OpsSentinel — Feature Specification

OpsSentinel is an open-source GitOps control plane for provisioning, configuration, deployment, and operational reliability across cloud, on-premises, and hybrid infrastructure.

Status: Active Development
License: MIT
Primary Focus: GitOps • Cloud & Platform Operations • CI/CD Reliability • Infrastructure Automation

1. Product Vision

OpsSentinel provides a unified operational control plane for modern infrastructure and application delivery.

Instead of managing infrastructure provisioning, server configuration, CI/CD pipelines, deployments, secrets, incidents, and operational workflows through disconnected tools, OpsSentinel provides a single platform to orchestrate and observe the complete lifecycle.

                    OPS SENTINEL
                 GitOps Control Plane
                         │
        ┌────────────────┼────────────────┐
        │                │                │
        ▼                ▼                ▼
   PROVISION         CONFIGURE         DELIVER
   OpenTofu          Ansible          CI/CD
   Terraform         Playbooks        GitHub
        │                │                │
        └────────────────┼────────────────┘
                         │
                         ▼
                  AUTOMATION ENGINE
                         │
        ┌────────────────┼────────────────┐
        ▼                ▼                ▼
      GITOPS          SECRETS           POLICY
        │                │                │
        └────────────────┼────────────────┘
                         ▼
                  OPERATIONS LAYER
                         │
        ┌────────────────┼────────────────┐
        ▼                ▼                ▼
    OBSERVE          ANALYZE           RECOVER

2. Core Product Pillars

OpsSentinel is organized around six core pillars:

Provision — Infrastructure as Code
Configure — Configuration management
Deliver — CI/CD and application deployment
Automate — Reusable operational workflows
Observe — Reliability and operational intelligence
Govern — Security, policies, RBAC, audit, and GitOps controls

3. Provision — Infrastructure Automation

OpsSentinel integrates with Infrastructure as Code engines rather than attempting to replace them. OpsSentinel provides a unified control plane across all major IaC and configuration management tools.

Supported IaC Engines

OpsSentinel supports multiple IaC engines through a pluggable integration architecture:

Engine	License	Language	Primary Use
OpenTofu	MPL 2.0 (Open Source)	HCL	Multi-cloud provisioning
Terraform	BSL (Commercial)	HCL	Multi-cloud provisioning
Pulumi	Apache 2.0 (Open Source)	TypeScript, Python, Go, C#, Java	Multi-cloud provisioning
CloudFormation	AWS Service	JSON/YAML	AWS-native provisioning
Crossplane	Apache 2.0 (Open Source)	YAML (Kubernetes CRDs)	Kubernetes-native provisioning
AWS CDK	Apache 2.0 (Open Source)	TypeScript, Python, Go, Java, C#	AWS cloud development
Bicep	MIT (Open Source)	Bicep DSL	Azure-native provisioning
Packer	BSL (Commercial)	HCL, JSON	Machine image building
Vagrant	MIT (Open Source)	Ruby	Development environment provisioning

OpenTofu (Preferred Open-Source Engine)

OpenTofu is the preferred open-source IaC engine for OpsSentinel.

Features

OpenTofu project management
Workspace management
Environment management
Plan execution
Apply execution
Destroy operations
Plan approval
Run history
State tracking
State locking
Drift detection
Scheduled plans
Variable management
Provider management
Module management
Execution logs
Plan output
Apply output
Failure analysis
Infrastructure change history

Workflow

Git Commit
    ↓
OpenTofu Plan
    ↓
Change Review
    ↓
Approval
    ↓
OpenTofu Apply
    ↓
Verification
    ↓
Environment Updated

Terraform

OpsSentinel provides full Terraform support as a first-class integration alongside OpenTofu.

Features

Terraform project discovery
Workspace management
Plan execution and output parsing
Apply execution
Destroy operations
State management integration (local and remote backends)
Terraform Cloud / HCP Terraform integration
Terraform Enterprise integration
Module registry integration
Provider version management
Variable and variable set management
Run history and audit
Drift detection
Import existing resources
State locking and conflict resolution

Migration Support

Terraform to OpenTofu migration assistant
State file compatibility verification
Provider compatibility checks
HCL syntax validation across engines

Workflow

Git Commit (Terraform files)
    ↓
Terraform Init
    ↓
Terraform Plan
    ↓
Change Review + Cost Estimation
    ↓
Approval (Policy Gate)
    ↓
Terraform Apply
    ↓
Drift Detection Schedule
    ↓
Environment Updated

Pulumi

OpsSentinel integrates with Pulumi for teams using general-purpose programming languages for infrastructure.

