One page per component. Each page explains how the component is set up in a tenant, what bedrock changes from the upstream defaults and the reason for each change.
Cilium
The network plugin: pod routing, service load balancing, network policy, encryption and flow visibility.
Kyverno
The policy engine: image, tag and resource checks on pods, plus the replication certificate sync.
Longhorn
Block storage for every volume in the cluster, and how its permissions and settings are tightened.
Garage
S3 object storage inside the tenant: layout, buckets, keys and access.
CloudNativePG
The PostgreSQL operator: clusters, poolers, backups and the settings that harden them.
Monitoring stack
Prometheus, Alertmanager, Loki, Alloy, Tempo, Grafana and OpenCost, and how each is configured.
Falco
Runtime threat detection on every node, and where its events go.