// the platform

One platform, from infrastructure to production.

Ybor provisions production Kubernetes in your cloud, then delivers your applications onto it. Commit to production in minutes, governed by default. Your team owns the source code, the clusters, and the data, on open foundations you can walk away with.

  • AICPA SOC for Service Organizations logoSOC 2 Type 2
  • AzureRuns in your AzureYour accounts · AWS coming soon
  • No lock-inOpen-source core
delivery · pipeline
delivery layer
commit ci build scan deploy live
statusDeployed to prod · a3f9c12
runs on the foundation
foundation · clusters
foundation layer
AKSMicrosoft Azure
EKSAWScoming soon
control planereconciling · 12/12 in sync
// three ways in

Same platform. Use it the way you work.

Click through Ybor Studio, script it from a terminal, or edit manifests in your IDE. Every path ends in the same place: a pull request to Git that operators reconcile.

studio.ybor.ai / catalog / blueprints
1/5Browse maintained blueprints
 no Kubernetes needed

Pick a blueprint. Get a running service.

Business builders and new developers work entirely in Studio. Guided steps, sensible defaults, nothing to configure that they don't need to see.

  • Blueprints with the pipeline built in
  • Databases attached in a click
  • Promotion and health at a glance
~/code · zsh
 comfortable with git + CLI

Stay in the terminal.

Developers render the same blueprints from the CLI, push to GitHub, and query state with the tools they already use. No context switch to a browser.

  • archetect render for any blueprint
  • CI runs on every push
  • Platform resources are plain Kubernetes objects
acme/.platform · editor
.platform/ installables/ redis.yaml istio.yaml applications/ orders-api.yaml policies/
1apiVersion: platform.ybor.ai/v1 2kind: InstallableSource 3metadata: 4 name: redis 5spec: 6 chart: oci://registry.acme.dev/charts/redis 7 version: "20.6.*" 8 destinations: [dev, stg, prd]9 promotion: kargo10 overrides:11 prd: { replica.replicaCount: 3 }
● PR #1482 opened · 4 checks passed
✓ Merged · ArgoCD synced to DEV → STG → PRD
 owns the platform

Everything is a manifest.

Platform engineers work in the .platform repo, the same files Studio writes. Review in pull requests, extend with your own compositions and installables.

  • Git is the record of every change
  • Custom installables and blueprints
  • Policy and RBAC as code
// one source of truthStudio, the CLI and your IDE all write to the same Git repos.
// one review pathEvery change is a pull request with checks, whoever made it.
// one reconcilerOperators apply what merged. No drift between doors.
// delivery layer

Less wiring. More shipping.

Everything a service needs to reach production (scaffolding, pipelines, secrets) generated once and enforced on every commit.

~/code · zsh
$ archetect render python-fastapi-service --name orders-api
fetching ybor-studio/archetypes@2.0.1
orders-api/
├── .github/workflows/build.yml promote.yml
├── app/main.py app/models.py
├── tests/test_health.py
├── deploy/platform-application.yaml
└── Dockerfile README.md
✓ 19 files · ready to push
acme/orders-api · actions
push to main · a3f9c12 · run #214
✓ test38s
✓ build image1m 02s
✓ sign (Sigstore)4s
✓ generate SBOM6s
✓ scan image21s
✓ policy check (Kyverno)3s
✓ all checks passed · image registry.acme.dev/demo-org/orders-api:a3f9c12
kargo · orders-api
DEVHealthyauto on merge
STGHealthygreen for 2h · tests passed
PRDHealthyapproved by on-call
✓ v1.0.0 promoted to production · a3f9c12 · 3 gates passed
deploy/platform-application.yaml
env:
vault:
DATABASE_URL: orders-api/db#url
STRIPE_KEY: orders-api/stripe#key
──────────── at deploy ────────────
✓ DATABASE_URL injected vault · rotated 3d ago
✓ STRIPE_KEY injected vault · rotates in 27d
✓ 0 secrets in Git · audit event written
every deploy above lands on the foundation below
// foundation layer

Provision once. Govern forever.

The clusters, policies, and secrets every delivery lands on, declared in Git, reconciled by operators, defensible in an audit.

acme/.platform · clusters/prd-use1.yamlIDE
1 apiVersion: platform.ybor.ai/v1
2 kind: PlatformCluster
3 metadata: { name: prd-use1 }
4 spec:
5 provider: azure
6 region: eastus
7 kubernetes: "1.31"
8 nodePools: [{ name: general, min: 3, max: 12 }]
✓ PR #311 merged · platform-cluster-operator: Ready · 14m
studio.ybor.ai / catalog / installablesStudio UI
1/5Installables catalog
~/ · zshCLI
$ kubectl get environments -n demo-org
NAME CLUSTER APPS STATUS
dev dev-use2 14 Ready
stg stg-use2 14 Ready
prd prd-use1 12 Ready
$ kubectl get ns -l app=orders-api
NAME STATUS
demo-org-orders-api-dev Active
demo-org-orders-api-stg Active
demo-org-orders-api-prd Active
studio.ybor.ai / settings / governanceStudio UI
Governancedemo-org · all environments
Policies14 / 14 passingaudit mode · enforce when ready
mTLSStrictIstio · every workload
RBACScopedOrganization → Application
Audit log
j.riveramergedinstallables/redis.yaml2m ago
ci-botpromotedorders-api v1.0.0 → prd6m ago
m.chenupdatedpolicy require-probes1h ago
// the connective tissue

One object model ties delivery to infrastructure.

The same primitives the delivery layer scaffolds are the primitives the foundation layer schedules. An Application deploys to Environments; Environments are scheduled onto Clusters. Enterprise to Cluster, it's one model.

// integrations

Built on open source. Plays with what you already run.

AzureAKS
AWSEKScoming soon
Java
.NET
Python
Rust
TypeScript
GitHub ActionsCI
ArgoCDGitOps deploy
Kargopromotion
Harborregistry
Istioservice mesh
Kyvernopolicy
Vaultsecrets
cert-managercertificates
OpenTelemetrytraces
Grafanadashboards
Prometheusmetrics
Datadogoptional

Don't see your tool? Ybor is extensible by design: add a Crossplane composition for any cloud resource, register a custom installable for any cluster addon, generate an archetype for any stack.

See the full reference

// security

Security your reviewers can verify.

Ybor's own controls are covered by a SOC 2 Type 2 report. On your clusters, signed deploys, Kyverno policies, mTLS, Vault-backed secrets and audit logs to your SIEM are on by default, reviewed once by your security team.

Read the security overview

See the whole platform reconcile a cluster and ship a service.

Bring your stack. We'll walk the object model, bring a real cluster up live, ship a service onto it commit-to-prod, and let your security team grill us.

Book a demo Open the architecture docs