Skip to content

architecture.md

Latest commit

 

History

History
193 lines (162 loc) · 5.48 KB

architecture.md

File metadata and controls

193 lines (162 loc) · 5.48 KB
Raw

Architecture — DevOps EKS SaaS Platform Infrastructure

1. High-Level Infrastructure

flowchart TB
    subgraph Internet["🌐 Internet"]
        Users["👥 Users"]
        DNS["🌐 Route53<br/>DKIM/SPF/DMARC"]
    end

    subgraph AWS["☁️ AWS Account"]
        ACM["🔒 ACM Certificate"]
        
        subgraph VPC["🔒 VPC 10.0.0.0/16"]
            subgraph PubSub["Public Subnets (3 AZs)"]
                ALB["⚖️ ALB Ingress Controller"]
                NAT["🌐 NAT Gateway"]
            end
            
            subgraph PrivSub["Private Subnets (3 AZs)"]
                subgraph EKS["☸️ EKS Cluster v1.29"]
                    NG["🖥️ Managed Node Group<br/>m6i.large × 2-10"]
                    
                    subgraph Platform["Platform Namespace"]
                        ArgoCD["🔄 ArgoCD"]
                        KEDA["📈 KEDA"]
                        ESO["🔐 External Secrets<br/>Operator"]
                        ALBCtrl["⚖️ AWS LB Controller"]
                    end
                    
                    subgraph Apps["Application Namespaces"]
                        API["📦 API Service"]
                        Worker["📦 Worker Service"]
                        Web["📦 Web Service"]
                    end
                end
            end
            
            subgraph DataSub["Data Subnets (3 AZs)"]
                Aurora["🐘 Aurora PostgreSQL<br/>r6g.large"]
                Redis["⚡ ElastiCache Redis<br/>r6g.large"]
            end
        end
        
        SQS["📨 SQS Queues"]
        SNS["📢 SNS Topics"]
        SES["✉️ SES + DKIM"]
        SM["🔑 Secrets Manager"]
        KMS["🔐 KMS CMK"]
        S3State["🗂️ S3 TF State"]
        Lambda["⚡ Lambda"]
    end

    Users --> DNS --> ACM --> ALB
    ALB --> API & Web
    ArgoCD -->|"GitOps sync"| API & Worker & Web
    ESO -->|"fetch secrets"| SM
    KEDA -->|"scale workers"| SQS
    API --> Aurora & Redis
    Worker --> SQS & SES
    SNS --> Lambda --> SQS
    SM --> KMS
Loading

2. GitOps Deployment Flow

sequenceDiagram
    participant Dev as 👨‍💻 Developer
    participant GH as ⚙️ GitHub Actions
    participant GHCR as 📦 GHCR (OCI)
    participant Argo as 🔄 ArgoCD
    participant EKS as ☸️ EKS Cluster
    participant Slack as 💬 Slack

    Dev->>GH: Push to main / Open PR
    
    rect rgb(240, 248, 255)
        Note over GH: CI Pipeline
        GH->>GH: Lint + Test
        GH->>GH: Build Docker image
        GH->>GH: helm lint + helm template
        GH->>GHCR: Push image (tag: SHA)
        GH->>GHCR: helm push chart (OCI)
    end
    
    rect rgb(240, 255, 240)
        Note over Argo: GitOps Sync
        Argo->>GHCR: Detect new chart version
        Argo->>Argo: Diff current vs desired
        Argo->>EKS: Apply manifests (auto-sync)
        EKS->>EKS: Rolling update
        Argo->>Slack: Sync succeeded ✅
    end
    
    rect rgb(255, 240, 240)
        Note over Argo: On Failure
        Argo->>Argo: Sync failed
        Argo->>Slack: Sync failed ❌
        Argo->>EKS: Auto-rollback (if configured)
    end
Loading

3. Secrets Management Flow

flowchart LR
    subgraph GitRepo["📂 Git Repository"]
        SOPS["🔐 SOPS-encrypted<br/>values files"]
    end
    
    subgraph AWS["☁️ AWS"]
        KMS["🔐 KMS CMK"]
        SM["🔑 Secrets Manager"]
    end
    
    subgraph EKS["☸️ EKS Cluster"]
        ESO["🔐 External Secrets<br/>Operator"]
        CSS["📋 ClusterSecretStore<br/>(IRSA auth)"]
        ES["📄 ExternalSecret<br/>resources"]
        K8S["🔑 Kubernetes Secrets"]
        Pod["📦 Application Pod"]
    end
    
    SOPS -->|"sops --decrypt"| KMS
    KMS -->|"decrypt"| SM
    SM --> CSS
    ESO --> CSS
    CSS --> ES
    ES -->|"sync every 1h"| K8S
    K8S -->|"env vars / volumes"| Pod
Loading

4. KEDA Autoscaling Architecture

flowchart TB
    subgraph Triggers["📊 Scaling Triggers"]
        SQS["📨 SQS Queue Depth<br/>ApproximateNumberOfMessages"]
        Redis["⚡ Redis List Length<br/>LLEN pending_jobs"]
        Cron["⏰ Cron Schedule<br/>Business hours scale-up"]
    end
    
    subgraph KEDA["📈 KEDA Controller"]
        SO["ScaledObject"]
        HPA["Generated HPA"]
    end
    
    subgraph EKS["☸️ EKS"]
        Worker1["📦 Worker Pod 1"]
        Worker2["📦 Worker Pod 2"]
        WorkerN["📦 Worker Pod N"]
        SA["🔑 ServiceAccount<br/>(IRSA → SQS read)"]
    end
    
    SQS --> SO
    Redis --> SO
    Cron --> SO
    SO --> HPA
    HPA -->|"scale 1→N"| Worker1 & Worker2 & WorkerN
    SA -->|"pod identity"| Worker1 & Worker2 & WorkerN
Loading

5. Network Topology

flowchart TB
    subgraph VPC["🔒 VPC 10.0.0.0/16"]
        subgraph AZ1["AZ us-east-1a"]
            Pub1["Public 10.0.0.0/20<br/>ALB + NAT"]
            Priv1["Private 10.0.48.0/20<br/>EKS Nodes"]
            Data1["Data 10.0.96.0/20<br/>Aurora + Redis"]
        end
        
        subgraph AZ2["AZ us-east-1b"]
            Pub2["Public 10.0.16.0/20"]
            Priv2["Private 10.0.64.0/20<br/>EKS Nodes"]
            Data2["Data 10.0.112.0/20<br/>Aurora + Redis"]
        end
        
        subgraph AZ3["AZ us-east-1c"]
            Pub3["Public 10.0.32.0/20"]
            Priv3["Private 10.0.80.0/20<br/>EKS Nodes"]
            Data3["Data 10.0.128.0/20"]
        end
    end
    
    IGW["🌐 Internet Gateway"] --> Pub1 & Pub2 & Pub3
    Pub1 -->|"NAT"| Priv1
    Priv1 -->|"SG: app→data"| Data1
    Priv2 -->|"SG: app→data"| Data2
Loading