Infrastructure as Code (IaC), Kubernetes Manifests, and Service Mesh Configuration for the 3RVision Application
This repository contains the complete infrastructure setup for deploying the 3RVision application as a cloud-native microservices architecture. The project demonstrates modern DevOps practices and production-ready Kubernetes deployment patterns.
1. Infrastructure as Code with Terraform
- Automated Kind (Kubernetes in Docker) cluster provisioning
- Multi-node cluster setup with 1 control plane and 2 worker nodes
- Configurable port mappings for external access
2. Microservices Deployment on Kubernetes
- Three-tier architecture: Frontend, Backend, and ML Model services
- Each service deployed in isolated namespaces for better resource management
- ConfigMaps and Secrets for externalized configuration
- Health probes (readiness/liveness) for reliable service availability
3. Istio Service Mesh Integration
- Traffic Management: VirtualServices and DestinationRules for intelligent routing
- Canary Deployments: Weight-based traffic splitting (90/10) between stable and canary versions
- Header-based Routing: Route specific requests to canary using
x-canary: trueheader - Security: Strict mTLS (mutual TLS) encryption for all inter-service communication
- Load Balancing: Round-robin distribution with connection pooling
- Circuit Breaking: Outlier detection to prevent cascading failures
4. Observability Stack
- Prometheus: Metrics collection from Kubernetes, Istio, and Envoy proxies
- Jaeger: Distributed tracing with 100% sampling for request flow visibility
- Grafana: Visualization dashboards connected to Prometheus datasource
5. Production-Ready Patterns
- Canary deployment strategy for safe rollouts
- Namespace isolation for security boundaries
- RBAC configuration for Prometheus service account
- Automated deployment scripts for observability components
| Section | Description |
|---|---|
| Architecture Overview | High-level system design |
| Repository Structure | Project organization |
| Mind Maps | Visual diagrams of components |
| Getting Started | Setup instructions |
| Component Deep Dive | Detailed configurations |
| Canary Deployment | Traffic splitting strategy |
| Service Ports | Port reference table |
3RVision is deployed on Kubernetes with Istio service mesh for advanced traffic management, security, and observability.
βββββββββββββββββββββββ
β User/Client β
ββββββββββββ¬βββββββββββ
β
βΌ
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β KIND KUBERNETES CLUSTER β
β (Terraform Provisioned) β
β ββββββββββββββββββ ββββββββββββββββββ ββββββββββββββββββ β
β β Control Plane β β Worker #1 β β Worker #2 β β
β ββββββββββββββββββ ββββββββββββββββββ ββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β ISTIO SERVICE MESH β
β β
β Gateway βββββββΊ VirtualService βββββββΊ DestinationRule β
β (Ingress) (Routing) (mTLS + Load Balancing) β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β MICROSERVICES β
β β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββ β
β β FRONTEND β β BACKEND β β ML MODEL β β
β β (Next.js) βββββΊβ (Go) βββββΊβ (Flask) β β
β β Port: 3000 β β Port: 8080 β β Port: 5001 β β
β β β β β β β β
β β stable/canaryβ β stable/canaryβ β stable/canaryβ β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β OBSERVABILITY STACK β
β β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββ β
β β Prometheus β β Jaeger β β Grafana β β
β β (Metrics) β β (Tracing) β β (Dashboards) β β
β β Port: 9090 β β Port: 16686 β β Port: 3000 β β
β ββββββββββββββββ ββββββββββββββββ ββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
3RVision-Infra/
βββ Readme.md # This documentation file
βββ .gitignore # Git ignore patterns
β
βββ Terraform/ # Infrastructure as Code
β βββ kind-cluster/
β βββ main.tf # Kind cluster definition
β βββ variables.tf # Cluster configuration variables
