. Every configuration file, every integration, every decision — published without restriction on GitHub. Fork it, own it, run it.

100%
Open source
~2hr
Bare metal to running
Zero
Vendor lock-in
cloudbedrock.internal — Control Plane
Healthy
◈ CloudBedrock
prod-dc1 · Talos 1.9
Infrastructure
⬡ Node Pools12
◈ VMs8
⬖ GPUs2
⊞ Namespaces
Platform
☁ Tenants
🔒 Policies
⛁ Storage
📊 Observability
Nodes
12
CPU
67%
Memory
78%
GPU
91%
Node Pools
// 3 pools · 12 nodes · Talos Linux 1.9
control-planectrl
3/3 healthy · 12c / 64GB
workerscompute
5/6 healthy · 192c / 768GB
gpu-poolGPU
3/5 active · 12× H100
TenantCPUMemGPUStatus
data-science
4× H100 ● ok
platform-eng
● ok
ml-training
8× H100 ⚠ quota
100%Open source — Apache 2.0, no licence
YoursEvery config file, every decision
~2hrBare metal to running cluster
ZeroVendor lock-in, ever
What CloudBedrock Is

CloudBedrock is the months of integration work you shouldn't have to do yourself. Assembling a production-grade private cloud from open source components is not hard in theory — Talos, Cilium, Rook-Ceph, ArgoCD, cert-manager, Vault, Keycloak. The components are all excellent. What takes time is making them work together: version compatibility, upgrade sequencing, the OIDC chain from identity provider to every service, the GitOps pipeline structure, and the hundreds of edge cases that only appear under load. CloudBedrock is that work, done, and published as a complete reference architecture you fork and own outright.

Not a product

There is no CloudBedrock service to subscribe to. It is a Git repository. Fork it, read it, modify what doesn't fit, and run it. You own the result from the first command.

Not a generic K8s installer

CloudBedrock is opinionated. It makes specific choices at every layer and documents why. You may disagree with some of them. That's fine — change the YAML.

Not a managed service

No dependency on Plane Sailing to keep it running. The infrastructure is yours. Engineering support is available, but entirely optional.

Who It's For

Infrastructure teams who own
their own hardware.

CloudBedrock is for teams with servers — in a data centre, a colocation facility, or on-premises — who want a cloud-native platform without a hyperscaler bill or a multi-month infrastructure project. Where you're starting from changes the migration path, not the destination.

🏃

Leaving VMware

Broadcom's acquisition changed the VMware commercial reality overnight. If you're facing a licence renewal that no longer makes sense, CloudBedrock is a concrete migration path — not a vague "move to Kubernetes" recommendation, but working infrastructure configuration for the platform that replaces vSphere on your existing hardware.

  • KubeVirt runs unconverted VMs through the Kubernetes API — no separate hypervisor control plane, migrate workloads at your own pace
  • Rook-Ceph on existing disks replaces vSAN without dedicated storage hardware
  • Active Directory wires in on day one — no identity migration required to get started
🏗

Leaving OpenStack

OpenStack is powerful and famously expensive to operate. If your team spends more time maintaining the control plane than building on top of it, CloudBedrock is a clean exit. The operational surface area — upgrade procedures, component interdependencies, failure modes — is an order of magnitude smaller.

  • Kubernetes replaces Nova and Neutron — containerised workloads move first, everything else on your schedule
  • MinIO gives you an S3-compatible API with the same interface as Swift — applications don't change
  • Keystone identity federates to Keycloak via OIDC while you migrate users at your own pace
🌱

Deploy on Cloud or on-prem

Deploy CloudBedrock to accelerate the journey to Cloudyard and CloudGate.

  • Deploys on all popular hosted Kubernetes incl. AWS, Azure and VMWare Tanzu.
  • Fully air-gap capable — signed offline image bundles for regulated and disconnected environments
  • Integrate onto existing commodity hardware
⚙️

Starting from Scratch

You have hardware — colocation, a leased rack, servers in a data centre — and you want a cloud-native platform without a hyperscaler contract. CloudBedrock gives you the complete starting configuration so you're building on a tested, integrated foundation rather than assembling the puzzle across a dozen component documentation sites.

