Building a Cloud-Native Platform: From IaaS to PaaS

Built and operated a complete Kubernetes-native cloud platform, from managed infrastructure and PaaS provisioning to APIs, web UI, automation, security, and observability.

A hands-on STACKIT Build-a-Cloud platform engineering project covering the full journey from Kubernetes infrastructure to a production-oriented PaaS product. The implementation includes a managed PostgreSQL service on STACKIT Kubernetes Engine, Kubernetes-native provisioning with CloudNativePG, an OpenAPI-driven Go REST API, JWT authentication, a web UI, secure Ingress and TLS, GitOps/CI/CD automation, monitoring, centralized logging, audit logging, performance testing, autoscaling, and a Go SDK.

View Source

TYPECloud Engineering / Platform Engineering

PUBLISHEDJan 1, 2026

ROLEParticipant, STACKIT Build-a-Cloud Program

UPDATEDSep 16, 2026

TECH STACK

KUBERNETES

POSTGRESQL

STACKIT CLOUD

CLOUDNATIVEPG

OPENAPI

JWT

VUE.JS

GITOPS

CI/CD

INGRESS

PROMETHEUS

GRAFANA

LOKI

HPA

Why I Built This

The goal was to understand how a modern cloud platform is built as a complete system rather than as an isolated application.

I focused on turning Kubernetes capabilities into a real PaaS product: users should be able to authenticate, provision database instances, retrieve connection information, manage access, and interact with the platform without directly operating Kubernetes resources.

I implemented the complete feature set of the Build-a-Cloud track, including the optional bonus features, to move the project beyond a basic proof of concept toward an automated, observable, developer-friendly platform.

Building a Cloud-Native Platform: From IaaS to PaaS

Architecture Overview

The platform is built around STACKIT Kubernetes Engine. Kubernetes and CloudNativePG provide the platform foundation, the Go control-plane API manages product instances, the web UI provides the user-facing experience, GitOps/CI/CD handles delivery, and the observability stack provides monitoring, logging, and auditability.

Kubernetes Platform

STACKIT Kubernetes Engine hosts the platform workloads, Kubernetes resources, RBAC, networking, and autoscaling components.

PaaS Product Layer

CloudNativePG and Kubernetes Custom Resources provide the managed PostgreSQL product and its instance lifecycle.

Control Plane API

A Go REST API exposes OpenAPI-defined operations for authentication, product provisioning, instance management, connection information, and access configuration.

Web UI & Secure Access

A Vue-based web interface consumes the API, while Kubernetes Ingress and SSL/TLS provide secure external access through the platform.

Automation & Delivery

Container images are built and published to STACKIT Container Registry, while GitOps and CI/CD automate deployment of the API and UI.

Observability & Operations

Prometheus and Grafana monitor platform and application health, Loki provides centralized logging, audit logging records user actions, and HPA/performance testing support scalable operation.

Developer Tooling

A native Go SDK provides programmatic access to the PaaS API with authentication, documentation, and usage examples.

Kubernetes → Managed PostgreSQL PaaS → REST API → Web UI → GitOps/CI/CD → Observability & Developer Tooling

Core Features

Kubernetes-Native PaaS

Implemented the managed PostgreSQL product on top of Kubernetes and CloudNativePG.

• Managed PostgreSQL InstancesProvisioned and managed PostgreSQL product instances through Kubernetes Custom Resources.

• CloudNativePG OperatorUsed the operator reconciliation model to automate database lifecycle management.

• Instance ConnectivityImplemented connection and access handling for provisioned database instances.

REST API & Authentication

Built the API control plane as the front door to the PaaS.

• OpenAPI-First APIDefined and documented the API contract with OpenAPI and generated API types using oapi-codegen.

• Full Lifecycle ManagementImplemented create, list, get, delete, connection-data, and access-management operations for product instances.

• JWT AuthenticationImplemented registration/login and JWT-secured access to protected platform operations.

• Control-Plane SeparationKept platform authentication data in a dedicated control-plane PostgreSQL cluster separate from customer product instances.