β βββ outputs.tf # Cluster outputs (kubeconfig, endpoints)
β
βββ k8s/ # Kubernetes Manifests
β βββ backend/ # Backend service manifests
β β βββ deployment-stable.yaml # Stable version deployment
β β βββ deployment-canary.yaml # Canary version deployment
β β βββ service.yaml # Backend service definition
β β βββ secret.yaml # Environment secrets
β β βββ backup-backend-deployment.yaml
β β
β βββ frontend/ # Frontend service manifests
β β βββ deployment-stable.yaml # Stable version deployment
β β βββ deployment-canary.yaml # Canary version deployment
β β βββ service.yaml # Frontend service definition
β β βββ secrets.yaml # Environment secrets
β β βββ backup-frontend-deployment.yaml
β β
β βββ model/ # ML Model service manifests
β β βββ deployment-stable.yaml # Stable version deployment
β β βββ deployment-canary.yaml # Canary version deployment
β β βββ service.yaml # ML service definition
β β βββ configmap.yaml # Model configuration
β β βββ backup-ml-deployment.yaml
β β
β βββ observability/ # Monitoring & Tracing
β βββ namespace.yaml # Observability namespace
β βββ prometheus/ # Metrics collection
β β βββ config.yaml # Prometheus scrape config
β β βββ deployment.yaml # Prometheus deployment
β β βββ rbac.yaml # RBAC permissions
β β βββ deploy-prometheus.sh # Deployment script
β β βββ verify-prometheus.sh # Verification script
β βββ jaeger/ # Distributed tracing
β β βββ deployment.yaml # Jaeger all-in-one deployment
β β βββ deploy-jaeger.sh # Deployment script
β β βββ verify-jaeger.sh # Verification script
β βββ grafana/ # Visualization dashboards
β βββ datasource.yaml # Prometheus datasource config
β βββ deployment.yaml # Grafana deployment
β βββ deploy-grafana.sh # Deployment script
β
βββ istio/ # Service Mesh Configuration
βββ gateway/
β βββ frontend-gateway.yaml # Istio ingress gateway
β
βββ virtual-services/ # Traffic routing rules
β βββ virtualservice-frontend-gateway.yaml # External traffic routing
β βββ virtualservice-frontend-mesh.yaml # Internal mesh routing
β βββ virtualservice-backend.yaml # Backend routing
β βββ virtualservice-ml.yaml # ML service routing
β
βββ destination-rules/ # Load balancing & connection pools
β βββ destination-rule-frontend.yaml
β βββ destination-rule-backend.yaml
β βββ destination-rule-ml.yaml
β
βββ mTLS/ # Mutual TLS configuration
β βββ peer-authentication/
β β βββ peer-authentication-frontend.yaml
β β βββ peer-authentication-backend.yaml
β β βββ peer-authentication-ml.yaml
β βββ verify-mtls.sh # mTLS verification script
β
βββ telemetry/
βββ tracing-config.yaml # Jaeger tracing configuration
USER REQUEST
β
βΌ
βββββββββββββββββββββββββββββββ
β Istio Ingress Gateway β
β (Port: 30080) β
βββββββββββββββββββββββββββββββ
β
ββββββββββββββββββββββββββΌβββββββββββββββββββββββββ
β β β
βΌ βΌ βΌ
βββββββββββββββ βββββββββββββββ βββββββββββββββ
β FRONTEND β β BACKEND β β ML MODEL β
β Namespace β β Namespace β β Namespace β
βββββββββββββββ€ βββββββββββββββ€ βββββββββββββββ€
β β β β β β
β Service: β β Service: β β Service: β
β frontend-svcβββββββββββΊβ backend-svc βββββββββββΊβ ml-svc β
β Port: 3000 β β Port: 8080 β β Port: 5001 β
β β β β β β
β Deployments:β β Deployments:β β Deployments:β
β β’ stable(2) β β β’ stable(2) β β β’ stable(2) β
β β’ canary(1) β β β’ canary(1) β β β’ canary(1) β
β β β β β β
β Config: β β Config: β β Config: β
β [Secrets] β β [Secrets] β β [ConfigMap] β
βββββββββββββββ βββββββββββββββ βββββββββββββββ
ISTIO SERVICE MESH TRAFFIC FLOW
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β EXTERNAL TRAFFIC INTERNAL (MESH) TRAFFIC β
β β β β
β βΌ βΌ β
β βββββββββββββββ βββββββββββββββ β
β β frontend- β β mesh β β
β β gateway β β (default) β β
β β Port:3000 β β β β
β ββββββββ¬βββββββ ββββββββ¬βββββββ β
β β β β
β βΌ βΌ β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β VIRTUAL SERVICES β β
β β β β
β β Routing Rules: β β
β β β’ Header "x-canary: true" βββΊ 100% Canary β β
