Infrastructure Strategy & Architecture
Define target architecture, standards, topologies and technology decisions for infrastructure products.
Orthevs Engineering Lab · IEL
Manage infrastructure as verifiable state, from the physical site to the cloud.
The Infrastructure Engineering Lab brings together data centers, hardware, network, compute, virtualization, storage, cloud, edge, automation and operations in a domain Control Plane for reproducible infrastructure.
Documented target state · Concept / Architecture Baseline
Infrastructure Lifecycle
InputDemandInventoryPolicies
Orthevs LabIELControl Plane
OutcomeResourcesServicesEvidence
Observed state, capacity, cost and drift drive further evolution
Domain application · target architecture
Independent engineering environment
The Lab is designed as a complete domain application with a workspace, editors, models and SDK-like interfaces. Its Factories are the specialist tools; Engines handle processing and execution. Shared Contracts connect it with other Labs.
Develop infrastructure resources, networks and physical or virtual topologies.
From Engineering Contract to verifiable outcome
- 01
Contract & Foundation
Requirements and rules select the domain foundation.
- 02
Lab Workspace
Models, editors and tools address the domain problem.
- 03
Factory & Engine
Specialist tools create artifacts and use suitable execution mechanisms.
- 04
Validation & Product
Tests, evidence and approvals lead to a versioned outcome.
The workflows and capabilities shown describe the documented target model. Check availability and maturity for each release and capability.
Mission and ambition
Infrastructure becomes a versioned, plannable engineering product.
Infrastructure is more than individual servers or cloud resources. Sites, power and cooling, hardware, address spaces, networks, compute, virtualization, storage and operational services form interdependent systems. IEL keeps these dependencies, responsibilities and handovers together in a shared domain model.
The Lab describes desired and observed state, plans changes before they are executed and carries them out through provider-independent capability contracts. Existing data center, virtualization, network and cloud tools remain usable via adapters; IEL does not replace them wholesale.
The first vertical slice connects Infrastructure Blueprint, hardware inventory, DNS/IPAM, provisioning and monitoring. This not only creates a resource but also makes its identity, connectivity, operability and future changeability verifiable.
Capability map
Twelve domains structure the Infrastructure Engineering Lab.
The domains organize responsibility and lifecycles. Within them, Factories deliver clearly bounded, versionable capabilities.
Physical & Datacenter Infrastructure
Model sites, racks, power, cooling, cabling and hardware inventory as a reliable foundation.
Compute & Virtualization Infrastructure
Manage bare metal, hypervisors, virtual machines and compute pools with capacity and lifecycle.
Network Engineering
Treat IPAM, DNS, routing, switching, load balancing and connectivity as versioned network services.
Storage & Data Infrastructure
Design block, file and object storage, data paths, performance, protection classes and lifecycle.
Cloud, Hybrid & Edge Infrastructure
Integrate public cloud, private cloud, hybrid topologies and edge sites through explicit provider profiles.
Infrastructure Automation
Orchestrate IaC, provisioning, configuration, workflows and reconciliation under control.
Observability & Operations
Correlate health, telemetry, events, diagnostics and operational states across infrastructure boundaries.
Resilience & Lifecycle
Represent backups, failover, disaster recovery, migration and decommissioning as tested procedures.
Security & Compliance
Embed segmentation, hardening requirements, access, policy and infrastructure Evidence.
Asset, Cost & Governance
Bring together inventory, ownership, capacity, cost, quotas and decision records.
Integration & Service Enablement
Provide infrastructure as a consumable capability for PEL, OSEL and other Labs.
Use cases
IEL starts with the complete engineering problem.
The scenarios combine several Factories into one dependable flow. They describe the documented target state, not a product function that is already committed.
1Datacenter Foundation
Capture a site as a consistent infrastructure model
Racks, power paths, hardware, cabling, address spaces and management access are inventoried and connected in a topology. Capacity and dependency checks form the basis for later provisioning.
- Physical inventory and ownership
- Power, network and rack dependencies
- Capacity and lifecycle status
2Provisioning
Provision compute, network and storage from a Blueprint
An approved Infrastructure Blueprint is translated into provider-specific plans. DNS/IPAM, network segments, compute and storage are created, verified and registered as consumable resources in a defined order.
- Plan and change diff
- Idempotent provider operations
- Readiness and handover
3Hybrid & Edge
Operate distributed sites consistently, but not identically
Cloud, data center and edge targets use shared contracts but retain their own capability, latency and security profiles. Rollouts account for limited connectivity, local failure domains and controlled offline procedures.
- Provider and site profiles
- Local autonomy with central governance
- Offline and reconnect behavior
4Lifecycle & Resilience
Bring drift, capacity limits and outages under control
Observed state is checked against the approved target design. Deviations, bottlenecks and health signals lead to a plan, an approved correction or a recovery procedure rather than uncontrolled one-off changes.