  • No prior enterprise services required — CloudBedrock bootstraps Keycloak, Vault, and an internal CA as production-safe defaults you replace when ready
  • Fully air-gap capable — signed offline image bundles for regulated and disconnected environments
  • GPU support pre-configured — NVIDIA DCGM, MIG partitioning, per-tenant quotas, Grafana dashboards ready
What It Delivers

Not components.
A working platform.

Every component CloudBedrock uses is individually documented and deployable. The value is the integration — version compatibility confirmed, configuration tested across layers, upgrade sequences written, and the edge cases that only emerge in production already handled.

01

Immutable Node OS

Talos Linux was designed specifically for Kubernetes nodes — no SSH, no shell, no package manager, no configuration drift. Nodes are managed entirely via a declarative API. Upgrades are atomic with automatic rollback. The attack surface of a conventional Linux host simply doesn't exist here.

Talos Linux 1.9API-onlyAtomic upgradesNo SSH ever
02

eBPF Networking

Cilium replaces kube-proxy entirely with eBPF kernel programs — no overlay network, no performance penalty, native load balancing via BGP, and Hubble providing real-time network flow visibility across every namespace without tapping traffic. The networking layer that is usually the hardest to configure is pre-wired and documented.

CiliumHubbleBGP load balancingkube-proxy replaced
03

Distributed Storage

Rook-Ceph provides block, file, and object storage from the same node fleet — no separate storage infrastructure required. MinIO sits on top for S3-compatible object storage with a familiar API. Both are pre-configured with sensible replication policies, storage classes, and Grafana dashboards out of the box.

Rook-CephMinIOBlock + File + ObjectCSI drivers
04

Multi-Tenant Isolation

Tenants get dedicated namespaces with hard CPU, memory, and storage quotas enforced at the kernel — not at an admission controller that can be misconfigured. Cilium NetworkPolicies enforce tenant network separation at the eBPF layer. OIDC-scoped access from your identity provider grants exactly the right permissions, nothing more.

Namespace isolationKyvernoOIDC scopingResource quotas
05

VM Workloads

KubeVirt runs virtual machines through the standard Kubernetes API — no separate hypervisor management plane. VMs and containers share the same networking, storage, and scheduling layer. Essential for VMware migrations where not every workload moves to containers on day one, and for legacy applications that require full OS isolation.

KubeVirtLive migrationMixed workloadsCDI import
06

GPU Cloud

Full NVIDIA stack pre-configured — DCGM exporter, device plugin, MIG partitioning, and time-slicing. Per-tenant GPU quotas enforced at the scheduler. GPU utilisation visible by tenant, by job, and by device in Grafana from day one. The configuration that typically takes a week to assemble correctly is already done.

NVIDIA DCGMMIG partitioningTime-slicingPer-tenant quotas
Enterprise Integrations

Bring your own.
Or we bootstrap one.

CloudBedrock does not require you to replace services your organisation already runs. Active Directory, an existing PKI, a SAN, an established monitoring stack — all of them wire in. Every integration point in inventory.yaml has two modes: point it at what you have, or leave it blank and CloudBedrock bootstraps an open source default.

The defaults are not toy configurations. Keycloak is production-grade identity brokering. The cert-manager internal CA is properly chained and auto-rotating. Vault is initialised with Kubernetes auth and auto-unseal. You can run on them indefinitely, or hand off to your existing enterprise services when ready — on your schedule, not ours.

