1. Home
  2. Architecture
  3. Diagrams
Diagrams

Architecture diagram system

Reference shapes for microservices, Kafka/event-driven, Kubernetes, cloud, RAG, agents, LLM gateways and enterprise SaaS — tied to hubs and case studies, not generic clip-art. By Sanjeev Kumar, Application Architect.

How to read these

Each entry follows the same structure: problem, architecture shape, components, data flow, security, scaling and trade-offs. Visuals use site colour tokens (CSS + light SVG) so they match the dark theme without a new JS framework. Deeper narrative lives on the linked hub pages; case studies and writing supply programme context. Kafka remains under event-driven (the old /architecture/kafka path 301s there).

Microservices with API façade

Hub: Microservices Architecture

Problem
Legacy cores and tightly coupled modules cannot absorb independent release cadence without breaking consumers.
Architecture
Strangler-fig extraction behind a stable API façade; new Spring Boot services own clear capability boundaries while traffic shifts slice by slice.
Components
  • API façade / BFF
  • Extracted domain services
  • Shared identity & policy
  • Per-service data stores
  • Observability sidecars / agents
Data flow
Clients hit the façade; routing sends migrated paths to new services and legacy paths to the core until cut-over completes.
Security
mTLS or gateway TLS, RBAC at the edge, least-privilege service identity — same trust-boundary habits as the financial platform write-up.
Scaling
Scale extracted services independently; keep legacy load manageable by shifting high-churn slices first.
Trade-offs
Façade complexity and dual-run cost versus big-bang rewrite risk. Boundaries that still share transactions are not ready to split.

Kafka event-driven backbone

Hub: Event-Driven & Kafka Architecture

Problem
Synchronous meshes duplicate work and cannot guarantee exactly-once business posting across a DB write and a publish.
Architecture
Transactional outbox on the producer, Kafka as the event backbone, idempotent consumers with dedupe — the banking modernisation shape.
Components
  • Producer + outbox
  • Relay / connector
  • Kafka topics + schema registry
  • Consumer groups
  • Dedupe / idempotency store
  • DLQ + runbooks
Data flow
Business fact commits locally → outbox relay publishes → consumers process at-least-once with idempotency keys → compensations on saga paths.
Security
ACLs on topics, encrypted transit, audit of sensitive payloads; correlation IDs in headers for forensics.
Scaling
Partition for parallelism while preserving per-key order where the domain requires it; watch lag SLOs and hot partitions.
Trade-offs
Operational load (lag, poison messages, schema evolution) versus coupling reduction. Broker EOS does not replace application idempotency.

Kubernetes runtime for Java services

Hub: Kubernetes Architecture

Problem
JVM services need a runtime that supports rolling release, honest health signals and resource isolation on GCP/hybrid estates.
Architecture
Deployments behind Services/Ingress on GKE (or equivalent), with probes, PDBs and workload identity — as used beside Kafka on the financial platform stack.
Components
  • Ingress / gateway
  • Service
  • Deployment + pods
  • Config / secrets injection
  • HPA / PDB
  • Cluster logging & metrics
Data flow
North-south traffic via Ingress to Services; east-west pod DNS; config and secrets mounted at runtime, not baked into images.
Security
Workload identity, network policy, secret managers, mTLS on regulated paths.
Scaling
HPA on meaningful SLIs; right-size requests/limits for heap + native memory; PDB for quorum-safe disruption.
Trade-offs
Platform complexity versus VM sprawl. Mis-tuned probes and CPU limits create restart storms that look like app bugs.

Cloud perimeter on GCP (AWS-fluent)

Hub: Cloud Architecture

Problem
Regulated workloads need private connectivity, controlled egress and reviewable topology — not public-by-default defaults.
Architecture
Shared VPC / interconnect patterns, private clusters and service connect, IaC-managed perimeter — GCP-first with AWS as a strong second in the portfolio.
Components
  • Shared VPC / interconnect
  • Private GKE / compute
  • Managed data services
  • Identity & secret plane
  • CI/CD with short-lived creds
  • Observability
Data flow
On-prem or partner traffic via interconnect; apps talk privately to data and AI endpoints; analytics lands in governed lakes (e.g. BigQuery paths).
Security
VPC Service Controls / equivalent perimeters, least-privilege SA, no long-lived keys in CI.
Scaling
Regional services and managed autoscaling; keep data gravity and residency explicit when adding regions.
Trade-offs
Perimeter friction slows ad-hoc SaaS use; that is intentional for regulated data planes.