- Freshness and drift
- Capacity and cost context
- Recovery and retirement Evidence
End-to-end lifecycle
From the requirement to the controlled next state.
IEL connects strategic planning, physical and virtual provisioning and Day 2 operations in a continuous infrastructure lifecycle.
- 1Discover
Capture demand and inventory
Record sites, assets, services, dependencies, owners and protection requirements.
- 2Design
Design the topology
Define compute, network, storage, failure domains and operational objectives as a Blueprint.
- 3Plan
Calculate impact
Check provider capabilities, capacity, cost, policies and change diff in advance.
- 4Approve
Approve the change
Present risk, scope, maintenance window and recovery procedure to accountable roles.
- 5Provision
Create resources
Orchestrate physical, virtual and cloud capabilities idempotently.
- 6Configure
Connect services
Configure network, DNS, storage, access and operational integrations.
- 7Validate
Check readiness
Test connectivity, capacity, security, health and handover criteria.
- 8Operate
Observe state
Bring together inventory, telemetry, cost, drift, incidents and SLOs.
- 9Evolve
Adjust capacity
Expand, migrate, patch and optimize with a new plan and Evidence.
- 10Recover
Restore services
Test failover, restore and alternative paths under realistic conditions.
- 11Retire
Decommission resources
Resolve dependencies, handle data, revoke access and retire assets.
Closed feedback loop
Observed state, capacity, cost and drift drive further evolution. Insights are not merely documented; they flow, versioned, into the next engineering cycle.
Reference architecture
Desired state, inventory and provider reality are never confused with one another.
IEL maintains a domain infrastructure model and controls execution through adapters without turning provider objects into the domain model unchecked.
Orthevs Platform
IAM, secrets, policy, audit, eventing, registry and artifact storage.
IEL Core & API
Blueprints, topology, inventory, desired/observed state, planning, jobs and operation ledger.
IEL Factories
Data center, compute, network, storage, cloud, automation, operations and governance.
Execution Plane
Hardware, hypervisors, network controllers, storage, cloud APIs, edge and isolated runners.
Declarative First
A typed target design leads; manual reality remains visible as an observation.
Plan before Apply
Cost, capacity, policies, dependencies and impact are checked before mutations.
Provider-capable, not provider-bound
Domain objects remain stable; adapters declare their actual capabilities.
Physical matters
Location, power, cabling and hardware remain part of the digital topology and failure domains.
Lab Core
Shared responsibilities keep the Factories integrable.
The Lab Core bundles the cross-cutting domain services; a Factory adds a capability without rebuilding these foundations in parallel.
IEL is treated as an independent microservice with its own Docker runtime.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
IEL has its own Core layer for domain coordination, Factory Manager, jobs, workflows and artifact references.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
IEL has its own API layer for external clients, frontend/BFF, internal Core communication and lab-to-lab communication.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
IEL communicates with other Labs and the Orthevs Platform exclusively through documented APIs, events and Capability Contracts.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
Every IEL Factory is a plugin of the IEL microservice, not a separate Lab microservice.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
Factory plugins are installed, versioned, authorized, monitored and executed by the IEL Core through defined plugin/capability contracts.
Shared IEL function for consistent APIs, lifecycles and verifiable handovers.
Domain model and evidence
Topology and operations connect physical and digital infrastructure.
InfrastructureBlueprint, Site, Asset, Network, ComputePool, StorageService and Deployment form a coherent resource model. References retain provider identity and ownership without coupling to the internal databases of other systems.
Observations carry timestamps and freshness. An unknown or stale actual state is not interpreted as healthy. Large plans, inventory exports and Evidence are kept as referenced artifacts outside transactional metadata.
InfrastructureBlueprint
Topology, variables, dependencies, policies and service objectives.
Site & Asset
Location, rack, hardware identity, owner, support and lifecycle status.
NetworkService
Address spaces, DNS, routing, segmentation and connectivity contract.
ComputePool
Capacity, placement, accelerators, quotas and failure domain.
StorageService
Class, performance, replication, encryption and protection profile.
InfrastructureOperation
Plan digest, approval, execution, result, Evidence and recovery path.
Security, governance and operations
Infrastructure automation is only as secure as its credentials and change boundaries.
IEL separates Control Plane and Execution Plane, limits provider permissions and treats plan, apply and recovery as auditable security boundaries.
Limit provider access
Credentials are short-lived, scope-bound and never stored in Blueprints.
- Workload identity
- Secret broker
- JIT and revocation
Show impact in advance
Every mutation has a plan, diff, risk, approval and idempotency key.
- Preflight and policy
- Maintenance windows
- Four-eyes principle for critical changes
Constrain execution
Runners receive only the target, network and time permissions required for the specific operation.