Features

Pulumi project discovery
Stack management
Program execution (TypeScript, Python, Go, C#, Java)
Preview execution (plan equivalent)
Update execution (apply equivalent)
Destroy operations
State management (Pulumi Cloud and self-managed backends)
Secret management integration
Component and resource tracking
Dependency graph visualization
Policy as Code (CrossGuard) integration
Import existing resources
Stack references and output sharing
Configuration management
Execution logs and output

Supported Languages

TypeScript / JavaScript
Python
Go
C# (.NET)
Java
YAML (for simple configurations)

Workflow

Git Commit (Pulumi program)
    ↓
Pulumi Preview
    ↓
Change Review + Diff Visualization
    ↓
Approval (Policy Gate)
    ↓
Pulumi Update
    ↓
Verification
    ↓
Environment Updated

CloudFormation

OpsSentinel provides integration with AWS CloudFormation for AWS-native infrastructure.

Features

Stack management
Change set creation and review
Stack set management (multi-account, multi-region)
Template validation
Drift detection
Stack event history
Resource tracking
Nested stack support
Custom resource monitoring
Stack policy management
Import existing resources
Execution logs

Workflow

Git Commit (CloudFormation template)
    ↓
Change Set Creation
    ↓
Change Review
    ↓
Approval
    ↓
Stack Execute
    ↓
Verification
    ↓
Environment Updated

Crossplane

OpsSentinel integrates with Crossplane for Kubernetes-native infrastructure management.

Features

Composition management
Claim management
Resource tracking
Dependency graph visualization
Drift detection
Status monitoring
Event history
Provider configuration
Function pipeline management
Crossplane package management

Multi-Engine Orchestration

OpsSentinel can orchestrate across multiple IaC engines in a single workflow:

                    OpsSentinel
                  Control Plane
                       │
    ┌──────────┬───────┴───────┬──────────┐
    │          │               │          │
    ▼          ▼               ▼          ▼
OpenTofu   Terraform        Pulumi    CloudFormation
    │          │               │          │
    └──────────┴───────┬───────┴──────────┘
                       │
                       ▼
              Unified State View
              Cross-Engine Drift
              Correlated Changes

AWS CDK

AWS Cloud Development Kit support for AWS-native infrastructure.

Features

CDK project management
Stack management and deployment
App synthesis (CDK app → CloudFormation template)
Drift detection for deployed stacks
Cost estimation via AWS Pricing API

Integration Points

CDK CLI integration (cdk synth, cdk deploy, cdk diff)
CloudFormation stack tracking
AWS account/region management
Asset publishing to S3

Bicep

Azure-native infrastructure as code.

Features

Bicep file compilation (Bicep → ARM template)
What-if operation tracking
Module registry integration
Drift detection for deployed resources

Integration Points

Bicep CLI integration (az deployment)
Azure Resource Manager tracking
Azure subscription management
Private module registry support

Packer

Machine image building across multiple platforms.

Features

Packer template management
Build tracking (AMI, Azure Image, GCE Image)
Builder management (AWS, Azure, GCP, VMware, VirtualBox)
Post-processor tracking

Integration Points

Packer CLI integration (packer build, packer validate)
Image artifact tracking
Multi-platform build orchestration
Secret management for builder credentials

Vagrant

Development environment provisioning and management.

Features

Vagrantfile management
Box management (Vagrant Cloud)
Machine lifecycle (up, halt, destroy, provision)
Provider management (VirtualBox, VMware, Hyper-V, Docker)

Integration Points

Vagrant CLI integration (vagrant up, vagrant destroy)
Box version tracking
Provisioner management (Shell, Ansible, Docker)
Synced folder monitoring

Cross-Engine Capabilities

Unified infrastructure inventory across all engines
Cross-engine dependency mapping
Correlated change tracking (Terraform change + Ansible config + GitHub deployment)
Aggregated drift detection across all engines
Single approval workflow for multi-engine changes
Cost estimation across all providers

4. Infrastructure Providers

OpsSentinel should support infrastructure through OpenTofu providers and native integrations.

Public Cloud

AWS
Microsoft Azure
Google Cloud
Oracle Cloud Infrastructure
Alibaba Cloud
DigitalOcean
Akamai/Linode
Vultr

Private Cloud

OpenStack
Apache CloudStack
Proxmox VE
OpenNebula

Hybrid Infrastructure

Support environments combining:

Public Cloud
     +
Private Cloud
     +
On-Premises
     +
Kubernetes

5. Configure — Configuration Management

OpsSentinel integrates with configuration management tools for server automation, application deployment, and ongoing system maintenance.

Supported Configuration Management Tools

Tool	License	Architecture	Primary Use
Ansible	GPL v3 (Open Source)	Agentless (SSH/WinRM)	Automation, configuration, deployment
Chef	Apache 2.0 (Open Source)	Agent-based	Infrastructure automation, compliance
Puppet	Apache 2.0 (Open Source)	Agent-based	Configuration management, compliance
SaltStack	Apache 2.0 (Open Source)	Agent-based (optional)	Event-driven automation, remote execution
InSpec	Apache 2.0 (Open Source)	Agentless	Compliance testing and auditing
PowerShell DSC	MIT (Open Source)	Agent-based	Desired state configuration (Windows/Linux)
StackStorm	Apache 2.0 (Open Source)	Event-driven	Event-driven automation and remediation
Rudder	GPL v3 (Open Source)	Agent-based	Configuration management and compliance

Ansible

OpsSentinel integrates with Ansible for agentless configuration management and automation.

