Platform components
Every component of the Navin Enterprise distribution: open source bricks, platform services of the publisher and services the client provides. Each page is generated from its manifest (catalog/components, schema contracts/v1/managed-component.schema.json).
| Component | Purpose | Plane | Pinned version | Licence | Licence status | State |
|---|---|---|---|---|---|---|
| Alertmanager | Alerts | observability, audit and SOC | v0.34.2 | Apache-2.0 | allowed | integrated |
| Grafana Alloy | Node and pod log and metric agent | observability, audit and SOC | v1.21.3 | Apache-2.0 | allowed | integrated |
| Apache APISIX | API gateway | agent execution | 3.19.0 | Apache-2.0 | allowed | integrated |
| Argo CD | GitOps | infrastructure and DevSecOps | v2.13.2 | Apache-2.0 | allowed | integrated |
| Asterisk | PBX of the telephony (PJSIP, dialplan, IVR, queues, voicemail, conferences, recordings), ADR-0173 | multimodal | 20.6.0 | GPL-2.0-only WITH Asterisk-linking-protocols-exception | exception (LEX-024) | partial |
| AWS CLI | Bucket initialisation of the compose stack | data and privacy | 2.27.0 | Apache-2.0 | allowed | integrated |
| Blackbox exporter | Metrics exporter | observability, audit and SOC | 0.27.0 | Apache-2.0 | allowed | integrated |
| cert-manager | Certificates | infrastructure and DevSecOps | v1.16.2 | Apache-2.0 | allowed | integrated |
| Cilium | Network and egress restrictions | infrastructure and DevSecOps | 1.16.5 | Apache-2.0 | allowed | integrated |
| ClamAV (clamd, freshclam and HTTPS gateway) | Antivirus scanning of every uploaded file before ingestion | data and privacy | 1.4.6 | GPL-2.0-only | exception (LEX-022) | integrated |
| ClickHouse | Analytics and AI trace store | data and privacy | 25.3.6.10034.altinitystable | Apache-2.0 | allowed | integrated |
| Altinity ClickHouse operator | ClickHouse operator | data and privacy | 0.27.4 | Apache-2.0 | allowed | integrated |
| Client vault (BYO) | Secrets store provided by the client | identity, governance and policies | byo (provided by the client) | LicenseRef-Client-Provided | allowed | partial |
| CloudNativePG | PostgreSQL operator | data and privacy | 1.25.0 | Apache-2.0 | allowed | integrated |
| Cognee API | Memory of the AI agents as a knowledge graph (add, cognify, semantic, graph and GraphRAG search, per dataset access control) | agent execution | 1.6.6 | Apache-2.0 | allowed | partial |
| Control plane API | Platform API, governance, licensing | platform management | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Control plane worker | Background jobs (retention, quotas, heartbeats) | platform management | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Coraza WAF (proxy-wasm) with OWASP CRS | Web application firewall | agent execution | gateway-image (inside the gateway image) | Apache-2.0 | allowed | partial |
| Cosign | Artefact signing | infrastructure and DevSecOps | 2.6.5 | Apache-2.0 | allowed | integrated |
| Docling (docling-serve) | Document extraction | data and privacy | 1.38.2 | MIT | allowed | integrated |
| Elasticsearch | Search and log store of the client, reached through a connection (never shipped) | observability, audit and SOC | absent (not deployed) | AGPL-3.0-only OR SSPL-1.0 OR Elastic-2.0 | non compliant | absent (not deployed) |
| espeak-ng and phonemizer | Phonemisation for Kokoro | multimodal | separate-process (separate process) | GPL-3.0-or-later | exception (LEX-020) | partial |
| etcd | APISIX configuration store | agent execution | 3.5.35 | Apache-2.0 | allowed | integrated |
| External Secrets Operator | Secret synchronisation into Kubernetes | identity, governance and policies | v2.14.0 | Apache-2.0 | allowed | integrated |
| Falco | Runtime detection | observability, audit and SOC | node-provided (provided by the node) | Apache-2.0 | allowed | partial |
| faster-whisper | Speech to text | multimodal | 1.2.1 | MIT | allowed | integrated |
| FFmpeg and codecs | Audio and video decoding | multimodal | distribution-package (package of the distribution) | LGPL-2.1-or-later AND GPL-2.0-or-later | exception (LEX-010) | partial |
| Forgejo (CI) | Git forge and CI runner used by the project | infrastructure and DevSecOps | byo (provided by the client) | GPL-3.0-or-later | exception (LEX-008) | partial |