- Ephemeral runners
- Egress control
- Resource limits
Take failure domains seriously
Redundancy counts only after tested failover and documented restore.
- RPO/RTO per service class
- Isolated exercises
- Evidence and postmortem
Interplay within the Orthevs system
IEL provides reliable infrastructure capabilities for the Engineering Labs.
Other Labs do not consume provider access directly but well-scoped resource and operation contracts.
Requirement→IEL Plan→Provider Operation→Readiness→Lab Consumption→Observed State
Platform Engineering
Consumes compute, network, storage and sites for clusters and platform products.
Operating System Engineering
Receives hardware, VM, network and storage targets for provisioning and fleet lifecycle.
AI & ML Engineering
Uses CPU, GPU, storage and data path profiles for training and inference.
Blockchain Engineering
Obtains node, validator, RPC and indexer infrastructure with defined failure domains.
Security Engineering
Reviews infrastructure controls, exposures and Evidence and returns security gates.
Roadmap target state
The first vertical slice connects Blueprint, inventory and real provisioning.
IEL extends provider coverage and automation only once ownership, plannability and observability have been demonstrated in the reference path. The phases are deliberately described without binding delivery dates.
- Phase 0Foundation
Architecture and contracts
Factory manifest, capability, artifact and event contracts, core API, operation ledger and security boundary.
Exit Gate: Blueprint, plan and operation are versioned and verifiable. - Phase 1Vertical Slice
Blueprint to monitoring
Infrastructure Blueprint, hardware inventory, DNS/IPAM, provisioning and monitoring in one end-to-end path.
Exit Gate: a resource is created, addressed, checked and observed. - Phase 2Production Readiness
Operations and security gates
Contract tests, packaging, scalable runners, observability, approval, backup and recovery.
Exit Gate: errors, retries, aborts and recovery are traceable. - Phase 3Cross-Lab
Infrastructure as an Orthevs capability
Standardized handovers to PEL, OSEL, AMEL, BCEL and SEL with ownership and events.
Exit Gate: at least one Lab consumes IEL without database or credential coupling. - Phase 4Enterprise
Governance, resilience and scaling
Multi-site, hybrid/edge, cost, capacity, governance, DR and advanced automation.
Exit Gate: operating profiles and failure domains are tested and measurable.
MVP scenario
Blueprint → Inventory → DNS/IPAM → Provisioning → Monitoring
From an approved Infrastructure Blueprint, the MVP creates a clearly identified resource, assigns its network and DNS context, checks reachability and capacity, and hands it over to operations with a current observed state.
Deliberate boundaries
What the target state explicitly does not promise.
Named non-goals protect the Lab from a broad but unintegrated tool catalog and keep technical statements verifiable.
- IEL does not replace any hypervisor, network, storage or cloud platform from scratch.
- Provider functions count as supported only when the adapter explicitly declares and tests them.
- A successful apply without readiness and observability evidence is not a completed infrastructure operation.
- Destructive changes require dependency checks, data handling, approval and a recovery path.
- Unknown or stale actual state is not presented as healthy or compliant.
- The 48 Factories are activated in phases along real infrastructure pathways.
IEL Factory Portfolio
48 capabilities across 12 domains.
Every Factory has its own detail page covering responsibility, use cases, artifacts and contract. The catalog represents the planned capability map.
Asset, Cost & Governance
4 FactoriesAsset Management Factory
Maintain asset master data, ownership, contracts, and lifecycle status.
Open detail page ↗CMDB Integration Factory
Connect CMDB, inventory, and discovery systems through contracts.
Open detail page ↗FinOps Infrastructure Factory
Make costs, consumption, reservations, and infrastructure budgets transparent.
Open detail page ↗Lifecycle Management Factory
Control refresh cycles, EOL and EOS data, and technical debt.
Open detail page ↗Cloud, Hybrid & Edge Infrastructure
4 FactoriesCloud Infrastructure Factory
Prepare cloud accounts, landing zones, and foundational infrastructure resources.
Open detail page ↗Edge Compute Factory
Model edge sites, small compute cells, and local infrastructure profiles.
Open detail page ↗Hybrid Connectivity Factory
Design hybrid-cloud connections, routing, and site interconnections.
Open detail page ↗Remote Site Factory
Roll out branches, remote sites, and remote infrastructure reproducibly.
Open detail page ↗Compute & Virtualization Infrastructure
4 FactoriesBare Metal Factory
Coordinate bare-metal provisioning, firmware, BIOS, and out-of-band access.
Open detail page ↗GPU & Accelerator Factory
Provide GPU, FPGA, and accelerator capacity for specialized workloads.
Open detail page ↗Hardware Inventory Factory
Inventory servers, appliances, serial numbers, warranty, and lifecycle data.
