Deployment architecture

The platform runs on a multi-layered, cloud-native design built on Kubernetes, integrating various services to create a resilient, elastically scalable system.

Core Components

Infrastructure Foundation

The platform runs on a managed Kubernetes cluster (Google Kubernetes Engine, Autopilot mode) inside a Virtual Private Cloud, with nodes distributed across three availability zones in a single region for redundancy. Node provisioning, patching and lifecycle are managed by the platform provider, and no node is assigned an external IP address. All application objects live in a single Kubernetes namespace, which forms the administrative boundary for the workloads.

Every service is packaged as a container and runs as pods managed by a Deployment or StatefulSet. Scaling is handled by Kubernetes controllers: HorizontalPodAutoscalers add and remove pod replicas for demand-driven services, and VerticalPodAutoscalers adjust the compute allocated to selected stateful and high-throughput workloads. PodDisruptionBudgets protect the workloads that must stay available during voluntary disruptions.

Access Layer

Inbound access is defined declaratively with the Kubernetes Gateway API. A Gateway resource provisions a managed external Layer-7 load balancer that terminates TLS with a Google-managed certificate; HTTPRoutes apply host- and path-based routing rules and redirect plain HTTP to HTTPS; a HealthCheckPolicy probes a health endpoint so unhealthy backends are removed from rotation.

Traffic admitted by the Gateway reaches a single internal nginx Service, whose pods act as the reverse proxy — applying security headers and routing each request on to the appropriate application Service. A second, dedicated LoadBalancer Service exposes an MQTT endpoint on TCP 8883 for tooling clients. Outbound traffic to integrated products leaves through a Cloud NAT gateway, which provides egress only and is not reachable from the internet.

Application Workloads

Three groups of workloads sit behind cluster-internal Services, each group made up of Deployments with a matching Service:

• API services — the platform’s Node.js APIs. Event-driven operations execute in-process within these services rather than in a separate function runtime.

• Web front-ends — the React applications, served as static assets with runtime configuration mounted from a ConfigMap.

• Code analysis services — language-specific source parsing, with signing keys mounted from a Secret.

Data Management

The architecture employs two storage approaches:

• SQL database — PostgreSQL for structured, relational data, running in-cluster as a StatefulSet backed by a PersistentVolumeClaim and scaled vertically.

• NoSQL database — MongoDB Atlas for semi-structured content, large files and unstructured data alike, consolidated in a single data lake. Its connection details are supplied to the workloads from a Kubernetes Secret.

Messaging & Communication

• A self-hosted MQTT broker, running in-cluster as a StatefulSet with its own persistent volume, for asynchronous messaging

• In-process, event-driven application logic within the API services

• Email notifications delivered through an SMTP provider

Intelligence & Monitoring

• Google Vertex AI for large language model capabilities, with Voyage AI — built into MongoDB Atlas — for embeddings

• A dedicated, in-cluster observability stack: Loki as the log store (StatefulSet with a persistent volume), Grafana for dashboards (Deployment with a persistent volume), and Promtail as a DaemonSet collecting logs from every pod in the namespace

Secrets Management

Application credentials are held in HashiCorp Vault, running in-cluster as a StatefulSet with its own persistent volume, and injected into workloads at runtime. File-based credentials are delivered as Kubernetes Secrets mounted into the pods that need them, so no secret material is baked into container images or application code.

Security Measures

The deployment incorporates layered security including VPC network isolation, namespace and pod-level isolation, private nodes with no external addresses, multi-zone redundancy, TLS/HTTP security headers, encryption at rest and in transit, runtime secret injection, role-based access controls, comprehensive audit logging, and AI ethics compliance frameworks.

Key architectural benefits: high availability, elastic and efficient resource use, security, flexibility, and future-readiness for advanced analytics.