| garak | AI red teaming | observability, audit and SOC | 0.12.0 | Apache-2.0 | allowed | integrated |
| Gitea | Git (kit reference) | infrastructure and DevSecOps | absent (not deployed) | MIT | allowed | absent (not deployed) |
| Gitleaks | Secret scanning | infrastructure and DevSecOps | v8.21.2 | MIT | allowed | integrated |
| Grafana | Dashboards (removed) | observability, audit and SOC | absent (not deployed) | AGPL-3.0-only | non compliant | absent (not deployed) |
| gVisor | Agent and code sandbox | agent execution | node-provided (provided by the node) | Apache-2.0 | allowed | partial |
| HAProxy | Manager load balancer | platform management | 3.2.9 | GPL-2.0-or-later | exception (LEX-004) | integrated |
| Harbor | OCI registry | infrastructure and DevSecOps | 1.19.4 | Apache-2.0 | allowed | partial |
| Haystack | RAG pipelines | data and privacy | 2.18.1 | Apache-2.0 | allowed | partial |
| Helm | Packages | infrastructure and DevSecOps | v3.16.3 | Apache-2.0 | allowed | integrated |
| Jaeger | Distributed traces | observability, audit and SOC | 2.22.0 | Apache-2.0 | allowed | integrated |
| Kamailio | SIP edge of the telephony (proxy, dispatcher to the PBX pools and LiveKit SIP, WSS, anti-flood), ADR-0173 | multimodal | 5.7.4 | GPL-2.0-or-later | exception (LEX-025) | partial |
| KEDA and HPA | Autoscaling | infrastructure and DevSecOps | 2.16.1 | Apache-2.0 | allowed | integrated |
| Keepalived | Virtual IP failover | platform management | 2.4.3 | GPL-2.0-or-later | exception (LEX-005) | integrated |
| Keycloak | SSO, OIDC, SAML, MFA | identity, governance and policies | 26.8.1 | Apache-2.0 | allowed | integrated |
| Kokoro (kokoro-onnx) | Text to speech | multimodal | 0.6.1 | MIT | allowed | integrated |
| kube-state-metrics | Observability helper | observability, audit and SOC | v2.20.0 | Apache-2.0 | allowed | integrated |
| kubeconform | Manifest validation | infrastructure and DevSecOps | v0.6.7 | Apache-2.0 | allowed | integrated |
| Kubernetes | Orchestrator | infrastructure and DevSecOps | byo (provided by the client) | Apache-2.0 | allowed | integrated |
| Kyverno | Admission policies | infrastructure and DevSecOps | v1.13.2 | Apache-2.0 | allowed | integrated |
| Label Studio Community Edition | Data labeling, human review and LLM and VLM fine-tuning datasets | data and privacy | 1.23.2 | Apache-2.0 | allowed | integrated |
| Langfuse | AI traces (removed) | observability, audit and SOC | absent (not deployed) | MIT AND LicenseRef-Langfuse-EE | non compliant | absent (not deployed) |
| LemonLDAP::NG | WebSSO and OpenID Connect provider over the directory of the bank, TOTP (alternative to Keycloak) | identity, governance and policies | 2.23.4 | GPL-2.0-or-later | exception (LEX-034) | partial |
| LiteLLM Proxy OSS | LLM gateway and quotas | models | v1.106.5 | MIT | allowed | integrated |
| LiveKit Server | Real time voice (WebRTC) | multimodal | v1.9.0 | Apache-2.0 | allowed | integrated |
| LiveKit Agents workers (navin-voice-agent) | Workers of the Navin voice AI agents | multimodal | 1.0.0 | Apache-2.0 | allowed | partial |
| LiveKit Egress | Recording of LiveKit rooms to SeaweedFS | multimodal | 1.15.0 | Apache-2.0 | allowed | partial |
| LiveKit Ingress | RTMP and WHIP import into LiveKit rooms (optional, not used by telephony) | multimodal | 1.5.0 | Apache-2.0 | allowed | partial |
| LiveKit SIP | SIP gateway of the telephony into LiveKit rooms | multimodal | 1.22.0 | Apache-2.0 | allowed | partial |
| LLaMA-Factory | Fine-tuning of LLM and VLM (SFT, LoRA, QLoRA, DPO) | models | 0.9.5 | Apache-2.0 | allowed | integrated |
| Grafana Loki | Logs (removed) | observability, audit and SOC | absent (not deployed) | AGPL-3.0-only | non compliant | absent (not deployed) |
| MCP official SDKs | Tool protocol | agent execution | absent (not deployed) | MIT | allowed | absent (not deployed) |
| Media worker | STT, TTS and video jobs | multimodal | 1.0.0 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Mem0 REST server | Persistent memory of the AI agents (facts per user, agent and run, semantic search, history) | agent execution | 2.2.1 | Apache-2.0 | allowed | partial |