β β β’ Default Traffic βββΊ 10% Stable + 90% Canary β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β
β βΌ β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β DESTINATION RULES β β
β βββββββββββββββββββββββ¬ββββββββββββββββββββββ¬ββββββββββββββββββββββββββ€ β
β β frontend-dr β backend-dr β ml-dr β β
β βββββββββββββββββββββββΌββββββββββββββββββββββΌββββββββββββββββββββββββββ€ β
β β TLS: ISTIO_MUTUAL β TLS: ISTIO_MUTUAL β TLS: ISTIO_MUTUAL β β
β β LB: ROUND_ROBIN β LB: ROUND_ROBIN β LB: ROUND_ROBIN β β
β β TCP Conn: 100 β TCP Conn: 100 β TCP Conn: 50 β β
β β HTTP Pending: 50 β HTTP Pending: 50 β HTTP Pending: 30 β β
β β Outlier: 3 errors β Outlier: 3 errors β Outlier: 3 errors β β
β β β β β β
β β Subsets: β Subsets: β Subsets: β β
β β β’ stable β β’ stable β β’ stable β β
β β β’ canary β β’ canary β β’ canary β β
β βββββββββββββββββββββββ΄ββββββββββββββββββββββ΄ββββββββββββββββββββββββββ β
β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
mTLS SECURITY CONFIGURATION
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β ββββββββββββββββββββββββββββββββ β
β β PeerAuthentication β β
β β (STRICT mTLS Enforcement) β β
β ββββββββββββββββ¬ββββββββββββββββ β
β β β
β ββββββββββββββββββββββββΌβββββββββββββββββββββββ β
β β β β β
β βΌ βΌ βΌ β
β βββββββββββββββββββ βββββββββββββββββββ βββββββββββββββββββ β
β β frontend-mtls β β backend-mtls β β ml-mtls β β
β β NS: frontend β β NS: backend β β NS: ml β β
β β Mode: STRICT β β Mode: STRICT β β Mode: STRICT β β
β ββββββββββ¬βββββββββ ββββββββββ¬βββββββββ ββββββββββ¬βββββββββ β
β β β β β
β βΌ βΌ βΌ β
β βββββββββββββββββββ βββββββββββββββββββ βββββββββββββββββββ β
β β Envoy Sidecar β β Envoy Sidecar β β Envoy Sidecar β β
β β (TLS 1.2/1.3) β β (TLS 1.2/1.3) β β (TLS 1.2/1.3) β β
β ββββββββββ¬βββββββββ ββββββββββ¬βββββββββ ββββββββββ¬βββββββββ β
β β β β β
β βΌ βΌ βΌ β
β βββββββββββββββββββ βββββββββββββββββββ βββββββββββββββββββ β
β β Frontend App β β Backend App β β ML Model β β
β β (plaintext) β β (plaintext) β β (plaintext) β β
β βββββββββββββββββββ βββββββββββββββββββ βββββββββββββββββββ β
β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β ENCRYPTED TRAFFIC FLOW β
β β
β Frontend ββββββ [mTLS] ββββββΊ Backend ββββββ [mTLS] ββββββΊ ML Model β
β β
β All inter-service communication is encrypted with mutual TLS β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
OBSERVABILITY ARCHITECTURE
(Namespace: observability)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β β
β βββββββββββββββββββββ β
β β Istio Telemetry β β
β β (100% sampling) β β
β βββββββββββ¬ββββββββββ β
β β β
β ββββββββββββββββββββββββΌβββββββββββββββββββββββ β
β β β β β
β βΌ βΌ βΌ β
β βββββββββββββββββββ βββββββββββββββββββ βββββββββββββββββββ β
β β PROMETHEUS β β JAEGER β β GRAFANA β β
β β (Metrics) β β (Tracing) β β (Dashboards) β β
β βββββββββββββββββββ€ βββββββββββββββββββ€ βββββββββββββββββββ€ β
β β Port: 9090 β β Port: 16686 β β Port: 3000 β β
β β NodePort: 30090 β β NodePort: 30686 β β NodePort: 30330 β β
β βββββββββββββββββββ€ βββββββββββββββββββ€ βββββββββββββββββββ€ β
β β Scrape Jobs: β β Collectors: β β Datasource: β β
β β β’ prometheus β β β’ Zipkin (9411) β β β’ Prometheus β β
β β β’ k8s-apiserver β β β’ gRPC (14250) β β β β
β β β’ k8s-nodes β β β’ OTLP (4317) β β Features: β β
β β β’ k8s-pods β β β β β’ Dashboards β β
β β β’ istio-mesh β β Tags: β β β’ Istio metrics β β
β β β’ envoy-stats β β β’ env: dev β β β’ Alerting β β
β β β’ ingress-gw β β β’ cluster: kind β β β β
β βββββββββββββββββββ βββββββββββββββββββ β Auth: β β
β β admin/admin β β
β βββββββββββββββββββ β
β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β DATA COLLECTION FLOW β
β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
β β Frontend β β Backend β β ML Model β β
β β + Envoy β β + Envoy β β + Envoy β β
β ββββββββ¬βββββββ ββββββββ¬βββββββ ββββββββ¬βββββββ β
