Cloud-native Kubernetes operator · CNCF stack

Work in progress

Your static frontend, servedin your own Kubernetes cluster

Frontier declaratively orchestrates the distribution of static frontend pages across your Kubernetes cluster with a 3-tier cache, Gateway API and OCI origins. No complexity — just CRDs.

Deploy to your clusterSee the architecture
origin.yaml
apiVersion: frontier.k8s.io/origin/v1
kind: Origin
metadata:
  name: my-origin
  namespace: default
spec:
  target:
    distribution: my-distribution
    securityPolicy: my-security-policy
    gateway:
      kind: Gateway
      name: default
      namespace: traefik-system
    route:
      hostnames:
        - sgt911.dev
      pathPrefixes:
        - /
  type: OCI
  oci:
    artifact: quay.io/frontier/hello:latest
    artifactPullPolicy: IfNotPresent

GitOps

state declared as code

Governance

policies and limits per resource

Gateway API

native integration on every origin

Self-healing

the cluster converges to desired

Product

Declarative end to end

Describe the desired state and let Frontier manage the whole distribution: workloads, networking, cache and security.

Declarative distributions

Express the desired state with Kubernetes CRDs and let the operator converge the cluster. No dashboards, no scripting — pure manifests.

3-tier cache

Cold on source nodes, hot on edge nodes and warm via gossip between peers. Your content served from the closest node.

OCI origins

Ship your frontend as an OCI image and Frontier pulls, extracts and caches it automatically across the whole fleet.

Native Gateway API

Every Origin is an HTTPRoute. Traefik, Kong or any Gateway API provider routes straight into the edge nodes.

Governance by policy

HSTS, CORS, CSP and custom headers injected as route filters, managed declaratively as versioned resources.

Elastic source pool

The source node pool autoscales with HPA according to cold cache demand, with PVC or emptyDir persistence.

Architecture

Operator, Source Nodes and Edge Nodes

A single repository builds all three images. The operator orchestrates, the daemons run the caching, gossip and serving logic.

Operator

Controller Manager that reconciles the CRDs and generates workloads, services, ConfigMaps and HTTPRoutes with a full reconcile loop.

Source Nodes

StatefulSet with persistence that pulls OCI artifacts, extracts the content and serves the cold tier to the edge nodes.

Edge Nodes

DaemonSet on every node of the cluster: in-memory hot tier, warm gossip between peers and proxying to the source node on cold miss.

Cache

Three tiers governed by CachePolicy

Global and per-origin limits: size, entries, TTL and file size. All configurable as a ConfigMap.

Cold

Source Nodes

Disk-backed cache with optional persistence. Pulls OCI artifacts and extracts the static content.

Warm

Edge Nodes · gossip

Entry metadata shared between peers over memberlist, with direct HTTP fetch between edge nodes.

Hot

Edge Nodes

In-memory, high-speed cache close to the end user. TTL, limits and eviction governed by CachePolicy.

Gateway API

Every Origin is an HTTPRoute

Frontier attaches your origins to any spec-compliant Gateway — Traefik, Kong, ALB — and manages cross-namespace references with dynamic ReferenceGrants.

Client

Requests your app

Gateway

Traefik · Kong · ALB

Edge Pool

Hot → Warm → Cold

How it works

From manifest to production in three steps

01

Apply your CRDs

Distribution, CachePolicy, SecurityPolicy and Origin describe the desired state.

02

The operator reconciles

It generates edge DaemonSets, source StatefulSets, services, ConfigMaps and HTTPRoutes.

03

Traffic flows to the edge

Client → Gateway → HTTPRoute → Edge Node, resolving hot, warm and cold cache.

Take your frontend to the edge of your cluster today

Static frontend + Kubernetes + Gateway API + 3-tier cache. All declared as code.

Read the docsExplore the code