👤
Identity & Access Management
Single auth source for all components — namespaces, Grafana, storage, developer tools, and any application you deploy
BringActive Directory / Azure AD — OIDC federation or LDAP bridge
BringAny OIDC provider — Okta, Ping, ForgeRock, Auth0
ProvidedKeycloak — open source, full LDAP sync, bootstrapped on first run
🔏
PKI & Certificate Authority
TLS everywhere — component-to-component, ingress endpoints, and node-level certificates — all managed and rotated automatically by cert-manager
BringMicrosoft AD CS — cert-manager ADCS issuer integration
BringHashiCorp Vault PKI — cert-manager Vault issuer
Providedcert-manager internal CA — self-signed root, auto-rotating, production-safe
🗝
Secrets Management
Application credentials injected at runtime via External Secrets Operator — never stored as plaintext Kubernetes secrets
BringAzure Key Vault / AWS KMS — External Secrets provider
BringCyberArk / Thales HSM — enterprise HSM via ESO
ProvidedHashiCorp Vault — bootstrapped, Kubernetes auth, auto-unseal
Block & Object Storage
Persistent volumes, object buckets, and file shares presented as standard Kubernetes storage classes
BringNetApp Trident — NFS and iSCSI CSI integration
BringPure Storage / Dell PowerStore — native CSI drivers
ProvidedRook-Ceph — block, file, and object storage from node-local disks
📊
Observability Platform
Metrics, logs, and GPU telemetry from all cluster components and tenant workloads, with pre-built dashboards for every CloudBedrock component
BringDatadog / Dynatrace / Splunk — Alloy forwarding integration
BringElastic Stack — log forwarding via Alloy output
ProvidedGrafana + Mimir + Loki + Alloy — full stack, pre-built dashboards
🌐
Network & DNS
Upstream routing for cluster ingress, DNS resolution, and load balancer IP allocation in your data centre network
BringExisting BGP routers — Cilium BGP peering to your ToR switches
BringWindows DNS / Infoblox — external-dns integration
ProvidedCoreDNS + Cilium LB IPAM — self-contained, no upstream dependencies
Getting Started

Clone. Fill in the blanks.
Run bootstrap.sh.

The entire bootstrap is a shell script and a YAML inventory file. No proprietary installer, no binary you can't inspect. What is in the repository is exactly what runs — which is the point.

bootstrap.sh — prod-dc1
# One script. One config file. Everything follows.
$ git clone https://github.com/planesailing/cloudbedrock
$ cp inventory.example.yaml inventory.yaml
# edit inventory.yaml — 2 minutes
$ ./bootstrap.sh --inventory inventory.yaml
Validating inventory (12 nodes)...
Hardware reachable · topology valid
AD reachable: corp.acme.internal
ADCS CA · root cert retrieved
Provisioning Talos Linux (12 nodes)...
All nodes booted · Talos 1.9.0
etcd quorum · API server healthy
Deploying platform components...
Cilium · kube-proxy replaced
cert-manager · ADCS issuer configured
Rook-Ceph · 3-replica OSDs ready
Vault · K8s auth · auto-unseal
Keycloak → AD LDAP sync active
Grafana stack · dashboards live
NVIDIA DCGM · 12× H100 detected
Cluster ready. Elapsed: 1h 44m
$
The Stack

Six integrated layers.
All in the repository.

Every component, every version pin, every configuration value lives in Git. There are no proprietary wrappers, no opaque binaries, nothing outside the repository. What you read is exactly what runs.

Your workloads
Any container Any VM GPU jobs Databases ML workloads
Observability
Grafana Loki Mimir Alloy DCGM Hubble
Security
Vault Ext. Secrets Falco OPA Gatekeeper Kyverno
Orchestration
Kubernetes 1.32 ArgoCD cert-manager Keycloak
Storage
Rook-Ceph MinIO Velero CSI drivers
OS & Network
Talos Linux Cilium BGP KubeVirt MetalLB

Every CloudBedrock release is integration-tested across the full stack before tagging. Component versions are pinned. Upgrading means bumping a version in a pull request — ArgoCD applies it in dependency order, health-checks each layer, and rolls back automatically on failure.

  • The repository is the sole source of truth. No component holds configuration outside it. Disaster recovery is a git clone and a bootstrap run against new hardware.
  • Air-gap installations are fully supported. Every release includes a signed offline image bundle — no internet required at bootstrap or upgrade time.
  • The stack is modular. Don't need KubeVirt? Remove the ArgoCD application. No GPUs? Leave out DCGM. It's YAML, not a product feature flag.
  • CloudBedrock runs any workload. It is not coupled to any particular application platform — run whatever you want on top of it, including the Plane Sailing product stack if that's useful.
Open Source

Take every line.
No strings attached.

Apache 2.0. No enterprise tier. No feature flags behind a paywall. No configuration locked in a binary. Fork the repository, modify what doesn't fit, and run it. That is the complete model.