| MinIO | S3 object storage (compose only, removed) | data and privacy | absent (not deployed) | AGPL-3.0-only | non compliant | absent (not deployed) |
| Model weights | LLM, STT, TTS, VAD, OCR and diarisation weights | models | byo (provided by the client) | LicenseRef-Model-Licences | exception (LEX-012) | partial |
| MySQL (Opik state) | Opik state database (client service) | observability, audit and SOC | 8.4.5 | GPL-2.0-only | exception (LEX-003) | partial |
| NATS JetStream | Event bus | agent execution | 2.15.1 | Apache-2.0 | allowed | integrated |
| Prometheus NATS exporter | Metrics exporter | observability, audit and SOC | 0.20.2 | Apache-2.0 | allowed | integrated |
| navin-manager node agent | Host agent | platform management | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| navin-manager console | Manager web console, dashboards of the machines and services (ADR-0169) | experience | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Platform Operator | ManagedComponent reconciliation (platform.navin.ai/v1alpha1) | platform management | 1.0.0 | LicenseRef-Navin-Enterprise | allowed | partial |
| navin-manager server | Platform manager API | platform management | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Navin MCP host | MCP hosting of the Navin Manager, one process and one token per stdio MCP server of a tenant project | agent execution | 1.0.0 | Apache-2.0 | allowed | partial |
| Navin Enterprise RAG Agent API | RAG product API (instances, conversations, citations, branding) on top of the Control Plane | agent execution | 0.1.0 | LicenseRef-Navin-Enterprise | allowed | partial |
| Navin Enterprise RAG Agent web application | Chat web application and BFF (Next.js 16, MUI, OIDC session) | experience | 0.1.0 | LicenseRef-Navin-Enterprise | allowed | partial |
| Navin Enterprise RAG Agent worker | Durable RAG jobs claimed from the PostgreSQL queue (rag.rag_jobs, FOR UPDATE SKIP LOCKED) | agent execution | 0.1.0 | LicenseRef-Navin-Enterprise | allowed | partial |
| Navin runtime | Agent runtime (AgentLoop, AgentRunner, SubagentManager) | agent execution | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| Navin SM | Navin desktop and CLI of the organisations, distributed to the workstations by the Manager with its organisation file (managed settings) | experience | 2.4.6 | LicenseRef-Navin-Enterprise | allowed | partial |
| Prometheus node exporter | Metrics exporter | observability, audit and SOC | v1.12.1 | Apache-2.0 | allowed | integrated |
| NVIDIA GPU Operator, drivers and CUDA | GPU nodes | infrastructure and DevSecOps | v24.9.1 | Apache-2.0 | exception (LEX-011) | partial |
| Ollama | Complementary local inference for light and quantized models (GGUF) on CPU or GPU | models | 0.40.14 | MIT | allowed | integrated |
| Open Policy Agent | ABAC policies, conditions and obligations | identity, governance and policies | 1.22.0 | Apache-2.0 | allowed | integrated |
| OpenBao | Secrets store (deployed today) | identity, governance and policies | v2.7.2 | MPL-2.0 | exception (LEX-006) | integrated |
| OpenCV | Vision and video processing | multimodal | absent (not deployed) | Apache-2.0 | allowed | absent (not deployed) |
| OpenFGA | ReBAC and fine grained authorisation | identity, governance and policies | v1.22.1 | Apache-2.0 | allowed | integrated |
| OpenLineage | Lineage | data and privacy | absent (not deployed) | Apache-2.0 | allowed | partial |
| OpenSearch and Security Analytics | Logs, SIEM and detection | observability, audit and SOC | 3.9.0 | Apache-2.0 | allowed | integrated |
| OpenSearch Dashboards | Search, logs and index administration console | observability, audit and SOC | 2.19.2 | Apache-2.0 | allowed | integrated |
| OpenTelemetry SDK (Python) | Instrumentation | observability, audit and SOC | >=1.25 | Apache-2.0 | allowed | integrated |
| OpenTofu | Infrastructure as code (deployed today) | infrastructure and DevSecOps | 1.8.7 | MPL-2.0 | exception (LEX-007) | integrated |
| Opik | AI traces and evaluations | observability, audit and SOC | 2.2.137 | Apache-2.0 | allowed | integrated |
| OpenTelemetry Collector (contrib) | Telemetry pipeline | observability, audit and SOC | 0.163.2 | Apache-2.0 | allowed | integrated |
| PaddleOCR | OCR | data and privacy | byo (provided by the client) | Apache-2.0 | allowed | partial |
