Files
api7-demo/web/docs/architecture.md
d.viti a2eef9efde
Some checks failed
Build and Push Docker Images / build-web (push) Failing after 1m3s
Build and Push Docker Images / build-api (push) Failing after 1m1s
first commit
2025-10-03 01:20:15 +02:00

284 lines
9.0 KiB
Markdown

# Architecture Overview
## Infrastructure Architecture
```
Internet
Load Balancer (External IP)
Ingress Controller
TLS Termination (Wildcard Certificate)
┌─────────────────────────────────────────────────────┐
│ Gateway Ingress │
│ (*.domain.com / domain.com) │
└─────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────┐
│ Gateway Service (ClusterIP) │
│ gateway-service (Internal IP) │
│ Ports: 80 (→9080), 443 (→9443) │
└─────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────┐
│ Gateway Pods (Multiple Replicas) │
│ - gateway-pod-1 │
│ - gateway-pod-2 │
│ - gateway-pod-3 │
└─────────────────────────────────────────────────────┘
[Route Matching & Service Discovery]
┌──────────────────┬──────────────────┐
│ Backend │ Backend │
│ Services │ Services │
│ (ClusterIP) │ (ClusterIP) │
└──────────────────┴──────────────────┘
Application Pods
```
## Component Details
### 1. External Access Layer
**Load Balancer**
- Provides external IP address
- Supports LoadBalancer service type
- Exposes Ingress Controller to the internet
**Ingress Controller**
- Handles HTTP/HTTPS traffic
- TLS termination point
- Routes to appropriate backend services
### 2. Control Plane
**Deployment Method**: Helm Chart
**Namespace**: Dedicated namespace for gateway components
#### Components
**Dashboard**
- **Function**: Web UI for gateway management
- **Service Type**: ClusterIP
- **Ports**: Management ports (HTTP/HTTPS)
- **Replicas**: Configurable
**Developer Portal**
- **Function**: API documentation and developer access
- **Service Type**: ClusterIP
- **Ports**: Web service port
- **Replicas**: Configurable
**Data Plane Manager**
- **Function**: Data Plane management and configuration distribution
- **Service Type**: ClusterIP
- **Ports**: Management and proxy ports
- **Replicas**: Configurable
**PostgreSQL Database**
- **Function**: Configuration and metadata storage
- **Service Type**: ClusterIP
- **Port**: 5432/TCP
- **Storage**: Persistent volume with configurable size
- **Deployment**: StatefulSet for data persistence
**Prometheus Server**
- **Function**: Metrics collection and monitoring
- **Service Type**: ClusterIP
- **Port**: 9090/TCP
- **Storage**: Persistent volume for metrics retention
### 3. Gateway Data Plane
**Deployment Method**: Helm Chart
**High Availability**: Multiple replicas for fault tolerance
#### Gateway Deployment
- **Replicas**: Configurable (recommended: 3+)
- **Strategy**: RollingUpdate for zero-downtime deployments
- **Max Unavailable**: 25% during updates
**Gateway Groups**:
- Logical grouping of gateway instances
- Environment-based separation (dev/staging/prod)
- Independent configuration per group
#### Gateway Service
- **Type**: ClusterIP for internal routing
- **Ports**:
- HTTP: 80/TCP → 9080/TCP
- HTTPS: 443/TCP → 9443/TCP
#### Gateway Configuration
**Configuration Store**:
- **Connection**: Secure connection to control plane
- **TLS**: Mutual authentication enabled
- **Certificates**: Managed via Kubernetes secrets
**Configuration Volumes**:
- Gateway configuration via ConfigMap
- TLS certificates for secure communication
- Service discovery configuration
### 4. Ingress Configuration
**Gateway Ingress Resource**
```yaml
Hosts:
- *.domain.com
- domain.com
Backend:
Service: gateway-service
Port: 80
TLS:
- hosts:
- *.domain.com
- domain.com
secretName: wildcard-tls-secret
```
**Access Points**:
- External IP: Provided by Load Balancer
- Protocols: HTTP (80), HTTPS (443)
- Ingress Class: Configurable
### 5. Storage Architecture
**Persistent Volumes**:
| Component | Recommended Size | Usage |
|-----------|-----------------|-------|
| PostgreSQL Database | 10Gi+ | Configuration and metadata storage |
| Prometheus Metrics | 100Gi+ | Time-series metrics retention |