CloudBedrock exists because we deployed this same infrastructure stack for multiple organisations and spent weeks on integration work that was identical every time. The configurations are not secret. The component choices are not proprietary. The value is the integration, the testing, and the documentation of every decision and why it was made. If it's useful to you without our involvement, take it without hesitation. If you want the team that built it alongside a migration or a complex deployment, we're available.
Optional — Plane Sailing Stack

CloudBedrock also runs our
own product suite.

If you want to go beyond the infrastructure layer — a self-service developer portal, a package inspection gateway, or controlled egress — the Plane Sailing products are designed to deploy on top of CloudBedrock with pre-written integration overlays in the repository. This is entirely optional and none of it is required to get value from CloudBedrock itself.

CloudBedrock
← You are here
Cloudyard
+ Self-service developer platform
CloudGate
+ Artefact ingress inspection
CloudLock
+ Controlled data egress
PigeonHole
+ Encrypted secret sharing

Pre-written overlays for each product.

The repository includes a cloudyard/ and cloudgate/ directory — ArgoCD application definitions and values overlays that deploy each product against a CloudBedrock cluster with OIDC, storage, and networking already wired. Enable them with a single flag in inventory.yaml. They are tested against every CloudBedrock release so they work, but they are entirely optional additions, not a requirement.

Support Options

The repository is free.
Our time isn't.

Most teams deploy CloudBedrock without any involvement from us. If you're navigating a VMware migration, operating under compliance obligations, or need contractual support SLAs for a production cluster — that's what these options are for.

// Self-Service
Community
The full repository, documentation, and GitHub Discussions community. Everything needed to deploy CloudBedrock without any involvement from us.
  • Full repository access — Apache 2.0
  • Architecture documentation
  • Enterprise integration guides
  • Upgrade and migration runbooks
  • GitHub Discussions community
  • Direct engineering support
  • Contractual SLA
  • Signed air-gap image bundle
Get the Repository →
// Supported
Engineering Support
Direct access to the engineers who built CloudBedrock — for integration debugging, architecture review, upgrade assistance, and production support on your running cluster.
  • Everything in Community
  • Dedicated Slack channel
  • Architecture review session
  • Integration debugging support
  • Upgrade assistance
  • Signed air-gap offline bundle
  • Best-efforts P1 response
  • Private patches before public release
  • Contractual SLA with defined RTOs
  • Named support contact
Talk to the Team →
// Embedded
Migration Engagement
A time-boxed engagement where Plane Sailing engineers work alongside your team through migration planning, deployment, enterprise wiring, and full knowledge transfer.
  • Everything in Engineering Support
  • VMware / OpenStack migration plan
  • Embedded deployment assistance
  • AD / PKI / storage integration
  • Team runbook authoring
  • Knowledge transfer sessions
  • 90-day post-deployment support
  • Contractual SLA with defined RTOs
Discuss Your Migration →
// Enterprise
Enterprise SLA
A contractual support agreement with defined response and resolution time objectives across severity levels — for organisations where infrastructure downtime has a business or compliance cost that requires formal commitment.
Severity Definition Initial Response Updates Target Resolution
P1 Critical Cluster control plane or storage layer unavailable; total production impact 30 minutes Every 30 min 4 hours
P2 High Significant degradation; major feature unavailable; workaround possible 2 hours Every 4 hours 1 business day
P3 Medium Non-critical component issue; limited user impact; stable workaround exists 8 hours Daily 5 business days
P4 Low General questions, configuration guidance, enhancement requests 1 business day As needed Next release
  • Everything in Migration Engagement
  • Named senior support engineer
  • 24/7 P1 on-call coverage
  • Quarterly architecture review
  • Advance notice of breaking changes
  • Compliance documentation pack (SOC 2, ISO 27001 evidence)
  • Custom SLA schedule available on request
// SLA coverage hours: P1/P2 — 24/7 including weekends and bank holidays.
P3/P4 — 09:00–18:00 UK time, Monday–Friday.
Response times measured from ticket creation or direct Slack escalation.
Discuss Enterprise SLA →
Get Started

Start with the
repository.

Clone it, read it, and decide if you need help. Most teams deploy CloudBedrock without us. If you're planning a VMware migration, building in a regulated environment, or standing up a GPU cluster from scratch — we've done this before and we're available.

⌥ Get CloudBedrock on GitHub Talk to the Team