| Enterprise portal | Web experience | experience | 1.0.2 | LicenseRef-Navin-Enterprise | allowed | integrated |
| PostgreSQL exporter | Metrics exporter | observability, audit and SOC | 0.17.1 | Apache-2.0 | allowed | integrated |
| PostgreSQL | Central SQL store | data and privacy | 16.6 | PostgreSQL | exception (LEX-001) | integrated |
| Microsoft Presidio | PII detection and anonymisation | data and privacy | 2.2.366 | MIT | allowed | integrated |
| Prometheus | Metrics | observability, audit and SOC | v3.15.1 | Apache-2.0 | allowed | integrated |
| Prometheus operator | Observability helper | observability, audit and SOC | v0.94.2 | Apache-2.0 | allowed | integrated |
| Promptfoo | AI tests | observability, audit and SOC | 0.117.4 | MIT | allowed | integrated |
| Pulumi OSS | Infrastructure as code (kit reference) | infrastructure and DevSecOps | absent (not deployed) | Apache-2.0 | allowed | absent (not deployed) |
| pyannote.audio | Diarisation | multimodal | >=3.1 | MIT | allowed | integrated |
| Qdrant | Vector database | data and privacy | v1.20.0 | Apache-2.0 | allowed | integrated |
| Ragas | RAG evaluation | observability, audit and SOC | 0.3.2 | Apache-2.0 | allowed | integrated |
| Redis | Cache, counters and sessions | data and privacy | v7.2.17 | BSD-3-Clause | exception (LEX-002) | integrated |
| Redis exporter | Metrics exporter | observability, audit and SOC | v1.44.0 | MIT | allowed | integrated |
| Redis operator (OT-CONTAINER-KIT) | Redis operator | data and privacy | v0.27.0 | Apache-2.0 | allowed | integrated |
| RTPengine | optional media relay of the telephony (RTP anchoring, difficult NAT, media interconnection), ADR-0173 | multimodal | 11.5.1.18 | GPL-3.0-or-later | exception (LEX-026) | partial |
| SeaweedFS | S3 compatible object storage (replaces MinIO) | data and privacy | 4.51 | Apache-2.0 | allowed | partial |
| Semgrep CE | Static analysis | infrastructure and DevSecOps | 1.99.0 | LGPL-2.1-only | exception (LEX-019) | integrated |
| Silero VAD | Voice activity detection | multimodal | 6.2.3 | MIT | allowed | integrated |
| SPIFFE/SPIRE | Workload identity and mTLS | identity, governance and policies | 1.15.5 | Apache-2.0 | allowed | integrated |
| Client storage connector (BYO) | Object storage of the client | data and privacy | byo (provided by the client) | LicenseRef-Client-Provided | allowed | integrated |
| Syft | SBOM | infrastructure and DevSecOps | 1.55.0 | Apache-2.0 | allowed | integrated |
| Tekton Pipelines | CI pipelines (kit reference) | infrastructure and DevSecOps | v1.18.0 | Apache-2.0 | allowed | partial |
| Temporal | Durable workflows | agent execution | 1.32.0 | MIT | allowed | integrated |
| Temporal UI | Workflow console | agent execution | 2.54.1 | MIT | allowed | integrated |
| Tetragon | Runtime enforcement | observability, audit and SOC | node-provided (provided by the node) | Apache-2.0 | allowed | partial |
| Thanos sidecar | Observability helper | observability, audit and SOC | v0.42.5 | Apache-2.0 | allowed | integrated |
| Google Tink | Application encryption | data and privacy | 1.16.1 | Apache-2.0 | allowed | integrated |
| ToolHive Kubernetes Operator (Stacklok) | MCP Runtime, ephemeral MCP servers per tenant, project and user | agent execution | v0.59.0 | Apache-2.0 | allowed | partial |
| Trivy | Vulnerability scanning | infrastructure and DevSecOps | 0.58.1 | Apache-2.0 | allowed | integrated |
| Velero | Cluster backup | infrastructure and DevSecOps | v1.15.0 | Apache-2.0 | allowed | integrated |
| vLLM | Local inference (text and vision language models) | models | v0.33.0 | Apache-2.0 | allowed | integrated |
| Wazuh (client SIEM connector) | Client SIEM | observability, audit and SOC | byo (provided by the client) | GPL-2.0-only | exception (LEX-009) | partial |
| YARA-X (rule scanning worker) | Rule based detection of malicious files before ingestion | data and privacy | 1.22.1 | BSD-3-Clause | exception (LEX-023) | integrated |
| ZAP | Dynamic scanning | infrastructure and DevSecOps | 2.15.0 | Apache-2.0 | allowed | integrated |
| Apache ZooKeeper | ClickHouse replication coordination (Opik) | observability, audit and SOC | 3.9.4 | Apache-2.0 | allowed | integrated |