Features

Inventory management
Dynamic inventory
Static inventory
Playbook management
Role management
Collection management
Variable management
Vault integration
Ad-hoc commands
Playbook execution
Scheduled execution
Job history
Execution logs
Failure detection
Execution retry
Host-level results
Ansible Galaxy integration
AWX/Tower integration
Callback plugin for real-time reporting

Ansible Workflow

Inventory
    ↓
Playbook
    ↓
Approval
    ↓
Execution
    ↓
Validation
    ↓
Configuration Drift Check

Chef

OpsSentinel integrates with Chef for infrastructure automation and compliance enforcement.

Features

Chef Server integration
Node management
Cookbook management
Recipe execution
Role management
Environment management
Data bag management
Attribute management
Chef Infra Client run monitoring
Compliance profiles (InSpec)
Policy group management
Chef Habitat integration
Chef Automate integration
Chef Workflow (Push Jobs)
Run history and audit
Node convergence status
Drift detection
Execution logs

Chef Concepts Integration

Chef Infra Server
    ├── Node (Managed Server)
    │     └── Chef Client Agent
    │           ├── Ohai (System Facts)
    │           ├── Cookbook (Configuration)
    │           │     └── Recipe (Tasks)
    │           │           └── Resource (Declarative)
    │           └── converge → desired state
    ├── Policy
    │     ├── Roles
    │     ├── Environments
    │     ├── Data Bags
    │     └── Attributes
    └── Reporting & Compliance
          └── InSpec Profiles

Chef Workflow

Cookbook Development
    ↓
Chef Server Push / Pull
    ↓
Approval (Policy Gate)
    ↓
Chef Client Run
    ↓
Convergence Check
    ↓
Compliance Scan
    ↓
Drift Detection
    ↓
Remediation (if needed)

Puppet

OpsSentinel integrates with Puppet for enterprise configuration management and compliance enforcement.

Features

Puppet Server integration
Node/agent management
Module management
Manifest management
Hiera data management
Facts integration
PuppetDB integration
Catalog compilation monitoring ↓ Agent run monitoring
Compliance reporting
Policy enforcement
drift detection
Puppet Enterprise integration
Bolt task execution
Plan management
Execution logs
Node group management
Environment management

Puppet Concepts Integration

Puppet Server
    ├── Manifests (.pp files)
    │     ├── Classes
    │     ├── Defines
    │     └── Templates
    ├── Modules
    │     ├── Manifests
    │     ├── Files
    │     ├── Templates
    │     └── Facts
    ├── Hiera (Data Layer)
    │     ├── Common
    │     ├── Per-OS
    │     ├── Per-Environment
    │     └── Per-Node
    └── PuppetDB
          ├── Facts
          ├── Catalogs
          └── Reports

Puppet Workflow

Code Commit (Manifests/Modules)
    ↓
Puppet Server Catalog Compilation
    ↓
Approval (Policy Gate)
    ↓
Agent Run (Every 30 min or Triggered)
    ↓
Catalog Application
    ↓
Resource Enforcement
    ↓
Compliance Report
    ↓
PuppetDB Update
    ↓
Drift Detection

SaltStack (Salt)

OpsSentinel integrates with SaltStack for event-driven automation and remote execution.

Features

Salt Master integration
Minion management
State management
Pillar data management
Execution modules
Returners integration
Reactor system
Beacon monitoring
Event bus integration
Remote execution
Orchestration runner
Job management
Schedule management
Execution logs
Minion connectivity monitoring

InSpec

OpsSentinel integrates with InSpec for compliance testing and security auditing.

Features

Profile management
Control authoring and execution
InSpec profile dependencies
Input files
Custom resources
Compliance reporting
Chef Automate integration
Habitat integration
Cloud-specific profiles (AWS, Azure, GCP)

InSpec Workflow

Profile Selection
    ↓
Input Configuration
    ↓
Execution (Agentless)
    ↓
Results Collection
    ↓
Compliance Report
    ↓
Drift Detection (if re-run)

PowerShell DSC

OpsSentinel integrates with PowerShell Desired State Configuration for Windows and Linux configuration management.

Features

DSC resource management
Configuration authoring
MOF file compilation
Push/Pull server integration
Local Configuration Manager (LCM) monitoring
Compliance reporting
drift detection
Partial configuration support
Azure Automation integration

DSC Workflow

Configuration Authoring
    ↓
MOF Compilation
    ↓
LCM Apply (Push) or Pull Server
    ↓
Resource Enforcement
    ↓
Compliance Check
    ↓
Drift Detection

StackStorm

OpsSentinel integrates with StackStorm for event-driven automation and remediation.

Features

Pack management
Action management
Rule management
Sensor monitoring
Trigger management
Workflow (Orquesta) management
Execution history
Audit trail integration
ChatOps integration
RBAC integration

StackStorm Workflow

Event Detection
    ↓
Sensor Trigger
    ↓
Rule Evaluation
    ↓
Action Execution
    ↓
Workflow Orchestration
    ↓
Result Logging

Rudder

OpsSentinel integrates with Rudder for configuration management and compliance reporting.

