Hangar · The stack

Five layers, one platform

Hangar from the ground up: clusters from one template, an API that keeps itself true, a guarded road to production, agents with less authority, and one place for people to look.

Five layers, one platform Hangar as a layer stack, from the clusters up: Ground (Apron), Control plane (Airframe), Delivery (Glidepath), AI workloads (Autopilot, early) and Experience (Tower). Secrets, identity and policy, and observability run through every layer. PEOPLE CLUSTERS L1GroundAPRONKubernetes · Calico · Gateway API · cert-managerEvery cluster starts from the same template. L2Control planeAIRFRAMECrossplane · XRDs · Functions · CloudNativePGThe platform is an API that keeps itself true. L3DeliveryGLIDEPATHTekton · Chains · Sigstore · ArgoCD · RolloutsOne small file in; a signed, verified release out. L4AI workloadsAUTOPILOTEARLYClearance · CEL policy · Preflight · AgentRunSame road, less authority, every call on record. L5ExperienceTOWERBackstage · Tower plugin · TechDocsOne place to look. Every change becomes a PR. RUNS THROUGHSecrets,identity,policyInfisicalExternal SecretsTokenReviewKyverno RUNS THROUGHObservabilityOpenTelemetryPrometheusLoki · TempoSloth SLOsDORA LEGENDHangar layerThe API everything drivesRuns through every layer

Five layers, two rails

Point at a layer (or tab to it) to see what is in it and why. Click to open its page.

L5 · Experience · Tower

People should look in one place, and every change they make there should become a pull request.

Backstage built Tower built TechDocs built

L4 · AI workloads · Autopilot

An agent is just another workload, with less authority by default and every call on the record.

Clearance built CEL policy built Preflight built MCP proposed AgentRun XR proposed

L3 · Delivery · Glidepath

One small file for developers; a fixed, platform-owned path from a merged commit to a verified release. ArgoCD is the only thing that writes to a cluster, and each cluster has its own.

Tekton built Pipelines-as-Code built CDEvents broker built Tekton Chains built Conforma built ArgoCD built Argo Rollouts built

L2 · Control plane · Airframe

The platform is an API. An XR says what you want; reconciliation keeps it true afterwards.

Crossplane built Airframe XRDs built Composition Functions built provider-github built CloudNativePG built

L1 · Ground · Apron

Every cluster starts from the same template and the same bootstrap order, with its own trust roots. Two today: dev and prod.

Kubernetes built Calico built Contour + Gateway API built cert-manager built Apron template built

Runs through every layer · Secrets, identity, policy

Identity comes from the platform, not from secrets the platform has to guard. Policy runs at admission and at release.

Infisical built External Secrets built provider-infisical built TokenReview built Kyverno built

Runs through every layer · Observability

One trace per change, from commit to canary, and SLOs and DORA metrics that Tower shows next to every release.

OpenTelemetry built Prometheus + Thanos built Loki + Tempo built Sloth built DORA exporter built

Builds from the ground up on load. Point at a layer to preview it below; click to open its page.

←/→ step · Space play/pause · R replay · Home/End jump

Hangar · OverviewClick any box to open its page