1.2. OPENMARU COP Overview
Introducing OPENMARU COP
OPENMARU COP (Container Orchestration Platform) is an enterprise-grade container orchestration platform based on Kubernetes. It is a Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployment, providing in a single platform all the tools needed across the whole application lifecycle -- development, build, deployment, and operation.
OPENMARU COP Installer is an automated installation and configuration tool based on Ansible. With a single command it builds the entire stack idempotently, from the Kubernetes cluster through the DevOps tools, the authentication system, and monitoring.
The design of OPENMARU COP follows these five principles.
| Principle | Description |
|---|---|
| Automation first | Repetitive work is automated with Ansible playbooks to minimize human error |
| Built-in security | The CIS benchmark, RBAC, and image scanning are applied by default from the installation stage |
| Ease of operation | The web console and integrated monitoring keep the operating burden low |
| Flexible deployment | Supports a range of network environments, including Connected and Disconnected (a closed network with external Internet access fully blocked, also known as air-gapped) |
| Standards compliance | Built on industry-standard technology such as Kubernetes, Helm, and OIDC |
Key Features
- An open-source orchestration platform based on Kubernetes (RKE2), free of vendor lock-in
- Automated installation based on Ansible, for straightforward deployment and scale-out
- A complete CI/CD pipeline integrating GitLab, Jenkins, ArgoCD, Harbor, and Nexus
- Straightforward image builds from source code through the S2I (Source-to-Image) builders
- Integrated SSO (OIDC) authentication based on Keycloak and LLDAP, giving a single sign-on across all services
- Built-in security through the CIS security profile, Cert-Manager, and Grype image vulnerability scanning
- Time-based autoscaling through CronHPA, with standard HPA interoperation
- Support for AI/GPU workloads through the NVIDIA GPU Operator, vLLM, and CogentAI (RAG)
- Integrated web-based cluster management through the OPENMARU COP Console
- Integrated monitoring and log collection through Observability and APM
Main Components
OPENMARU COP consists of the following core components.
| Category | Component | Namespace | Role |
|---|---|---|---|
| Platform | Kubernetes (RKE2) | kube-system | Container orchestration core |
| Platform | OPENMARU COP Console | openmaru-cop | Web-based integrated management console |
| Storage | NFS Provisioner | nfs-provisioner | Dynamic volume provisioning for RWX (shared across nodes) |
| Storage | Local Path Provisioner | local-path-storage | Dynamic volume provisioning for RWO (local) |
| Authentication | Keycloak SSO + LLDAP | openmaru-sso | OIDC-based integrated authentication, user and group directory |
| Certificates | Cert-Manager | cert-manager | Automatic issuance and renewal of TLS certificates |
| CI/CD | GitLab / Jenkins / ArgoCD | Bastion / argocd | Source management, build, GitOps deployment |
| Registry | Harbor / Nexus | Bastion | Repository for container images and artifacts |
| Autoscaling | CronHPA | openmaru-cronhpa | Cron-based scheduled scaling |
| Backup | kubedump | Bastion (CLI) | YAML backup and restore of Kubernetes resources per project (namespace) |
| Monitoring | MSAP Observability | openmaru-observ | Integrated monitoring of metrics, logs, and alerts |
| Monitoring | MSAP APM | openmaru-apm | Application performance monitoring |
| AI/GPU | CogentAI / vLLM | openmaru-vllm and others | On-premise LLM serving, RAG |
The components are installed in the following order. (A later step often requires an earlier one to be ready first, but not every step depends on all of the steps before it.)
- S2I image upload
- NFS Provisioner
- Local Path Provisioner
- Cert-Manager
- kubedump (project backup)
- Keycloak SSO (LLDAP)
- Harbor OIDC integration
- OPENMARU COP Console
- Observability
- APM
- ArgoCD
- kube-bench (CIS check)
- CronHPA
Deployment Architecture Types
OPENMARU COP supports three deployment architectures, chosen according to the scale of the customer's requirements.
| Type | Minimum configuration | Characteristics |
|---|---|---|
| All-In-One | At least 2 nodes (Bastion + combined Master/Worker) | Small-scale environment for testing and development |
| Standard | 1 Bastion + 3 Masters + 2 or more Workers | Typical production environment, HA configuration |
| Enterprise | Standard + Infra nodes + GPU nodes | Large-scale operation and support for AI/GPU workloads |
OPENMARU COP Terminology
| Term | Description |
|---|---|
| COP | Container Orchestration Platform. The core platform of OPENMARU COP |
| Bastion | The central management server hosting installation and operations management and the DevOps tools |
| Master (control-plane) node | The node running the cluster control components such as the API server, etcd, and the scheduler |
| Worker (data-plane) node | The node running the actual application workloads (pods) |
| Infra node | A node dedicated to infrastructure workloads such as monitoring and CI/CD (optional) |
| Namespace (project) | The unit that logically isolates Kubernetes resources. Also shown as "project" in the OPENMARU COP Console |
| S2I | Source-to-Image. The approach of building a container image directly from source code |
| CronHPA | The autoscaler specific to OPENMARU COP that adjusts the pod count at particular times based on a cron expression |
| kubedump | A CLI tool installed on the Bastion that backs up and restores Kubernetes resources per project (namespace) as YAML |
| SSO/OIDC | Integrated authentication through Keycloak. All services are signed into with one account |
| CogentAI | The on-premise LLM/RAG service provided by OPENMARU COP |