Building GetSol IDP: An Enterprise-Grade GitOps Internal Developer Platform on AWS

Muhammad Zubair - Software Engineer
Muhammad Zubair
2026-04-10 • Case Study

GetSol IDP App Logo - Developed by Muhammad Zubair GetSol IDP: An enterprise-grade, GitOps-driven Internal Developer Platform, engineered by Muhammad Zubair.

Modern engineering teams often face severe developer bottlenecks. While cloud computing offers immense power, developers are frequently forced to wait days for operations teams to provision infrastructure, master complex Terraform syntax, or risk security drift with un-governed cloud deployments.

To bridge this gap, Muhammad Zubair, a Software Engineer specializing in cloud-native infrastructure and platform engineering, engineered GetSol IDP—a cutting-edge, GitOps-driven Internal Developer Platform that acts as a unified control plane for zero-YAML self-service cloud provisioning on AWS.

By combining a lightweight Kubernetes runtime with powerful declarative tools like Argo CD, Crossplane, and Kyverno, GetSol IDP eliminates developer ticket friction and enforces shift-left security governance before resources ever reach the cloud.

The Tech Stack: Kubernetes, ArgoCD, and Crossplane

Building an enterprise-grade Internal Developer Platform requires a highly optimized, concurrent architecture. As a Software Engineer, I designed GetSol using a declarative GitOps approach to ensure maximum speed, security, and reliability.


| Layer               | Technology Used               | Purpose                                               |
| :------------------ | :---------------------------- | :---------------------------------------------------- |
| **Frontend (Portal)**| Spotify Backstage / GetSol UI | Zero-YAML self-service cloud UI and catalog           |
| **GitOps Engine**   | Argo CD                       | Declarative continuous deployment & self-healing      |
| **Cloud Control**   | Crossplane (Upbound AWS)      | Multi-cloud infrastructure provisioning (AWS S3)      |
| **Policy-as-Code**  | Kyverno                       | Kubernetes-native admission controller for security   |
| **Infrastructure**  | K3s, AWS EC2, Ubuntu          | Lightweight Kubernetes runtime on cloud compute       |

The Closed-Loop GitOps Reconciliation Pipeline

To provide the fastest and safest experience, an Internal Developer Platform cannot rely on manual ticket approvals (which introduces latency) or un-governed CLI executions (which lacks security). Here is how the GitOps architecture solves this:

1. The Portal (Developer Intent): The developer interacts with the GetSol Web UI to request AWS resources (like S3 buckets) using simple form fields, submitting declarative intent without writing a single line of YAML.

2. The Guardrail (Kyverno): The Kubernetes API intercepts the request. Kyverno evaluates it against Policy-as-Code rules, instantly rejecting non-compliant deployments (e.g., missing ownership labels) before they reach the cloud.

3. The Engine (ArgoCD & Crossplane): Argo CD continuously reconciles the cluster state against Git. Approved requests are processed by Crossplane, which securely communicates with AWS APIs to provision the live infrastructure and injects dynamic environment variables back into the developer's microservice.

Visual Tour & Production Proof

To demonstrate the platform's end-to-end capabilities, here is a visual walkthrough of the GetSol IDP in action, from developer request to live cloud infrastructure.

1. The GetSol Self-Service Developer Portal

The developer-facing web application allows engineers to provision AWS infrastructure without writing code or interacting with complex cloud consoles.

GetSol Developer Portal

2. AWS Management Console S3 Verification

Live S3 storage buckets created in AWS us-east-1 directly triggered by the platform's Kubernetes control plane via Crossplane.

AWS S3 Verification

3. Argo CD GitOps Dashboard

The Argo CD control plane maintaining 100% synchronization and healthy states across all platform modules (Backstage, Crossplane, Kyverno, and the root platform).

Argo CD GitOps Dashboard

4. Kyverno Policy Guardrail in Action

Real-time demonstration of Kyverno blocking an un-governed pod due to missing ownership labels, enforcing shift-left security.

Kyverno Policy Guardrail

5. Live Developer Backend Microservice

The live containerized application running in high availability across multiple pods, seamlessly injected with the newly provisioned AWS storage credentials.

Live Developer Backend Microservice

Code Spotlight: Solving Platform Engineering Complexities

1. Enforcing Shift-Left Security with Kyverno

A major issue with cloud deployments is un-tagged or orphaned infrastructure. I engineered a deterministic admission control policy using Kyverno to ensure every workload contains verifiable metadata before persistence. If a developer tries to deploy a rogue app without an owner label, the webhook instantly blocks it.


apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-owner-label
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: check-for-owner-label
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - default
    validate:
      message: "GetSol Security Violation: Every Pod must have an 'owner' label!"
      pattern:
        metadata:
          labels:
            owner: "?*"

2. Secure Cloud Credential Injection for Crossplane

To manage AWS resources natively via Kubernetes Custom Resources (eliminating brittle client-side Terraform), the platform must securely consume IAM secrets. I implemented a namespace-isolated injection mechanism to link AWS credentials to a cluster-scoped ProviderConfig.


# 1. Create the credential file locally
cat <<EOF > aws-creds.ini
[default]
aws_access_key_id = <YOUR_AWS_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_AWS_SECRET_ACCESS_KEY>
EOF

# 2. THE SECURE INJECTION
# Inject credentials into the crossplane-system namespace
kubectl create secret generic aws-creds \
    -n crossplane-system \
    --from-file=creds=./aws-creds.ini

# 3. Cleanup sensitive local files
rm aws-creds.ini

The Roadmap: Architecting GetSol V2

While the current iteration successfully provisions S3 storage via GitOps, an enterprise platform must continuously evolve. Rather than starting from scratch, I designed an architectural roadmap to extend the existing infrastructure into a fully-fledged GetSol V2:

  1. Expand the Resource Catalog: Create a unified UI catalog to support not just S3, but also compute (EC2) and relational databases (RDS).
  2. Crossplane Compositions: Build reusable Crossplane configurations (XRDs) for each supported resource, abstracting complex VPC and subnet networking away from the developer.
  3. Governance & Cost Control: Implement Single Sign-On (SSO) login, team-based authorization, resource quotas via Kyverno, and pre-deployment cost estimations.
  4. Lifecycle Management: Add Day-2 operational capabilities allowing developers to view, update, and safely delete (decommission) their resources directly from the portal.
  5. Spotify Backstage Integration: Integrate the entire GitOps loop natively into Backstage Software Templates, providing developers with a single, industry-standard unified portal.

The Impact of Platform Engineering for Developers

GetSol IDP demonstrates how modern platform engineering—when combined with thoughtful, GitOps-first architecture—can directly improve developer velocity. By leveraging Kubernetes, Argo CD, and Crossplane, the platform remains highly scalable, secure, and entirely eliminates infrastructure ticket friction, allowing developers to focus on writing code rather than managing YAML.

Muhammad Zubair - Software Engineer About the Developer I am Muhammad Zubair, a Software Engineer from Pakistan passionate about building AI-driven applications and cloud-native infrastructure that solve real-world problems.