OpenChoreo brings jurisdiction-aware workload placement to Kubernetes platforms
An open source internal developer platform separates control from data planes to let regulated workloads declare their geographic residency and enforce it through declarative policy.
Disclaimer
This article was produced by Scroll Insights News Desk using automated systems and published under our standing editorial policy. It is compiled from the primary sources linked above and is provided for general information only — it is not legal, financial, investment, tax or professional advice, and no decision should be taken on it without independent verification against those sources. Errors can be reported to corrections@scrollinsights.com and are corrected on the record.
OpenChoreo, a CNCF Sandbox project, released a multi-plane architecture on August 18 designed to let platform teams enforce data residency and jurisdictional boundaries in Kubernetes environments without modifying how workloads run.
The system separates control, data, observability, workflow and experience planes into distinct layers. A central control plane—which holds desired state through declarative APIs and runs reconciliation controllers but never executes tenant workloads—orchestrates the others through outbound, mutually authenticated connections. Each data, observability and workflow plane initiates its own connection to a gateway in the control plane; the control plane never opens inbound connections into them.
Why the separation matters for regulated environments
Regulatory regimes including the EU Data Act, NIS-2, DORA and the UK Data Use and Access Act require platform teams to demonstrate control, security and governance of operations down to the control plane itself. By isolating workload execution in separate data planes, OpenChoreo lets teams satisfy those demands without changing how developers deploy Kubernetes resources. Workloads remain standard Kubernetes objects running on conformant clusters in public cloud, on premises or bare metal; the platform layer manages where they land.
Multi-plane topology does not change the legal jurisdiction of the organization operating the infrastructure, but it provides the technical tooling to demonstrate compliance. OpenChoreo's entire topology can live in Git as declarative resources showing which region holds which data plane, which observability sink it uses and which promotion paths are allowed. Promotion pipelines at the platform layer decide which environments a component may move between, preventing workload drift into the wrong jurisdiction through ad-hoc deployment.
Isolating tenants and controlling network exposure
OpenChoreo supports two patterns for multi-tenancy. In the tenant-cluster model, each tenant gets a virtual control plane with its own API server and datastore running as pods inside a shared host cluster. Tenant A cannot see tenant B's resources, cannot be taken down by tenant B's misbehaving custom resource definitions or webhooks, and cannot touch tenant B's cluster state. In the composed topology, one physical host cluster per jurisdiction runs virtual clusters as per-tenant data planes, coordinated by a single control plane over outbound mutual TLS links.
For workloads handling sensitive data, API servers are never exposed to the internet. Connections flow outbound only, limiting the network surface available to attackers or compromised processes.
OpenChoreo's DataPlane resource carries a jurisdiction label to make tenant placement declarative and reviewable. Separately, observabilityPlaneRef pins telemetry to the regional observability plane, so a tenant's logs inherit the same residency guarantee as its workloads. Secrets and keys can be stored in External Secrets Operator-compatible vaults.
What the platform does and does not enforce
Multi-plane topology draws boundaries but does not enforce what happens inside them. Policy enforcement, supply-chain attestation, software bill of materials, audit logging and workload identity remain separate concerns that teams must configure independently. Authorization supports mapping from any OAuth2 or OIDC identity provider and applies whether the caller is a developer, a CLI tool or an AI agent.
OpenChoreo uses Argo Workflows, Cloud Native Buildpacks, OpenSearch, Prometheus, OpenTelemetry, Flux, cert-manager and Cilium as components in its stack. The project is available at openchoreo.dev for exploration and contributions.