Developer entry Where engineers ask for things and release
22 Backstage IDP
Backstage catalog templates
Next 22.1 · Backstage online, catalog and identity wired · 2026-12-18
24 Release Ticket System
release tickets change record
Next 24.1 · Release requests and their order in one place · 2026-11-27
23 Cogwork Desktop Application
Cogwork desktop release executor
Next 23.1 · Cogwork executes a release in the order the ticket sets · 2027-05-28
templates & requests ↓
Delivery Build, store, gate and deploy
15 CI/CD Pipeline Optimization
Jenkins GitLab CI APISIX canary signing
Next 15.2 · VM to Kubernetes cut-over by APISIX weighted routing · 2026-12-31
32 Unified Artifact Management
Nexus unified repos IaC
Next 32.1 · Nexus inventory and proof of concept settled · 2027-01-15
14 GitOps Continuous Deployment
ArgoCD GitOps
Next 14.1 · ArgoCD reconciling from Git, SSO on, manual sync closed · 2026-11-27
images & manifests ↓
Applications Workloads moving onto Kubernetes
25 Application Containerization
base images Helm chart CI templates
Next 25.1 · The paved road exists: base images, chart and CI templates · 2027-05-21
26 Application Migration to Kubernetes
goods API cart middle canary cutover
Next 26.4 · goods API Phase 1–10 moved off the middle, proven on 11/11 · 2026-11-11
30 API-First Data Access
API contracts no direct grants
Next 30.1 · Cross-application direct access inventoried, each dataset owned · 2027-02-26
events & queries ↓
Data Analytics and event streaming across sites
27 Data Platform
StarRocks ETL scheduler on-prem · US · asia-east1
Next 27.3 · Phase 1 — on-premises data platform ready · 2026-11-11
28 Event Bus (Kafka)
Kafka HTTP publish 3-site mirror
Next 28.2 · Control plane in git — schema, topic and access rules as code, with CI · 2027-09-17
runs on ↓
Runtime Compute, network fabric and naming
11 Kubernetes on the L3 Fabric
K8s L3 mode MetalLB BGP
Next 11.1 · L3-mode K8s cluster provisioned — MetalLB BGP mode · 2027-02-19
08 Enterprise-Grade Harvester HCI
Harvester HCI L3 fabric BGP to ToR
Next 8.2 · First rack group on L3 fabric — one rack group cut to BGP peering · 2027-02-12
09 KVM to Harvester Migration
KVM/libvirt Harvester
Next 9.1 · Harvester fixed as the default destination for rebuilds · 2027-04-23
10 DNS Architecture Refactoring
new DNS zones in Terraform
Next 10.1 · New DNS accepted, and the clients still on the old resolver identified · 2026-10-30
provisioned by ↓
Infrastructure as code Everything declared, applied from CI
04 Declarative Infrastructure Framework
Terraform Ansible CI apply
Next 4.1 · Cloud resources under Terraform · 2026-10-30
05 Bare-Metal IaC
Netbox Redfish/BMC iPXE
Next 5.1 · Netbox as the hardware source of truth · 2026-10-23
06 Database IaC & DBaaS
OpenMetadata schema migrations DBaaS
Next 6.1 · OpenMetadata cataloguing the database estate · 2026-12-18
07 Network IaC
Netbox intent rendered config default-deny
Next 7.1 · Netbox holds the network's intended state · 2027-01-01
rebuilds ↓
Estate & resilience Ownership, cleanup, recovery, sites
01 OS Administration Handover to SRE
SRE owns OS BMC stays w/ HW Ops
Next 1.1 · Boundary agreed and privileged access inventoried · 2027-01-31
02 Rebuild Existing Services under IaC slipped
build-before-break waves
Next 2.1 · Service inventory and rebuild order · 2026-08-28
03 Reclaim Wasted Capacity slipped
Mimir baseline right-sizing
Next 3.1 · Utilisation baseline and reclaim accounting · 2026-10-16
31 Disaster Recovery Automation
one rebuild pipeline cold-target rehearsal
Next 31.1 · Service tiers, recovery objectives and recovery order recorded · 2027-07-16
Zero-trust security Identity-based access, no standing secrets
12 Dynamic Secrets (Vault)
Vault dynamic DB creds SSH certs
Next 12.1 · Vault highly available and audited, with no long-lived root tokens · 2026-11-27
13 Zero-Trust Network Access
NetBird Warpgate
Next 13.1 · NetBird control plane self-hosted, highly available, and built from code · 2026-12-18
Supply chain & audit Scan, gate and trace every build
21 Vulnerability Management
DefectDojo release gate
Next 21.1 · DefectDojo under IaC/GitOps with SSO — products and engagements modelled per repository · 2026-10-23
20 End-to-End Build Auditing
audit ingest build events
Next 20.1 · Audit ingest in production, with Backstage producing · 2026-10-30
Observability One collector, one backend, SLO-driven
17 Telemetry Collection
Grafana Alloy
Next 17.1 · Alloy the only collector, deployed at every source · 2026-12-18
18 Unified Monitoring Platform
SLI/SLO alerts dashboards as code
Next 18.1 · SLIs and SLOs agreed with service owners, starting from none · 2027-11-19
19 ELK & Pinpoint → Grafana LGTM
ELK Pinpoint OpenTelemetry Grafana LGTM
Next 19.1 · Applications instrumented once, with OpenTelemetry · 2027-09-10
02 · Under-the-Hood Infrastructure as Code (IaC)
04 · Declarative Infrastructure Framework Clear selection waits on: noneunblocks: 5 Bare-Metal IaC, 6 Database IaC & DBaaS, 9 KVM to Harvester Migration, 10 DNS Architecture Refactoring, 32 Unified Artifact Management
# Milestone Target Status Waits for Team 4.1 Cloud resources under Terraform 2026-10-30 — SRE 4.4 Configuration management under Ansible 2026-11-20 4.1 SRE 4.2 VMs under Terraform — KVM and Harvester 2027-01-15 4.1 SRE 4.3 Database infrastructure under Terraform 2027-02-26 4.1 SRE
End state
What gets replaced Jenkins pipelines → GitLab CI KVM / libvirt hosts → Harvester HCI Legacy Kubernetes cluster → L3-mode cluster, MetalLB BGP ELK + Pinpoint → Grafana LGTM + OpenTelemetry Nexus → Unified artifact management (minimal NuGet kept) Old DNS resolver → New DNS, zones in Terraform 阿諾 → Superset on per-person Vault accounts Static SSH keys → Short-lived SSH certificates from Vault Hand-built VMs and hosts → Terraform + Ansible from CI Location-based network access → NetBird required for all access Taichung Site B → Decommissioned Taichung IDC → Retired, gated on DR rehearsal 31.3