Axiv Networks

Platform

One control plane. Every data plane.

Every Kardo node runs the same processes; the control plane decides each node’s role. Here is what is inside.

Architecture

From VIP to server

Clients Resolvers Admins HAProxy kardo-waf kardo-gslb IPVS kardod API · config · cluster
  1. 01

    Control plane

    kardod exposes REST API v1 and the UI, stores the config in bbolt with versioned transactions and replicates it with Raft.

  2. 02

    Render & reload

    It renders haproxy.cfg from Go templates, validates it and hot-reloads HAProxy without losing connections.

  3. 03

    Agents

    kardo-waf and kardo-auth answer HAProxy via SPOE; kardo-gslb serves DNS; kardo-k8s watches Kubernetes.

  4. 04

    Cluster

    VRRPv3 moves VIPs, Raft keeps every node consistent, a witness prevents split brain.

Components

Small, focused processes

kardod

The control plane: API, config store, data plane orchestration, system management, licensing, cluster.

HAProxy · IPVS · nftables

The data plane: L7 and TCP proxying, L4 UDP and DSR, firewall, NAT and basic DDoS protection with SYN proxy.

kardo-waf

The SPOA WAF agent: normalization, positive and negative models, learning and incident correlation.

kardo-auth

The access gateway: edge pre-authentication with a login portal, sessions replicated via Raft.

kardo-gslb

The authoritative DNS server for GeoLB, with its own site health checks and GeoIP.

kardo-k8s

The Kubernetes connector, active only on the cluster leader, with a token limited to its own endpoints.

Automation

Candidate, diff, commit

Every write lands in a shared, replicated candidate configuration. Review the diff, validate, then commit, optionally with a confirmed commit that rolls back on its own if you lose access.

  • REST API v1 with OpenAPI served by the appliance
  • API keys with role, scopes, allowed networks, expiry and rotation
  • Terraform provider and Ansible collection, tested end to end
terraform {
  required_providers {
    kardo = { source = "kardo/kardo" }
  }
}

# KARDO_ENDPOINT and KARDO_API_KEY from the environment
provider "kardo" {
  endpoint       = "https://lb1.example.com:8443"
  commit_mode    = "auto"
  commit_comment = "terraform"
}

Deployment

A hardened appliance, wherever you run it

Virtual machine

OVA, qcow2, VHD(X) and cloud images for AWS, Azure and GCP; first-boot wizard or SMBIOS/fw_cfg values.

Bare metal

ISO installer with NIC driver verification and no shell.

Appliance

Certified hardware with NIC/IRQ tuning and optional TPM.

Hardening

Secure by construction

Kardo runs on a minimal Debian stable built with mkosi: /usr is read-only and verified with dm-verity, updates go to A/B slots with automatic rollback.

  • No shell for customers or hypervisor administrators
  • One user per service; HAProxy cannot read kardod state
  • Per-agent tokens regenerated at every boot
  • Firewall in policy drop, systemd sandboxing for every unit
  • Updates verified fail-closed

Want the deep dive?

Our engineers will walk you through the architecture and the decisions behind it.

Talk to an engineer