Platform Scope & Ecosystem Boundaries
Carpenter operates as an isolated infrastructure foundation designed for high-throughput compute, edge ingress, and container orchestration. It does not function as an umbrella portal for organizational IT or auxiliary microservices.
Engineers must understand the strict boundary between Carpenter-managed infrastructure and adjacent enterprise services.
Domain Boundary Matrix
Section titled “Domain Boundary Matrix”The table below outlines operational responsibility boundaries. Cross-domain requests must adhere to explicit mutual TLS and token exchange protocols.
| Domain / Subsystem | In Carpenter Scope? | Governing Authority | Documentation Hub |
|---|---|---|---|
| Edge Ingress & Tunnels | Yes | Carpenter Infra Team | This Documentation |
| AWS Multi-Region Fabrics | Yes | Carpenter Systems | This Documentation |
| Bare-Metal Compute Clusters | Yes | Carpenter Hardware Ops | This Documentation |
| Global IAM & Identity Provider (IdP) | No | Enterprise SecOps | https://iam-docs.<zone-domain> |
| Audit Logs & Long-Term SIEM | No | SecOps & Compliance | https://compliance.<zone-domain> |
| Shared Persistent Databases (DBAAS) | No | Data Platforms Team | https://data-hub.<zone-domain> |
| CI/CD Build Pipelines | No | Developer Experience | https://pipelines.<zone-domain> |
Architectural Segregation Principles
Section titled “Architectural Segregation Principles”1. Isolated PKI Roots
Section titled “1. Isolated PKI Roots”While Carpenter services share intermediate certificates for mTLS verification, identity issuance for adjacent systems (e.g., enterprise SSO, VPNs) stems from independent Root CAs. A valid client certificate for Carpenter does not automatically grant ingress to sister platforms.
2. Autonomous Service Registries
Section titled “2. Autonomous Service Registries”Carpenter maintains its own dynamic discovery table for ingress nodes. External platforms publish their contracts and schema specifications via independent API gateways. Do not attempt to route internal database queries or build webhooks through Carpenter ingress nodes.
3. Cross-Platform Handshakes
Section titled “3. Cross-Platform Handshakes”When an application hosted within a Carpenter cluster must communicate with an external corporate resource (e.g., fetching a database connection pool from Data Platforms):
- Traffic leaves Carpenter egress via isolated WireGuard interfaces.
- Authentication transitions from TLS transport assertion to scoped OAuth2/mTLS bearer tokens issued by the target platform.