7.2 Self Service Password Reset Amazon Kubernetes architecture

The Kubernetes architecture provides a robust and scalable solution for deploying Self Service Password Reset applications on Kubernetes, leveraging AWS services for networking, load balancing, storage, and ingress routing.

The following diagram depicts the architecture and the components of Self Service Password Reset containers on Amazon EKS (Elastic Kubernetes Service) with Elastic Compute Cloud (EC2) Instance:

Figure 7-1

  • Route 53: Amazon Route 53 is the Domain Name System (DNS) web service. This enables users to create their own customized domain name to route incoming user traffic to an appropriate application load balancer, Kubernetes service, or ingress.

  • Amazon Certificate Manager (ACM): AWS Certificate Manager (ACM) is an Amazon service that allows you to easily create, manage, and automatically renew the public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates. ACM secures the communication between clients and SSPR applications deployed in a Kubernetes cluster through the Application Load Balancer (ALB). This ensures that the HTTPS requests sent to the Self Service Password Reset Kubernetes services are encrypted using the SSL/TLS certificates provided by ACM.

  • Virtual Private Cloud (VPC): Virtual Private Cloud is an isolated virtual network within the cloud infrastructure. Within this VPC, you can define other networking components like Application Load Balancers, Ingress controllers, and more.

  • Application Load Balancer (ALB): Application Load balancer distributes an external incoming HTTP/HTTPS traffic to the Kubernetes services and StatefulSets. A load balancer is a third-party component. ALB integrates with ACM to support HTTPS termination, ensuring secure communication channels.

  • Ingess: Ingress exposes the Self Service Password Reset services to external clients and is used for both internal and external traffic routing. However, in the SSPR Kubernetes architecture, Ingress manages the traffic within the Kubernetes cluster to allow HTTP/HTTPS request routing based on defined rules. For more information, see Ingress.

  • Elastic compute cloud (EC2) instance: Amazon EC2 instance is a virtual server provided by AWS that allows you to run the SSPR applications in the cloud. In the Self Service Password Reset Kubernetes, one EC2 instance is configured to function as a worker node within a cluster.

  • StatefulSet: StatefulSet is a Kubernetes controller to manage Stateful applications. It assigns a unique, stable identity, and persistent storage to each pod. This unique identity remains the same across pod rescheduling, restarts, and scaling events.

  • Elastic container registry (ECR): ECR hosts Docker container images used by Kubernetes deployments. It manages the storage and distribution of container images and ensures that the Kubernetes pods pull the required images for deployment and scaling operations.

  • Persistent Volume Claim (PVC): PVC is a request or claim for storage request to Persistent Volume by a pod in cluster. If there is a Persistent Volume that meets the criteria specified in the PVC (e.g., capacity, access mode), Kubernetes binds the PVC to the Persistent Volume dynamically.

  • Persistent Volume (PV): Persistent volume is a permanent piece of storage for each pod that represents the EFS volume. SSPR Kubernetes supports the dynamic provisioning to automate the process of creating PVs when there is a request from PVC. This storage holds critical application data, such as database files or configuration settings.

  • Elastic File System (EFS): EFS is the web service provided by AWS. It provides a serverless, fully elastic, and scalable file storage service that allows you to share file data without managing the storage capacity. It is used for storing shared data such as configuration files or any data that needs to be accessed and updated by multiple pods within the same or different StatefulSet.

  • LDAP Connection: LDAP stores directory information, which includes user data, authentication credentials, and configurations. StatefulSet Pods interact with LDAP using LDAP protocols (like LDAP over SSL/TLS) to query LDAP for user authentication, authorization, and retrieve directory information as needed.

  • External Database: External database provides persistent data storage to the Kubernetes applications for database management. Kubernetes does not have its built-in database service and depends on external databases for storing application data.

    NOTE:Self Service Password Reset supports Microsoft SQL Server, PostgreSQL, and Oracle database.

  • Network Address Translation (NAT) Gateway: A NAT is a service provided by AWS that enables EC2 instances within a Virtual Private Cloud (VPC) to securely and reliably access the Internet or external applications. It ensures that the internal network remains protected from direct exposure to external networks.

  • External Web Application: External web applications are those that are deployed outside of the AWS cloud. EC2 instances connect to external web applocations to perform critical SSPR functions. These applications may include SMTP servers, SMS gateways, or other external applications or services that are vital to operations.