Secure Web Platform

Turned the API into an accessible user-facing cloud service.

• Web UIBuilt a user-facing interface covering the relevant PaaS API functionality.

• IngressConfigured Kubernetes Ingress to expose the platform services.

• SSL/TLSPublished the platform securely over HTTPS using TLS.

• STACKIT SubdomainExposed the platform through a public STACKIT subdomain.

Automation & GitOps

Automated the path from source code to a running platform.

• Containerized ServicesBuilt container images for the platform components and published them to STACKIT Container Registry.

• GitOps DeploymentIntegrated API and UI deployment into the existing GitOps infrastructure.

• CI/CDAutomated deployment workflows instead of relying on manual Kubernetes changes.

Scaling & Performance

Implemented and validated automated scaling of the control plane.

• Horizontal Pod AutoscalerConfigured HPA for automatic scaling of the REST API control plane.

• Performance TestingExecuted performance tests to validate API behavior and the scaling configuration.

• Update FunctionalityImplemented and tested API functionality for updating instance access data and details.

Observability & Audit

Implemented the operational layer required to understand and operate the platform.

• Prometheus & GrafanaMonitored Kubernetes and application health and performance with persistent telemetry.

• Loki LoggingCentralized and analyzed application logs.

• Audit LoggingRecorded user actions including instance creation, modification, deletion, and access-related operations.

Developer SDK

Provided a native developer interface for the PaaS.

• Go SDKCreated a native Golang SDK for interacting with the PaaS API.

• SDK AuthenticationIntegrated authentication and authorization mechanisms into the SDK.

• Documentation & ExamplesProvided usage documentation and examples for developers consuming the platform.

Testing

Validated the platform at API and application levels.

• Unit TestsImplemented endpoint-level unit tests, including Kubernetes dynamic-client testing.

• Lifecycle TestingCovered create, list, get, update, and delete behavior for PaaS instances.

• Performance ValidationUsed performance testing to validate control-plane scaling behavior.

• End-to-End TestingImplemented E2E testing for the web UI and REST API.

Backend Systems

STACKIT Kubernetes Engine

Managed Kubernetes platform hosting the PaaS, API, UI, networking, and operational components.

CloudNativePG

Kubernetes operator responsible for PostgreSQL product instance management.

Go Control Plane

REST API responsible for authentication, product lifecycle operations, access configuration, and Kubernetes resource management.

PostgreSQL

Database technology used by the managed PaaS product and dedicated control-plane data store.

GitOps / CI/CD

Automated deployment pipeline for platform services and web components.

Prometheus / Grafana / Loki

Monitoring, visualization, and centralized logging stack for platform operations.

Go SDK

Developer-facing client library for programmatic access to the PaaS.

Key Decisions

Kubernetes-Native Product Architecture

Used Kubernetes Custom Resources and CloudNativePG instead of building a separate database provisioning system.

API-First Platform Access

Used OpenAPI as the contract between the platform backend and its consumers, including the web UI and SDK.

Control-Plane / Product Separation

Separated authentication and platform data from individual customer-facing PostgreSQL instances.

GitOps-Based Operations

Made deployment reproducible and auditable by integrating application delivery with GitOps.

Observability by Design

Added metrics, logs, audit trails, autoscaling, and performance validation as part of the platform rather than treating operations as an afterthought.

What I Learned

How a PaaS is built on Kubernetes

Learned how Kubernetes primitives, CRDs, and operators can be combined into a higher-level managed cloud product.

Platform engineering is more than deployment

The project connected provisioning, APIs, authentication, networking, UI, automation, monitoring, logging, and developer tooling into one platform.

API design shapes the developer experience

OpenAPI-first development made the PaaS easier to document, test, consume from the UI, and expose through an SDK.

Automation enables reliable operations

GitOps, CI/CD, HPA, performance testing, and Kubernetes-native lifecycle management reduced dependence on manual operations.

Observability is part of production readiness

Monitoring, centralized logs, and audit events provide the visibility required to operate and troubleshoot a platform.