β β β β β
β βββββββββββββββββββββΌββββββββββββββββββββ β
β β β
β Envoy Proxy Metrics (port 15090) β
β β β
β βββββββββββββββββΌββββββββββββββββ β
β βΌ βΌ βΌ β
β Prometheus Jaeger Grafana β
β (scrape) (receive) (query) β
β β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
- Docker installed and running
- Terraform v1.0+
- kubectl v1.25+
- Istio CLI (istioctl)
- Kind (optional - Terraform handles this)
# Navigate to Terraform directory
cd Terraform/kind-cluster
# Initialize Terraform
terraform init
# Review the plan
terraform plan
# Create the cluster
terraform apply -auto-approve
# Get cluster info
terraform outputWhat this creates:
- A Kind (Kubernetes in Docker) cluster named
3rvision-cluster - 1 Control Plane node
- 2 Worker nodes
- Port mappings: 30080 (HTTP), 30443 (HTTPS)
# Create namespaces with Istio sidecar injection
kubectl create namespace frontend
kubectl create namespace backend
kubectl create namespace ml
kubectl label namespace frontend istio-injection=enabled
kubectl label namespace backend istio-injection=enabled
kubectl label namespace ml istio-injection=enabled
# Deploy Frontend
kubectl apply -f k8s/frontend/secrets.yaml
kubectl apply -f k8s/frontend/deployment-stable.yaml
kubectl apply -f k8s/frontend/deployment-canary.yaml
kubectl apply -f k8s/frontend/service.yaml
# Deploy Backend
kubectl apply -f k8s/backend/secret.yaml
kubectl apply -f k8s/backend/deployment-stable.yaml
kubectl apply -f k8s/backend/deployment-canary.yaml
kubectl apply -f k8s/backend/service.yaml
# Deploy ML Model
kubectl apply -f k8s/model/configmap.yaml
kubectl apply -f k8s/model/deployment-stable.yaml
kubectl apply -f k8s/model/deployment-canary.yaml
kubectl apply -f k8s/model/service.yaml# Install Istio (if not already installed)
istioctl install --set profile=demo -y
# Deploy Gateway
kubectl apply -f istio/gateway/frontend-gateway.yaml
# Deploy Virtual Services
kubectl apply -f istio/virtual-services/
# Deploy Destination Rules
kubectl apply -f istio/destination-rules/
# Deploy mTLS policies
kubectl apply -f istio/mTLS/peer-authentication/
# Configure Tracing
kubectl apply -f istio/telemetry/tracing-config.yaml
# Verify mTLS
./istio/mTLS/verify-mtls.sh# Deploy observability stack
./k8s/observability/prometheus/deploy-prometheus.sh
./k8s/observability/jaeger/deploy-jaeger.sh
./k8s/observability/grafana/deploy-grafana.sh
# Verify deployments
./k8s/observability/prometheus/verify-prometheus.sh
./k8s/observability/jaeger/verify-jaeger.sh| File | Purpose |
|---|---|
main.tf |
Defines the Kind cluster with control plane and worker nodes. Configures port mappings for external access (30080β80, 30443β443). |
variables.tf |
Defines configurable parameters (cluster name defaults to 3rvision-cluster). |
outputs.tf |
Exports cluster information including kubeconfig path, endpoint, and certificates. |
| File | Description |
|---|---|
deployment-stable.yaml |
Production deployment (v2) with 2 replicas |
deployment-canary.yaml |
Test deployment (v3) with 1 replica |
service.yaml |
NodePort service on port 30080 |
secret.yaml |
Contains ML_SERVER_URL, AWS credentials, Gemini API key |
| File | Description |
|---|---|
deployment-stable.yaml |
Production deployment with 2 replicas, health probes |
deployment-canary.yaml |
Test deployment (v3) with 1 replica, health probes |
service.yaml |
NodePort service on port 30300 |
secrets.yaml |
Contains backend URLs, MongoDB URI, JWT secret, email credentials |
| File | Description |
|---|---|
deployment-stable.yaml |
Production deployment with 2 replicas, health probes |
deployment-canary.yaml |
Test deployment (v3) with 1 replica, health probes |
service.yaml |
NodePort service on port 30501 |
configmap.yaml |
Contains PORT and MODEL_PATH configuration |
- frontend-gateway.yaml: Configures the Istio Ingress Gateway to accept HTTP traffic on port 3000 for all hosts.