Enterprise RAG pipeline

Hub: RAG Architecture

Problem
Architecture knowledge exists but is hard to find under delivery pressure; unchecked generation invents APIs and decisions.
Architecture
Structure-aware ingest → embeddings / hybrid retrieval → citation-forced generation inside GCP residency, as in the applied RAG case study.
Components
  • Corpus sources (HLD/LLD, ADR, OpenAPI)
  • Ingest & chunk
  • Vector + keyword index
  • Re-ranker
  • Prompt assembly
  • LLM via gateway
  • Eval harness
Data flow
Docs indexed with ACL metadata → query retrieves & re-ranks → prompt packs evidence → model answers with chunk IDs or refuses.
Security
Query-time ACL filters, secret stripping before embed, private model endpoints, no cross-tenant answer cache.
Scaling
Cache stable retrieval by corpus version; cap tokens; scale embed/retrieve horizontally; kill runaway context packing.
Trade-offs
Retrieval quality is the ceiling. Fine-tuning loses citation and retractability on living corpora.

AI agents with human gates

Hub: AI Architecture

Problem
Multi-step design or review work needs more than one retrieve-generate pass — but agent loops create spend and tool-misuse risk.
Architecture
Planner with hard step caps, allow-listed tools (retrieve, compare, draft), and human approval before any write-action.
Components
  • Orchestrator
  • Tool registry
  • RAG retrieve tool
  • Draft artefact store
  • Human approval queue
  • Trace & token meters
Data flow
Goal → plan → tool calls → observe → re-plan until cap or done → human gate for side effects → audit log.
Security
Typed tool results, injection-resistant prompt boundaries, no standing write credentials for the model.
Scaling
Concurrency and token budgets per workflow; queue agent jobs; prefer single-shot RAG when it meets the job.
Trade-offs
Capability versus failure modes (loops, cost, tool abuse). Default to the simplest flow that works.

LLM gateway control plane

Hub: AI Architecture

Problem
Scattered model SDK calls duplicate credentials, bypass quotas and make prompt versions ungovernable.
Architecture
Thin gateway (or platform library) in front of providers: allow-lists, templates, rate limits, residency routing, request logging.
Components
  • App services (Java/Spring)
  • LLM gateway
  • Prompt template registry
  • Provider adapters
  • Quota & budget store
  • Audit / traces
Data flow
Service calls internal contract → gateway applies policy → routes to approved model endpoint → returns typed response + usage metrics.
Security
Central credentials, no-train flags, PII redaction hooks, tenant-scoped keys or impersonation.
Scaling
Per-workload rate limits; cache prompt prefixes where supported; shed load before provider 429 storms.
Trade-offs
Extra hop versus sprawl. Keep the gateway boring — not a second business domain.

Enterprise SaaS control vs data plane

Hub: Software Architecture

Problem
Multi-team or multi-client platforms leak data when caches, indexes or shared workers ignore tenancy.
Architecture
Hard isolation at identity, data and cache layers; shared platform services only where tenancy is enforced on every call — the same rule as AI tenant isolation.
Components
  • Identity / tenancy context
  • Control plane APIs
  • Per-tenant data stores or partitions
  • Shared stateless workers
  • Policy engine
  • Audit log
Data flow
Request carries tenant context → policy check → routed to partitioned data → response never mixes corpora or caches across tenants.
Security
Tenant in every authz decision; no shared answer/result caches across tenants; admin actions audited.
Scaling
Shard by tenant or workload; scale stateless workers horizontally; keep noisy neighbours away from critical partitions.
Trade-offs
Strong isolation costs ops complexity; weak isolation is cheaper until the first cross-tenant incident.

Related reading

Message sent

Thanks — I'll get back to you shortly.