MTB DP DEV — EKS Cluster Topology

MTB DP DEV — EKS Cluster Topology An architecture diagram generated by Archify. ArgoCD (INFRA) · auto-sync + self-heal · Architecture component · apps-hub ArgoCD (INFRA) auto-sync + self-heal apps-hub ECR (shared) · INFRA account images · Architecture component · cross-account ECR (shared) INFRA account images cross-account INFRA Monitoring · Grafana / Loki / Tempo · Architecture component · peering INFRA Monitoring Grafana / Loki / Tempo peering EKS Control Plane · K8s 1.33, IRSA · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) EKS Control Plane K8s 1.33, IRSA Node Groups · spot(1-8)+od(3-5)+sonar · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · compute subs Node Groups spot(1-8)+od(3-5)+sonar compute subs Observability · OTel DS + Prom agent · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · → INFRA Observability OTel DS + Prom agent → INFRA Traefik Public · NLB :443 (public sub) · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · mgate / vrtp Traefik Public NLB :443 (public sub) mgate / vrtp Traefik Internal · NLB (VPN only) · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · admin / keycloak Traefik Internal NLB (VPN only) admin / keycloak Platform Services · ESO+cert-mgr+autoscaler · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · Vault IRSA Platform Services ESO+cert-mgr+autoscaler Vault IRSA ns: dev (12 svc) · payment / mgate / vrtp · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) › Business workloads (Helm via ArgoCD) · Helm deploys ns: dev (12 svc) payment / mgate / vrtp Helm deploys ns: esb-dev + event · ESB + event services · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) › Business workloads (Helm via ArgoCD) · 9 pods ns: esb-dev + event ESB + event services 9 pods Conduktor + Kestra · Kafka UI + orchestration · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) Conduktor + Kestra Kafka UI + orchestration Kafka (KRaft 3.9) · infra-services, 3 brokers · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · event bus Kafka (KRaft 3.9) infra-services, 3 brokers event bus Redis + Keycloak · infra-services ns · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · 7.4 / 26.3 Redis + Keycloak infra-services ns 7.4 / 26.3 PG in-cluster · primary+replica, 7 DBs · EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) · ESB/Kestra PG in-cluster primary+replica, 7 DBs ESB/Kestra RDS (3 instances) · PG 15.12 :5432 · Architecture component · data subnets RDS (3 instances) PG 15.12 :5432 data subnets S3 Buckets · bin-range + kestra · Architecture component · IRSA S3 Buckets bin-range + kestra IRSA sync pull images OTLP + rw routes routes events SQL EKS mtb-dp-dev-eks — K8s 1.33, eu-central-1 (apis subnets 10.0.20.0/22) Business workloads (Helm via ArgoCD)

Node Groups (7 nodes, 2 AZ)

  • • spot-diversified: 1-8 nodes, SPOT, t3/t3a.large + m5/m5a/m6i/m6a.large
  • • on-demand-base: 3-5 nodes, ON_DEMAND, t3/t3a.medium (stable base)
  • • sonar-general: 1 node, SPOT, t3/m4/m5.xlarge (SonarQube taint)
  • • spot-medium: scaled to 0 (legacy, to be deleted)
  • • Add-ons: vpc-cni v1.22.4, coredns v1.13.2, kube-proxy v1.33.10, ebs-csi v1.63

ns: dev — 12 payment services (Helm)

  • • mgate-payment-service — bank card payment gateway
  • • payment-service — core payment processing engine
  • • binrange-payment-service — BIN range validation (IRSA → S3)
  • • callback-payment-service — async payment callbacks
  • • mtransfer-payment-service — money transfer processing
  • • visa-direct-service — Visa Direct P2P payments
  • • request-to-pay-service (VRTP) — request-to-pay protocol
  • • mps-control-service — admin panel backend
  • • payment-service-console — admin web console
  • • provision-oauth-service — OAuth token provisioning
  • • alias-token-service — card alias/tokenization
  • • mwallet-decryption-service — mobile wallet decryption

ESB + Event Services

  • • ns esb-dev: esb (CrashLoop, init), adapter-d8, adapter-stronghold
  • • ns esb-dev: service-router, service-callback, d8-xapi-proxy
  • • ns event-dev: event-router-receiver, event-router-sender
  • • ns event-dev: is-card-trx-pusher, oracle-proxy, d8-xapi-proxy
  • • ns infra-esb-dev: postgres primary+replica (PG 18.3, 8 DBs)
  • • DBs: esbdb, apim_db, esb-router, kestra, callback_service
  • • DBs: analytics_processing_service, shared_db, postgres

Infra Services (infra-services ns)

  • • Kafka KRaft 3.9.0 — 3 brokers (StatefulSet)
  • • Redis 7.4.0 — master 1/1, replicas scaled to 0
  • • Keycloak 26.3.2 — OAuth/IAM (STS), RDS iamdb backend
  • • RabbitMQ 3.13.2 — message broker (STS)
  • • Conduktor Console 1.27 — Kafka management UI
  • • Kestra — ESB workflow orchestration (S3 IRSA)

Platform + IRSA Roles

  • • External Secrets v1.1 → Vault (INFRA, KMS auto-unseal)
  • • cert-manager v1.18 → Route53 DNS-01 (IRSA: cert-manager-route53)
  • • Cluster Autoscaler (IRSA: cluster-autoscaler → ASG)
  • • node-health-monitor (IRSA → ASG SetInstanceHealth)
  • • ebs-csi-driver (IRSA → AmazonEBSCSIDriverPolicy)
  • • payment-service (IRSA: dev-s3-access → S3 bin-range-files)
  • • binrange-payment-service (IRSA: binrange-s3-access → S3)
  • • ecr-cross-account (IRSA → shared ECR 957849199084)

Observability → INFRA

  • • OTel Agent 0.137.0 — DaemonSet 7/7, all nodes
  • • → INFRA OTEL Gateway NLB (ab23e91d...elb) port 4317
  • • Prometheus (agent mode) — operator 0.88.1, prom 3.9.1
  • • → remote_write: prom-rw.shr.mps.mtb.ua:9090/api/v1/write
  • • node-exporter v1.9.0 (DS) + kube-state-metrics v2.14.0
  • • externalLabels: cluster=mtb-dp-dev-eks, env=mps-dev