openDesk.eu is the German government's sovereign digital workplace - 35+ open-source applications including Nextcloud, Element, OpenProject, Jitsi, and Collabora, all running on Kubernetes. The upstream project ships as Helmfiles.

In this talk I'll show how we rearchitected the openDesk deployment stack using two emerging CNCF-adjacent tools - Open Component Model (OCM.software) and Kubernetes Resource Orchestrator (KRO.run) - to solve three hard problems:

- Provenance & SBOM: How do you know every artifact you deploy is exactly what was built and hasn't been tampered with? OCM gives you component versioning, signing, and a full Software Bill of Materials out of the box.
- Dependency orchestration: How do you deploy 35 interdependent Helm releases in the right order, with readiness checks, without writing a custom operator? KRO's ResourceGraphDefinition turns implicit Helmfile ordering into an explicit, observable, self-healing dependency graph.
- Air-gap readiness: How do you make the entire stack relocatable to a sovereign cloud or disconnected environment? OCM's OCI transport layer lets you mirror the full component tree to any internal registry with one command.

The result: a single kubectl apply of one custom resource - kind: OpenDeskInstance - bootstraps the entire digital workplace. No CLI binaries embedded in your CD pipeline. No manual sync waves. Full drift detection via FluxCD.

I'll walk through the architecture, the real pain of migrating Helmfiles to FluxCD HelmReleases, and close with a demo showing an Kubernetes cluster becoming a running sovereign digital workplace.

All code is open-source and running today: github.com/platform-mesh/samples-opendesk-ocm-k8s-toolkit

- 45-minute slot preferred; content can be trimmed to 30 min by shortening the demo segment
- (Recorded) demo, no live cluster dependency - suitable for any conference setup
- Targets platform engineers and DevOps practitioners; assumes Kubernetes familiarity
- Speaker has deep end-to-end experience with the PoC including, fluxcd, kro.run, ocm.software and the helmfile migration pain
- Showcasing blueprint for advancing with European Digital Sovereignty