Features

Rudder Server integration
Node management
Directive management
Technique management
Rule management
Group management
Compliance reporting
Drift detection
Policy generation
Inventory management

Rudder Workflow

Policy Authoring (Directives)
    ↓
Rule Definition
    ↓
Group Assignment
    ↓
Agent Run
    ↓
Compliance Evaluation
    ↓
Drift Detection

Cross-Tool Configuration Intelligence

OpsSentinel provides unified visibility across all configuration management tools:

           OpsSentinel Configuration Layer
                       │
    ┌──────────┬───────┴───────┬──────────┐
    │          │               │          │
    ▼          ▼               ▼          ▼
  Ansible     Chef           Puppet     SaltStack
    │          │               │          │
    └──────────┴───────┬───────┴──────────┘
                       │
    ┌──────────┬───────┴───────┬──────────┐
    │          │               │          │
    ▼          ▼               ▼          ▼
  InSpec    PowerShell DSC  StackStorm  Rudder
    │          │               │          │
    └──────────┴───────┬───────┴──────────┘
                       │
                       ▼
            Unified Configuration View
            Cross-Tool Drift Detection
            Correlated Changes

Cross-Tool Capabilities

Unified host inventory across all tools
Cross-tool dependency mapping
Correlated change tracking
Aggregated drift detection
Single approval workflow for multi-tool changes
Compliance status across all tools
Configuration drift correlation with infrastructure changes

6. Server & Host Management

OpsSentinel should provide a unified inventory of managed infrastructure.

Host Information

Hostname
IP address
Operating system
OS version
Architecture
CPU
Memory
Storage
Network interfaces
Environment
Tags
Cloud provider
Region
Availability zone
Ansible connectivity
Last successful configuration run

Supported Operating Systems

Linux
Windows Server
macOS where appropriate
Container hosts
Kubernetes nodes

7. Deliver — CI/CD Control Plane

CI/CD is one of OpsSentinel's primary capabilities.

GitHub Actions

Current Core Features

GitHub OAuth
GitHub repository integration
Webhook integration
workflow_run events
Real-time workflow updates
Workflow status tracking
Run history
Job status
Failure tracking
Success rate
Failure rate
Workflow duration
Repository filtering
Status filtering
One-click workflow rerun

8. CI/CD Observability

OpsSentinel provides centralized visibility across repositories.

Pipeline Dashboard

Display:

Total workflows
Successful workflows
Failed workflows
Cancelled workflows
Running workflows
Success rate
Failure rate
Average duration
MTTR
Flaky workflows
Recent failures
Failure trends

9. Pipeline Health Score

OpsSentinel should calculate an overall reliability score.

Pipeline Health
        │
        ├── Success Rate
        ├── Failure Rate
        ├── MTTR
        ├── Flakiness
        ├── Duration
        ├── Regression
        └── Recent Failures

Example:

Pipeline Health

82 / 100

GOOD

Success Rate       94.2%
Failure Rate        5.8%
MTTR               18m
Flaky Workflows      2
Avg Duration       7m 32s

10. Failure Intelligence

OpsSentinel should move beyond detecting failures to understanding them.

Failure Fingerprinting

Group similar failures into reusable failure signatures.

Example:

Docker Build Failure

Occurrences: 17
Repositories: 4
Workflows: 8

First Seen: Aug 01
Last Seen: Aug 09

Likely Cause:
Dependency installation failure

Failure Categories

Potential categories include:

Dependency failures
Test failures
Build failures
Docker failures
Authentication failures
Authorization failures
Network failures
Infrastructure failures
Timeout failures
Deployment failures
Configuration failures
Resource exhaustion
External service failures
Unknown failures

11. Flaky Workflow Detection

Detect workflows that fail intermittently.

Example:

Workflow: integration-tests

Runs: 37
Failures: 13
Failure Rate: 35.1%

Status:
⚠ Flaky

Recommendation:
Investigate unstable test or external dependency.

Configurable detection thresholds should be supported.

12. MTTR & Reliability Analytics

Track operational recovery performance.

Metrics:

MTTR
MTTF
Failure frequency
Recovery frequency
Failure rate
Success rate
Deployment frequency
Workflow duration
Change failure rate

Future support:

DORA Metrics

Deployment frequency
Lead time for changes
Change failure rate
Time to restore service

13. Incident Management

A workflow failure should be capable of becoming an operational incident.

Workflow Failure
       ↓
Failure Fingerprint
       ↓
Repeated / Critical?
       ↓
Incident
       ↓
Investigation
       ↓
Resolution

Incident Features

Incident creation
Incident severity
Incident status
Incident timeline
Affected repositories
Affected workflows
Failure correlation
Assigned responders
Comments
Related GitHub issues
Resolution notes
MTTR tracking
Automatic closure

14. GitHub Issues Integration

OpsSentinel should integrate incidents with GitHub Issues.

