Demystifying OpenChoreo: An Architecture Overview
Many organizations invest in internal developer platforms (IDPs) to reduce cognitive load and enforce organization-wide standards. However, designing, building, and maintaining a production-grade platform on top of Kubernetes is inherently complex. Platform teams are often burdened with managing the Kubernetes API, integrating CI/CD and observability tooling, and configuring multi-tenancy access controls.
OpenChoreo addresses these challenges by providing a complete, modular, and open-source developer platform for Kubernetes. Originally developed by WSO2 as the successor to its SaaS WSO2 Developer Platform (formerly WSO2 Choreo), OpenChoreo brings battle-hardened platform engineering experience to the open-source community. Today, the project is part of the Cloud Native Computing Foundation (CNCF) ecosystem as a Sandbox project.
The Core Philosophy: Augmenting, Not Obscuring, Kubernetes
A common pitfall of many developer platforms is the attempt to hide Kubernetes behind proprietary layers or “black box” abstractions. OpenChoreo takes a different approach: it keeps Kubernetes visible and operable.
As a guiding principle, OpenChoreo augments Kubernetes rather than obscuring it. All platform APIs and programmable developer abstractions are Kubernetes-native. By using Kubernetes as the underlying system of record, OpenChoreo ensures a declarative platform and application state that natively supports GitOps. This design allows infrastructure teams to maintain full operational control while providing application developers with a simplified, self-service experience through golden paths that span the software development life cycle (SDLC).
A Multi-Plane Architecture
At the heart of OpenChoreo is a multi-plane architecture that separates the concerns of control, runtime data, workflows, and observability. This separation of concerns enables flexible deployment topologies across multiple clusters and cloud providers, allowing platform engineers to scale specific layers of the platform without needing to re-architect the whole system.
The architecture is divided into four distinct planes:
- Control Plane: Acting as the central “Brain” of the platform, the Control Plane orchestrates all other planes based on intent declared via APIs. It serves as the primary interface point for the CLI, API, MCP, and UI.
- Data Plane(s): This is where application workloads actively run. The Data Plane handles logical environments, project and tenant isolation, gateway topologies, and runtime and network security.
- Workflow Plane(s): Dedicated to automation, this plane executes builds and CI workflows. It also handles general-purpose automation tasks, such as Infrastructure as Code (IaC) rollouts.
- Observability Plane(s): To provide a unified view of system health, this plane ingests and provides APIs for distributed logs, metrics, traces, and alerts, pulling data from both the runtime and workflow planes.
Modularity and Integration
No two internal developer platforms are exactly alike, which is why OpenChoreo relies on a highly extensible, module-based architecture. Platform teams can use OpenChoreo’s default modules or replace them with preferred external tools from the modules catalog.
Out of the box, OpenChoreo integrates abstractions that platform and application teams need, including:
- A Backstage-powered developer portal.
- Built-in agents for site reliability engineering, cost control, and architecture.
- Native support for AI-assisted development and operations, allowing seamless integration with AI assistants like Claude Code and Codex.
Getting Started
OpenChoreo offers a holistic platform experience that unifies APIs and modules into an intent-driven ecosystem. For developers and platform engineers looking to test these architectural concepts firsthand, OpenChoreo can be deployed locally in minutes using Docker and K3d, as outlined in the Quick Start Guide.
