CNStack 2.0: Cloud‑Native Design for Agile, Secure Multi‑Cluster Ops

Background

Since the early 2000s, IT data centers have shifted from isolated management platforms to cloud‑native resource and workload management. Kubernetes has become the de‑facto framework, offering immutable infrastructure, declarative APIs and eventual consistency.

Product Goals

Agility – flexible deployment from a few nodes to thousands across regions.

Openness – support for open‑source standards, extensible APIs and third‑party integration.

Ecosystem – modular cloud services and components that can be released independently.

Security & compliance – unified authentication, authorization, audit, encryption and zero‑trust networking.

Design Principles

API‑first: the UI only consumes management APIs. All management objects are modeled as resources, enabling declarative, asynchronous and idempotent operations. No hidden internal APIs are allowed, ensuring consistent security controls and easy component replacement.

Architecture Overview

CNStack 2.0 is built on Kubernetes. Custom Resource Definitions (CRDs) and operators extend the control plane to manage services, tenants, permissions, certificates, backup/restore and multi‑cluster orchestration.

Key Components

ACK Distro – Alibaba’s Kubernetes distribution, packaged and deployed with Sealer.

cn‑app‑operator – Manages the lifecycle of cloud services and components using OAM‑style Helm rendering.

Account Manager – Provides user account management and LDAP/AD integration via KeyCloak.

UI Backend – Thin wrapper around Kubernetes or other management APIs for UI consumption.

Management Gateway – Central API gateway (based on Emissary‑Ingress) that handles routing, authentication, authorization, audit and TLS termination.

Ingress & Cluster Gateway – Minimal‑exposure data plane for cross‑cluster communication.

Cloud Services & Cloud Components – Independently packaged services such as microservice publishing, storage, virtualization, edge‑cloud collaboration and service mesh.

Security & Compliance

All control‑plane APIs converge to a single port behind the Management Gateway.

RBAC and hierarchical namespaces (via HNC) enforce multi‑tenant isolation.

Certificate management uses cert‑manager; secrets are encrypted at rest.

Audit, logging and monitoring rely on Loki, Victoria Metrics and Grafana.

Backup and disaster recovery are powered by Velero.

Daily Build Process

Every night a “daily build” snapshots component images and Helm charts from Git repositories, assembles a full product, deploys it to a test environment via the ADP platform, runs automated tests and publishes a new semantic version if all checks pass.

Chorus records the commit ID and uploads artifacts to ADP.

ADP creates a public‑cloud test cluster, deploys the product and executes built‑in test jobs.

Test reports are sent to notification channels; on success ADP publishes a new version.

R&D Efficiency Practices

CNStack 2.0 “eats its own dog food”: the same platform that delivers cloud services also orchestrates its CI/CD pipeline, giving developers the same usability and reliability as end users. Automated integration tests and strict version control improve developer experience and product quality.

References

https://github.com/sealerio/sealer

https://www.cncf.io/projects/emissary-ingress/

https://www.cncf.io/projects/cert-manager/

https://velero.io/

https://open-cluster-management.io/

https://github.com/alibaba/hybridnet

https://github.com/alibaba/open-local

https://github.com/keycloak/keycloak

https://github.com/grafana/loki

https://github.com/VictoriaMetrics/VictoriaMetrics

https://github.com/grafana/grafana