Control Plane Overview
The FastAPI backend that powers identity, workspaces, ReBAC, secrets, files, and app metadata.
The Control Plane is Groundfloor's platform management layer. One FastAPI backend (app/) serves both the Customer Portal and Operator Admin via /v1/* and /v1/admin/* route groups.
Stack
| Layer | Technology |
|---|---|
| API | Python 3.12 · FastAPI · asyncpg (plain SQL) |
| Identity | Keycloak (customer JWT) |
| Authorization | SpiceDB (direct gRPC) — schema in schema.zed |
| State | Postgres (gf_controlplane) |
| Object storage | S3-compatible (MinIO local, S3/R2/GCS prod) |
| Secrets | Infisical (pluggable SecretBackend) |
| Logs | Loki via Fluent Bit |
| LLM | LiteLLM + Redpanda CU billing |
| Events | Redpanda lifecycle topics |
Closed action vocabulary
SpiceDB enforces a fixed set of actions: administer, read, write, delete, ddl, deploy, manage_members, view_billing.
Tenant provisioning
Normal customers do not self-serve account creation in production unless ALLOW_CUSTOMER_ACCOUNT_CREATE=true. Groundfloor operators provision accounts via POST /v1/admin/accounts with an owner email.
Related
- Identity & auth — Keycloak and JWT flow
- ReBAC model — permissions and roles
- Provisioning — workspace saga
- Architecture — component diagram
- Core concepts — resource hierarchy
- API introduction — REST endpoints