Create Issue

[OpsSentinel] Production deployment failures

Repository: api
Workflow: production-deploy

Occurrences: 7
Failure Type: Docker authentication

First Seen: Aug 08
Last Seen: Aug 09

Suggested Investigation:
Check registry authentication credentials.

Automatic Resolution

When a known incident stops occurring:

Incident
   ↓
No recurrence
   ↓
Verification
   ↓
Resolved
   ↓
Close GitHub Issue

15. Recovery Center

OpsSentinel should provide centralized recovery actions.

Recovery Actions

Rerun workflow
Rerun failed jobs
Open GitHub workflow
Create GitHub Issue
Notify team
Retry deployment
Run remediation workflow
Execute Ansible playbook
Re-run OpenTofu plan
Trigger rollback

16. Automation Engine

OpsSentinel should provide reusable workflows for infrastructure and application operations.

Workflow Types

CI workflows
Deployment workflows
Infrastructure workflows
Configuration workflows
Maintenance workflows
Incident workflows
Recovery workflows
Scheduled workflows

17. Visual Workflow Builder

Future UI:

Trigger
   ↓
Condition
   ↓
OpenTofu Plan
   ↓
Approval
   ↓
OpenTofu Apply
   ↓
Ansible Configure
   ↓
GitHub Deploy
   ↓
Health Check
   ↓
Success?
 ┌─┴─┐
YES  NO
 ↓    ↓
Done  Recovery

Workflow components should be reusable.

18. Workflow Triggers

Supported triggers should include:

Git push
Pull request
Pull request merge
GitHub workflow completion
Schedule
Manual trigger
Webhook
Incident creation
Incident update
Infrastructure drift
Failed deployment
Approval
API request

19. GitOps

Git should be treated as the desired-state source of truth.

GitOps Principles

Version controlled
Declarative
Repeatable
Auditable
Reviewable
Reversible
Automated

GitOps Flow

Developer
    ↓
Git Commit
    ↓
Pull Request
    ↓
Review
    ↓
Approval
    ↓
OpsSentinel
    ↓
Automation
    ↓
Infrastructure / Application
    ↓
Verification

20. Environment Management

OpsSentinel should provide a unified environment view.

Environment Types

Development
Testing
QA
Staging
Production
Disaster Recovery

Each environment contains:

Environment
├── Infrastructure
├── Hosts
├── Kubernetes
├── Applications
├── Workflows
├── Secrets
├── Deployments
├── Health
├── Drift
└── Audit

21. Deployment Management

Track application deployments independently from CI workflows.

Deployment Information

Application
Version
Commit SHA
Repository
Environment
Deployment status
Deployment duration
Deployment initiator
Workflow
Infrastructure changes
Rollback status
Health check

22. Deployment Intelligence

OpsSentinel should correlate:

Commit
 ↓
Pull Request
 ↓
Workflow
 ↓
Build
 ↓
Infrastructure Change
 ↓
Deployment
 ↓
Incident

This enables questions such as:

What changed before this deployment failed?

Which commit introduced this failure?

Which infrastructure change correlates with this incident?

23. Drift Detection

Detect differences between desired and actual state.

Infrastructure Drift

Git Desired State
       ↓
OpenTofu Plan
       ↓
Changes Detected
       ↓
Drift

Configuration Drift

Use Ansible or related mechanisms to detect configuration differences.

Display:

Drifted resource
Expected state
Actual state
Last change
Source commit
Recommended action

24. Secrets Management

OpsSentinel should avoid storing plaintext secrets whenever possible.

Secret Provider Integrations

Potential providers:

HashiCorp Vault
AWS Secrets Manager
Azure Key Vault
Google Secret Manager
OCI Vault
Kubernetes Secrets
External Secrets Operator

Principles

Encryption at rest
Encryption in transit
Secret references
Short-lived credentials
Least privilege
Secret rotation
Audit logging
No plaintext secrets in logs
No secrets in Git repositories

25. Security & Identity

Authentication

GitHub OAuth
OIDC
SSO
SAML
Enterprise identity providers

Authorization

RBAC roles:

Viewer

Read-only access.

Developer

Execute approved workflows and view operational data.

Operator

Manage infrastructure and automation.

Admin

Manage users, policies, integrations, and system configuration.

Owner

Full organization-level control.

26. Policy Engine

OpsSentinel should support policy-driven automation.

Examples:

Production OpenTofu Apply
        ↓
Require Approval

Production Deployment
        ↓
Require Successful CI

Destructive Operation
        ↓
Require Admin Approval

Secret Access
        ↓
Audit Event

27. Audit & Compliance

Record operational activities.

Audit events:

Login
Logout
Repository connection
Workflow execution
Workflow rerun
Deployment
OpenTofu plan
OpenTofu apply
Ansible execution
Secret access
Policy change
User change
Permission change
Incident creation
Incident resolution

Audit records should include:

Timestamp
User
Organization
Action
Resource
Result
Source IP where appropriate
Correlation ID

28. Notifications

Current

Email
Slack
Microsoft Teams

Future

Webhooks
Discord
PagerDuty
Opsgenie
Google Chat
Generic notification providers

Notifications should support:

Failure
Recovery
Incident
Deployment
Approval request
Drift
Security event

29. Multi-Tenant Architecture

OpsSentinel should support both self-hosted and SaaS deployments.

