SAD¶

Table of Content:

• SAD
• Overview
• SAD - System architechture design
  • Techstack
  • Logical View
  • Physical View
  • Deployment
  • Security
  • Service Accounts Permission
• Appendix
  • Appendix A: Record of Changes

Overview¶

Inno Auth Internal is a serverless auth service serving both authentication and authortication for Data Platform

SAD - System architechture design¶

Techstack¶

[+] Programing Language: Python, Bash

[+] Deployment notification service:

• Serverless: Cloud Run

• CICD: CloudBuild, GitHub Actions

• Secret: Secret Manager

• Development: docker, docker-compose

Logical View¶

The logical view method of notification service

flowchart TB

  %% Component

  subgraph client[Internal Client]
    direction LR
    subgraph onprem[On premises Server]
      client_outside[Outside Cloud Client]
    end

    subgraph gcp1[Google Cloud Platform]
      client_inside[Cloud Client Client]
    end
  end

  subgraph gcp[Google Cloud Platform]

    subgraph auth[Auth Internal]
      auth-service[Notification Service]
    end

    subgraph service[Cloud Services]
      database
      dot[...]
      compute_engine[Compute Engine]
    end

  end

  %% Flow
  client -- request --> service -- redirect --> auth -- authentication & authorization --> service

Physical View¶

Following is the deployed services that matching on notification service

flowchart LR

  %% Service in Cloud Platform
  subgraph Google Cloud Platform

    cbuild[Cloud Build]
    lb[Load Balancing]
    iap[Cloud IAP]
    secret[Cloud Secret Manager]
    logging[Cloud Logging]
    iam[Cloud IAM]
    artifact[Cloud Artifact]

    subgraph auth[Auth Service]
      run[Cloud Run]
    end

    subgraph keycloak[KeyCloak Mother Plane]
      keycloak_service[KeyCloak]
    end

    run <-- interactive --> keycloak

  end

  subgraph gh[GitHub]
    repository[Repository]
  end

  %% Flow
  lb -- navigate --> iap -- handle authentication --> run
  gh <-- sync/trigger --> cbuild -- deploy --> run
  secret <-. mount .-> run
  iam -- control access --> cbuild
  cbuild -- store images --> artifact
  run -- yield logs --> logging

Deployment¶

There are 3 deployment environments: development, staging, production

Security¶

Service Accounts Permission¶

For the deployment of builder related to inno-auth-internal will in charge by:

sa-mars: Project builder:

Service account: sa-mars@$PROJECT_ID.iam.gserviceaccount.com

Alias: sa-mars

sa-timbersaw: Runner of Cloud Run:

Service account: sa-timbersaw@$PROJECT_ID.iam.gserviceaccount.com

Alias: sa-timbersaw

Appendix¶

Appendix A: Record of Changes¶

Table: Record of changes