If you’ve been following the rise of Internal Developer Platforms (IDPs), you’ve probably seen a lot of “platform engineering” buzzwords without much substance. OpenChoreo is different, and its architecture diagram tells the whole story.
<h3>The “Plane” Architecture - Why It Matters</h3>
OpenChoreo splits concerns into four distinct planes, each with a clear responsibility:
Control Plane The brain of the operation. It houses OpenChoreo Controllers, the API Server, Authorization and Access Control, and notably AI Agent Modules (SRE Agent). Everything you interact with (UI via Backstage, MCP, CLI, API) talks to the Control Plane. GitOps state is managed here via Flux.
Workflow Plane(s) Build and CI/CD live here. You get first-class support for Argo Workflows and Cloud Native Buildpacks, but the architecture is pluggable. Prefer GitHub Actions or Jenkins? There are community plugins for that too. This plane communicates with the Control Plane over WSS.
Data Plane(s) Where your actual workloads run. Isolated projects and environments with ingress/egress controls. The API Gateway layer supports kgateway . Elastic scaling is handled by KEDA (scale to zero), and security is enforced by Cilium and Kubewarden via the Guard Modules.
Observability Plane(s) A full observability stack, not bolted on, but built in as a first-class plane. Logging via OpenSearch and OpenObserve, metrics via Prometheus and Fluentbit, and tracing via OpenTelemetry. Workflow and runtime observability feed into this plane via dedicated pipelines.
<h3>Cross-Cutting Concerns Done Right</h3>
What stands out is how OpenChoreo handles the things most platforms leave as an exercise for the reader:
<ul>
<li>Authentication - Pluggable OAuth2/OIDC with WSO2 Thunder</li>
<li>Secret Management - Any ESO-compatible Secret Store / Key Vault</li>
<li>Container Registry - Any OCI-compliant registry</li>
<li>GitOps - Any Git provider via Flux</li>
</ul>
<h3>The AI Angle</h3>
The embedded AI Agent Modules in the Control Plane are worth a closer look. Having SRE, FinOps, and Architect agents as first-class citizens, not third-party add-ons, signals where platform engineering is heading. Pair that with the Observer MCP in the Observability Plane and you have a foundation for genuinely agentic platform operations.
<h3>Why OpenChoreo?</h3>
<ul>
<li>Kubernetes-native across all planes</li>
<li>Pluggable at every layer, no vendor lock-in</li>
<li>AI agents as first-class platform citizens</li>
<li>Full observability built-in, not bolted on</li>
</ul>
If you are building or evaluating an IDP in 2025, OpenChoreo’s architecture is worth a deep dive. The plane separation alone makes it one of the cleaner open source platform designs out there.
<a href="https://openchoreo.dev/" target="_blank" rel="noopener nofollow">https://openchoreo.dev/</a>

🚀 Daily Open Source Tools Squad delivers daily articles, open-source projects, and technical resources for Developers & DevOps pros. Stay updated with the latest trends & insights!

📬 Join our mailing list! → theinfinity.dev

Daily Open Source Tools

OpenChoreo is an open source Internal Developer Platform (IDP) built around a four-plane architecture: Control Plane (API server, controllers, AI agents via Flux/GitOps), Workflow Plane (Argo Workflows, Cloud Native Buildpacks, pluggable CI/CD), Data Plane (workload isolation, KEDA scaling, Cilium/Kubewarden security, kgateway), and Observability Plane (OpenSearch, Prometheus, OpenTelemetry). Cross-cutting concerns like auth (OAuth2/OIDC), secret management (ESO-compatible), and container registries are all pluggable. A notable feature is first-class AI Agent Modules (SRE, FinOps, Architect agents) embedded in the Control Plane, alongside an Observer MCP in the Observability Plane, positioning OpenChoreo for agentic platform operations.

OpenChoreo: The Open Source Internal Developer Platform That Gets the Plane Architecture Right