Tenant Isolation

Each tenant should have isolated:

Users
Organizations
Repositories
Environments
Credentials
Secrets
Workflows
Events
Incidents
Audit logs

30. Self-Hosted Deployment

OpsSentinel should remain fully usable as open-source software.

Deployment Options

Docker Compose

docker compose up -d

Kubernetes

Future support:

Helm
Kubernetes manifests
Operators

Bare Metal / VM

Support:

Linux
Reverse proxy
PostgreSQL
Node.js services

31. Database

Development

SQLite

Production

PostgreSQL

Core entities:

users
organizations
repositories
environments
workflows
workflow_runs
workflow_jobs
workflow_steps
failures
failure_fingerprints
incidents
deployments
infrastructure_runs          # OpenTofu / Terraform / Pulumi / CloudFormation runs
infrastructure_states        # State tracking across engines
infrastructure_drift         # Drift detection events
configuration_runs           # Ansible / Chef / Puppet / SaltStack runs
configuration_drift          # Configuration drift events
automation_workflows
workflow_executions
secrets
integrations
audit_events
notifications

32. API

OpsSentinel should expose an API-first architecture.

Core APIs

/api/auth
/api/users
/api/organizations
/api/repositories
/api/workflows
/api/runs
/api/jobs
/api/failures
/api/incidents
/api/deployments
/api/environments
/api/infrastructure
/api/configuration
/api/automation
/api/secrets
/api/integrations
/api/audit

IaC Engine APIs:
/api/infrastructure/opentofu
/api/infrastructure/terraform
/api/infrastructure/pulumi
/api/infrastructure/cloudformation
/api/infrastructure/crossplane

Configuration Management APIs:
/api/configuration/ansible
/api/configuration/chef
/api/configuration/puppet
/api/configuration/saltstack

33. Webhooks

Supported webhook sources:

GitHub
GitLab
Generic webhooks
Infrastructure events
Automation events

Webhook security:

HMAC verification
Signature validation
Replay protection
Timestamp validation
Rate limiting
Event deduplication

34. Observability

OpsSentinel should expose its own operational telemetry.

Metrics

API latency
Webhook latency
Workflow processing latency
Queue depth
Database performance
Notification latency
Automation execution duration

Logs

Structured JSON logs with:

Timestamp
Level
Service
Request ID
Correlation ID
User
Organization
Event

Future

OpenTelemetry
Prometheus
Grafana
Distributed tracing

35. AI & Intelligence Layer

AI should enhance operational workflows rather than become the primary product.

AI Root Cause Analysis

Input:

Workflow
Jobs
Steps
Logs
Commit
PR
Previous failures
Infrastructure changes
Deployment history

Output:

Likely Cause
Evidence
Confidence
Recommended Action
Related Failures

36. Predictive Reliability

Future capabilities:

Failure prediction
Deployment risk scoring
Flaky test prediction
Infrastructure change risk
Regression detection
Anomaly detection

Example:

Deployment Risk

HIGH — 78%

Reasons:
• Similar change failed 3 times
• Dockerfile modified
• Dependency major version update
• Previous deployment failure in this service

37. Automated Remediation

OpsSentinel should eventually support safe automated remediation.

Example:

Failure
  ↓
Identify Known Failure
  ↓
Check Remediation Policy
  ↓
Approval Required?
  ↓
Execute Remediation
  ↓
Verify
  ↓
Resolved

Examples:

Restart service
Rerun failed job
Execute Ansible playbook
Roll back deployment
Scale workload
Refresh credentials
Re-run infrastructure operation

All automated remediation must be policy-controlled and auditable.

38. Integrations

Source Control

GitHub
GitLab
Bitbucket

GitHub remains the primary integration.

CI/CD

GitHub Actions
GitLab CI
Jenkins
CircleCI
Azure DevOps

Infrastructure (IaC & Configuration Management)

Infrastructure as Code

OpenTofu (preferred open-source)
Terraform (full support)
Pulumi (TypeScript, Python, Go, C#, Java)
CloudFormation (AWS-native)
Crossplane (Kubernetes-native)

Configuration Management

Ansible (agentless)
Chef (agent-based)
Puppet (agent-based)
SaltStack (agent-based, optional)