| Configuration Store | 8Gi per node | Distributed configuration (if using etcd) |
**Storage Classes**:
- Distributed storage for database persistence
- Local or network storage for metrics
- High-performance storage for configuration
## Network Flow
### External Request Flow
1. **Client Request** → Domain URL (HTTP/HTTPS)
2. **DNS Resolution** → External Load Balancer IP
3. **Ingress Controller** → TLS termination with wildcard certificate
4. **Ingress Routing** → Gateway service endpoint
5. **Gateway Service** → Load balances across gateway pod replicas
6. **Route Matching** → Gateway evaluates routes based on host/path/priority
7. **Service Discovery** → Gateway fetches backend endpoints from Kubernetes
8. **Backend Request** → Proxies to backend service pods
9. **Response** → Returns through the chain to client
### Control Plane Communication
1. **Dashboard** → Database (configuration storage)
2. **Dashboard** → Data Plane Manager (gateway group management)
3. **Data Plane Manager** → Configuration store (configuration distribution)
4. **Gateway Pods** → Control plane endpoint (fetch routes/services)
5. **Prometheus** → Gateway Pods (scrape metrics)
## Security Architecture
### TLS/SSL Configuration
**External TLS** (Ingress Layer):
- **Certificate**: Wildcard certificate (Let's Encrypt or commercial)
- **Secret**: Kubernetes TLS secret
- **Domains**: Wildcard and root domain support
**Internal TLS** (Control Plane):
- **Dashboard**: Secure HTTPS access
- **Developer Portal**: Encrypted portal access
- **Data Plane Manager**: Secure management interface
**Gateway Communication TLS**:
- **Mutual TLS**: Enabled for secure communication
- **CA Certificate**: Certificate authority validation
- **Client Certificates**: Individual component authentication
### Service Accounts & RBAC
**Gateway Service Account**: Dedicated service account per namespace
**Required Permissions**:
- `list/watch` endpoints (for service discovery)
- Read access to services and pods
- Typically bound to appropriate ClusterRole
## High Availability
### Gateway Layer
- **Multiple replicas** for fault tolerance (3+ recommended)
- **RollingUpdate** strategy for zero-downtime deployments
- **Load balancing** across all healthy instances
### Control Plane
- **Database**: StatefulSet with persistent storage
- **Monitoring**: Persistent metrics storage
- **Management Components**: Stateless, scalable replicas
### Storage
- **Database**: Distributed or replicated storage
- **Metrics**: Persistent volume with retention policy
- **Configuration**: Highly available storage backend
## Monitoring & Observability
**Metrics Collection**:
- Time-series metrics from all gateway pods
- Persistent storage for historical data
- Query interface for metrics analysis
**Gateway Metrics**:
- HTTP request rates and throughput
- Latency percentiles (p50, p95, p99)
- Error rates and status codes
- Active connections and concurrency
- Upstream service health status
**Health Checks**:
- Gateway readiness and liveness probes
- Service health endpoints
- Automated recovery mechanisms
## Scalability Considerations
**Horizontal Scaling**:
- Gateway pods: Scale based on traffic patterns
- Backend services: Auto-scaling based on metrics
- Control plane: Scale management components as needed
**Vertical Scaling**:
- Database: Expand storage as data grows
- Metrics storage: Adjust retention and volume size
- Gateway resources: Tune CPU/memory for performance
## Configuration Management
**Gateway Configuration**:
- **Source**: Dashboard UI or CLI tools
- **Storage**: Centralized database
- **Distribution**: Control plane to data plane synchronization
- **Format**: YAML configuration or Web-based management
**Kubernetes Resources**:
- **Deployment**: Helm charts for standardized installation
- **Management**: Kubernetes-native resource management
- **Namespaces**: Logical separation of environments
---
*This architecture provides enterprise-grade API Gateway capabilities with high availability, scalability, and comprehensive monitoring.*