Open detail page ↗Virtualization Host Factory
Prepare virtualization hosts, hypervisor profiles, and cluster resources.
Open detail page ↗Infrastructure Automation
4 FactoriesAnsible Automation Factory
Bundle Ansible inventories, roles, playbooks, and idempotent operational flows.
Open detail page ↗Drift Reconciliation Factory
Compare desired and observed state and prepare controlled reconciliation.
Open detail page ↗Infrastructure Provisioning Factory
Control provisioning through IaC, API, and orchestration adapters.
Open detail page ↗Terraform Automation Factory
Standardize Terraform modules, state backends, and plan and apply flows.
Open detail page ↗Infrastructure Strategy & Architecture
4 FactoriesCapacity & Footprint Factory
Plan capacity, footprint, power consumption, and growth.
Open detail page ↗Infrastructure Blueprint Factory
Target architectures, resource models, and reusable infrastructure blueprints.
Open detail page ↗Infrastructure Roadmap Factory
Structure infrastructure roadmaps, modernization paths, and investment windows.
Open detail page ↗Topology Design Factory
Model site, network, compute, and storage topologies.
Open detail page ↗Integration & Service Enablement
4 FactoriesITSM Integration Factory
Connect change, incident, problem, and request processes to ITSM systems.
Open detail page ↗Operating System Enablement Factory
Prepare handovers to OSEL for images, hosts, and OS baselines.
Open detail page ↗Platform Lab Enablement Factory
Structure handovers to PEL, SEL, AMEL, and BCEL through Capability Contracts.
Open detail page ↗SRE Interface Factory
Deliver SRE interfaces, error budgets, and operational data to platform and service teams.
Open detail page ↗Network Engineering
4 FactoriesDNS & IPAM Factory
Manage DNS zones, IP address spaces, reservations, and naming conventions.
Open detail page ↗LAN Fabric Factory
Model switching fabrics, VLANs, VRFs, and local network transitions.
Open detail page ↗Load Balancing & Proxy Factory
Provide load balancers, reverse proxies, and traffic paths as an infrastructure capability.
Open detail page ↗WAN Connectivity Factory
Manage WAN, provider, VPN, and site connections.
Open detail page ↗Observability & Operations
4 FactoriesAlerting Factory
Model alerts, escalations, and on-call signals for infrastructure events.
Open detail page ↗Logging & Metrics Factory
Normalize and forward logs, metrics, and infrastructure telemetry.
Open detail page ↗Monitoring Factory
Collect infrastructure metrics, health checks, and availability signals.
Open detail page ↗Runbook Operations Factory
Provide runbooks, standard operating procedures, and recurring operational actions.
Open detail page ↗Physical & Datacenter Infrastructure
4 FactoriesCabling & Connectivity Factory
Plan cabling, cross-connects, patch panels, and physical connectivity.
Open detail page ↗Datacenter Design Factory
Design datacenter zones, rooms, racks, and physical constraints.
Open detail page ↗Power & Cooling Factory
Assess power supply, UPS, cooling, and thermal reserves.
Open detail page ↗Rack & Room Factory
Manage rack layouts, room occupancy, and installation planning.
Open detail page ↗Resilience & Lifecycle
4 FactoriesDecommissioning Factory
Make infrastructure decommissioning, data cleanup, and dismantling traceable.
Open detail page ↗Disaster Recovery Coordination Factory
Coordinate recovery plans, exercises, and infrastructure restart.
Open detail page ↗High Availability Factory
Assess high-availability designs, redundancy, and failure-domain models.
Open detail page ↗Maintenance Window Factory
Structure maintenance windows, change calendars, and operational approvals.
Open detail page ↗Security & Compliance
4 FactoriesHardening Factory
Manage hardening profiles for network, compute, storage, and management components.
Open detail page ↗Infrastructure Security Factory
Coordinate infrastructure security baselines, hardening, and control points.
Open detail page ↗PKI Integration Factory
Provide certificates, trust stores, and PKI integrations for infrastructure.
Open detail page ↗Segmentation & Compliance Factory
Represent segmentation, zone models, and compliance evidence for infrastructure.
Open detail page ↗Storage & Data Infrastructure
4 FactoriesBackup Infrastructure Factory
Prepare backup targets, infrastructure policies, and retention profiles.
Open detail page ↗Data Protection Factory
Coordinate snapshots, replication, encryption, and protection classes.
Open detail page ↗Filesystem Factory
Manage filesystems, mounts, shares, and performance profiles.
Open detail page ↗Storage Infrastructure Factory
Design and provide block, file, and object storage infrastructure.
Open detail page ↗Shape IEL together
Which infrastructure pathway should become fully plannable first?
A data center inventory, a compute provisioning flow or a hybrid/edge pathway can be detailed as a vertical slice with clear topology, readiness and operational handover.