Container & Orchestration

Kubernetes
Helm
Argo CD
Flux CD

Cloud

AWS
Azure
GCP
OCI
Alibaba Cloud
DigitalOcean
Akamai/Linode
Vultr

Private Infrastructure

OpenStack
CloudStack
Proxmox
OpenNebula

39. Platform Architecture

                         ┌──────────────────────┐
                         │      OpsSentinel     │
                         │    Control Plane     │
                         └──────────┬───────────┘
                                    │
              ┌─────────────────────┼─────────────────────┐
              │                     │                     │
              ▼                     ▼                     ▼
        Source Control          Automation           Integrations
              │                     │                     │
        ┌─────┴─────┐       ┌──────┴──────┐       ┌──────┴──────┐
        │           │       │             │       │             │
      GitHub      GitLab   │             │     Cloud       Kubernetes
        │                  │             │
        └──────────┬───────┤             │
                   │       │             │
                   ▼       ▼             ▼
              ┌────┴────────────┐   ┌────┴────────────┐
              │   IaC Engines   │   │ Config Tools    │
              ├─────────────────┤   ├─────────────────┤
              │ • OpenTofu      │   │ • Ansible       │
              │ • Terraform     │   │ • Chef          │
              │ • Pulumi        │   │ • Puppet        │
              │ • CloudFormation│   │ • SaltStack     │
              │ • Crossplane    │   │ • InSpec        │
              │ • AWS CDK       │   │ • PowerShell DSC│
              │ • Bicep         │   │ • StackStorm    │
              │ • Packer        │   │ • Rudder        │
              │ • Vagrant       │   │                 │
              └────────┬────────┘   └────────┬────────┘
                       │                     │
                       └──────────┬──────────┘
                                  │
                                  ▼
                           Workflow Engine
                                  │
                     ┌────────────┼────────────┐
                     ▼            ▼            ▼
                  Observe      Analyze      Recover
                     │            │            │
                     ▼            ▼            ▼
                  Metrics         AI       Remediation
                     │            │            │
                     └────────────┼────────────┘
                                  │
                                  ▼
                           Audit + Policy

Architecture Layers

Layer	Components	Purpose
Source Control	GitHub, GitLab, Bitbucket	Code, configuration, and infrastructure source of truth
IaC Engines	OpenTofu, Terraform, Pulumi, CloudFormation, Crossplane, AWS CDK, Bicep, Packer, Vagrant	Infrastructure provisioning and image building
Config Tools	Ansible, Chef, Puppet, SaltStack, InSpec, PowerShell DSC, StackStorm, Rudder	Server configuration, compliance, and automation
Workflow Engine	OpsSentinel core	Orchestrate, approve, and track all operations
Observe	Metrics, dashboards, health scores	Real-time operational visibility
Analyze	AI/ML, failure fingerprinting, root cause analysis	Intelligence and pattern recognition
Recover	Remediation, reruns, rollbacks	Automated and manual recovery
Audit + Policy	RBAC, policies, compliance, audit logs	Governance and control

40. Product Dashboard

The main dashboard should eventually provide:

OPS SENTINEL

┌─────────────────────────────────────────────┐
│ Pipeline Health        82 / 100             │
│ Success Rate           94.2%                │
│ MTTR                    18m                 │
│ Active Incidents         2                  │
└─────────────────────────────────────────────┘

Infrastructure
├── Healthy       42
├── Drifted        3
└── Failed         1

Deployments
├── Successful    127
├── Failed          5
└── In Progress     2

Automation
├── Successful    342
├── Failed         11
└── Running         4

Incidents
├── Critical        1
├── High            1
└── Resolved       24

41. CLI

Future OpsSentinel CLI:

opsctl login

opsctl repo list

opsctl workflow list

opsctl workflow run <workflow>

opsctl workflow rerun <run>

opsctl incident list

opsctl incident show <id>

opsctl tofu plan

opsctl tofu apply

opsctl ansible run <playbook>

opsctl environment list

opsctl deployment list

42. Webhooks & API Automation

Everything available through the UI should eventually be automatable through APIs.

Example:

curl -X POST \
  https://ops.example.com/api/workflows/deploy/run

This allows OpsSentinel to become part of larger automation ecosystems.

43. Open Source Strategy

OpsSentinel should remain open-source at its core.

Open Source

Core control plane
GitHub integration
CI/CD observability
Workflow engine
OpenTofu integration
Ansible integration
Docker deployment
PostgreSQL support
API
CLI

Potential Commercial Features

Optional future offerings:

Hosted SaaS
Enterprise SSO
Advanced RBAC
Enterprise support
Advanced compliance
Managed control plane
Premium AI capabilities
Advanced policy management

The open-source version should remain genuinely useful without requiring the commercial product.

44. Feature Priorities

P0 — Core

GitHub OAuth
GitHub webhooks
Workflow monitoring
Dashboard
Failure tracking
Notifications
Workflow reruns
PostgreSQL
Docker

P1 — Reliability

Pipeline Health Score
Failure fingerprinting
Failure clustering
Incident management
GitHub Issues integration
Deployment tracking
DORA metrics
Failure correlation

P2 — Automation

Workflow engine
Workflow templates
Scheduling
Approvals
Environment management
OpenTofu integration
Ansible integration

P3 — GitOps

GitOps repositories
Desired state
Drift detection
Environment synchronization
Deployment orchestration
Policy engine

P4 — Enterprise

RBAC
SSO/SAML
OIDC
Audit
Advanced policies
Multi-tenancy
Compliance

P5 — Intelligence

AI RCA
Predictive failure analysis
Deployment risk
Automated remediation
Anomaly detection