| File | Traffic Routing |
|---|---|
virtualservice-frontend-gateway.yaml |
External traffic: x-canary header β 100% canary; default β 10% stable, 90% canary |
virtualservice-frontend-mesh.yaml |
Internal mesh traffic with same routing rules |
virtualservice-backend.yaml |
Backend routing: x-canary β canary; default β 10% stable, 90% canary |
virtualservice-ml.yaml |
ML routing: x-canary β canary; default β 10% stable, 90% canary |
All services have consistent policies:
- TLS: ISTIO_MUTUAL (automatic mTLS)
- Load Balancer: ROUND_ROBIN
- Connection Pool: TCP (50-100 max connections), HTTP (30-100 pending requests)
- Outlier Detection: 3 consecutive errors, 30s interval, 30s ejection time
- Subsets: stable, canary (based on version label)
All namespaces (frontend, backend, ml) have STRICT mTLS enforcement, ensuring all service-to-service communication is encrypted.
| Component | Purpose | Access |
|---|---|---|
| Prometheus | Metrics collection and storage | NodePort: 30090, Port-forward: 9090 |
| Jaeger | Distributed tracing | NodePort: 30686, Port-forward: 16686 |
| Grafana | Visualization dashboards | NodePort: 30330, Port-forward: 3030 |
Prometheus Scrape Targets:
- Prometheus self-monitoring
- Kubernetes API servers
- Kubernetes nodes (kubelet)
- Kubernetes pods (with annotation)
- Istio control plane (istiod)
- Envoy proxies (port 15090)
- Istio Ingress Gateway
Jaeger Configuration:
- 100% trace sampling
- Custom tags: environment (3rvision-dev), cluster (kind-cluster)
- Zipkin-compatible endpoint at 9411
The infrastructure supports canary deployments through Istio VirtualServices:
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β CANARY DEPLOYMENT FLOW β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Incoming Traffic
β
βΌ
ββββββββββββββββ
β Header Check β
β x-canary:trueβ
ββββββββ¬ββββββββ
β
ββββββ΄βββββ
βYes βNo
βΌ βΌ
ββββββββββ ββββββββββββββββ
β Canary β βWeight-Based β
β (100%) β βDistribution β
ββββββββββ β β
β ββββββββββββ β
β βStable 10%β β
β ββββββββββββ β
β ββββββββββββ β
β βCanary 90%β β
β ββββββββββββ β
ββββββββββββββββ
| Service | Internal Port | NodePort | Port-Forward | Description |
|---|---|---|---|---|
| Frontend | 3000 | 30300 | 3000:3000 | Next.js application |
| Backend | 8080 | 30080 | 8080:8080 | Go API server |
| ML Model | 5001 | 30501 | 5001:5001 | Flask ML service |
| Prometheus | 9090 | 30090 | 9090:9090 | Metrics dashboard |
| Jaeger | 16686 | 30686 | 16686:16686 | Tracing UI |
| Grafana | 3000 | 30330 | 3030:3000 | Visualization dashboards |
| Istio Gateway | 3000 | - | - | HTTP ingress |