45. Long-Term Vision

OpsSentinel should evolve through these stages:

Stage 1
GitHub Actions Observability
        ↓
Stage 2
CI/CD Reliability Platform
        ↓
Stage 3
Automation Engine
        ↓
Stage 4
Infrastructure Automation
        ↓
Stage 5
GitOps Control Plane
        ↓
Stage 6
Cloud & Platform Operations Control Plane

The final platform:

                         OPS SENTINEL
                   Open-Source Control Plane
                               │
       ┌───────────────────────┼───────────────────────┐
       │                       │                       │
   PROVISION               CONFIGURE                DEPLOY
   OpenTofu                Ansible                   CI/CD
   Terraform               Chef                   GitHub Actions
   Pulumi                  Puppet                 GitLab CI
   CloudFormation          SaltStack              Jenkins
   Crossplane              PowerShell DSC            ArgoCD
   AWS CDK                 InSpec                     │
   Bicep                   Rudder                     │
   Packer                  StackStorm                 │
   Vagrant                                          │
       │                       │                       │
       └───────────────────────┼───────────────────────┘
                               │
                          AUTOMATE
                               │
                     ┌─────────┼─────────┐
                     │         │         │
                   GitOps    Secrets   Policies
                     │         │         │
                     └─────────┼─────────┘
                               │
                          OPERATE
                               │
                  ┌────────────┼────────────┐
                  │            │            │
               Observe      Analyze       Recover
                  │            │            │
                  └────────────┼────────────┘
                               │
                            GOVERN
                               │
                     RBAC • Audit • SSO

Supported Tools Matrix

Category	Tools
Infrastructure as Code	OpenTofu, Terraform, Pulumi, CloudFormation, Crossplane, AWS CDK, Bicep, Packer, Vagrant
Configuration Management	Ansible, Chef, Puppet, SaltStack, InSpec, PowerShell DSC, StackStorm, Rudder
CI/CD	GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure DevOps
GitOps	ArgoCD, FluxCD
Container Orchestration	Kubernetes, Helm
Source Control	GitHub, GitLab, Bitbucket

46. Product Promise

Provision infrastructure with OpenTofu, Terraform, Pulumi, CloudFormation, AWS CDK, Bicep. Build images with Packer. Manage dev environments with Vagrant. Configure systems with Ansible, Chef, Puppet, SaltStack, PowerShell DSC. Validate compliance with InSpec, Rudder. Automate operations with StackStorm. Deliver applications with CI/CD. Automate operations through GitOps. Observe reliability. Recover failures. Govern everything.

OpsSentinel's goal is not to replace OpenTofu, Terraform, Pulumi, Ansible, Chef, Puppet, Kubernetes, GitHub Actions, or other best-of-breed tools.

OpsSentinel connects them into one operational control plane.

47. Final Positioning

Product Category

Open-Source GitOps & Cloud Operations Control Plane

One-Line Description

OpsSentinel is an open-source GitOps control plane for provisioning, configuration, deployment, automation, and operational reliability across cloud, on-premises, and hybrid infrastructure.

Short Description

Provision with OpenTofu. Configure with Ansible. Deliver with CI/CD. Automate through GitOps. Observe and recover with OpsSentinel.

Core Philosophy

Git is the source of truth.
Open standards are the foundation.
Best-of-breed tools do the execution.
OpsSentinel provides the control plane.
Automation handles the repetition.
Observability provides the feedback.
Policies provide the guardrails.

Build less tooling. Connect more operations.

FilesExpand file tree

Feature Specification.md

Latest commit

History

Feature Specification.md

File metadata and controls

OpsSentinel — Feature Specification

1. Product Vision

2. Core Product Pillars

3. Provision — Infrastructure Automation

Supported IaC Engines

OpenTofu (Preferred Open-Source Engine)

Features

Workflow

Terraform

Features

Migration Support

Workflow

Pulumi

Features

Supported Languages

Workflow

CloudFormation

Features

Workflow

Crossplane

Features

Multi-Engine Orchestration

AWS CDK

Features

Integration Points

Bicep

Features

Integration Points

Packer

Features

Integration Points

Vagrant

Features

Integration Points

Cross-Engine Capabilities

4. Infrastructure Providers

Public Cloud

Private Cloud

Hybrid Infrastructure

5. Configure — Configuration Management

Supported Configuration Management Tools

Ansible

Features

Ansible Workflow

Chef

Features

Chef Concepts Integration

Chef Workflow

Puppet

Features

Puppet Concepts Integration

Puppet Workflow

SaltStack (Salt)

Features

InSpec

Features

InSpec Workflow

PowerShell DSC

Features

DSC Workflow

StackStorm

Features

StackStorm Workflow

Rudder

Features

Rudder Workflow

Cross-Tool Configuration Intelligence

Cross-Tool Capabilities

6. Server & Host Management

Host Information

Supported Operating Systems

7. Deliver — CI/CD Control Plane

GitHub Actions

Current Core Features