Network & Infrastructure Architecture

CDN · Load Balancers · TLS/mTLS · API Gateway · Service Mesh · Anti-Affinity

CDN & Global Traffic Management

Edge Caching · GSLB · Anycast · Geo-routing

CDNStatic assets, API responses (GET, cacheable) and portal pages served from CDN edge. TTL configured per content type. Stale-while-revalidate for catalog API responses.

Cache TTL PolicyStatic assets: 1 year (versioned). Product catalog API: 5 min. Subscriber data: 0 (no cache). Invoice PDFs: 24 h (authenticated).

GSLBGlobal Server Load Balancing routes traffic to nearest healthy data centre. Health checks at a configurable interval. Automatic failover to secondary region on health check failure.

Anycast DNSAnycast IP routing delivers requests to the geographically nearest PoP. Low-latency DNS resolution at the edge.

Edge Cache GSLB Anycast Cache-Control

Load Balancers — L4 & L7

External · Internal · Health Checks · Algorithms

External LB (L7)HTTP/2 + gRPC aware. Path-based routing to API gateway. TLS termination. Connection draining on pod scale-down. Sticky sessions via consistent hashing where required.

Internal LB (L4)Cluster Network Proxy for east-west service-to-service traffic. Round-robin by default. Least-connections for stateful services (billing, payment).

Health ChecksLiveness: container alive? Readiness: can accept traffic? Startup: slow-starting containers. All three probes mandatory. Unhealthy pods removed from LB pool within seconds.

AlgorithmRound-robin for stateless services. Consistent hash on subscriber ID for session-sensitive flows. Least outstanding requests for high-variance latency services.

L7 Routing Health Probes Connection Draining Consistent Hash

Stateless Services & Anti-Affinity

Stateless Design · Pod Anti-Affinity · Zone Spreading

Stateless microservices have no local in-memory state between requests. All session state is externalised to In-Memory Cache or a distributed cache. Any pod replica can serve any request — enabling true horizontal scalability and zero-downtime rolling deployments.

Stateless RuleNo pod may store session state, file system state or in-memory cache that is not shared. Configuration injected via environment / ConfigMap — not baked into image.

Pod Anti-AffinityRequired anti-affinity rule: no two replicas of the same service may run on the same node. Preferred anti-affinity: spread replicas across availability zones.

Zone SpreadingTopologySpreadConstraints enforce even distribution across AZs. Minimum 2 replicas per zone for tier-1 services (billing, order management, IAM).

Node AffinityRevenue-critical services (billing, rating) scheduled on dedicated node pools — isolated from dev/test workloads and batch jobs to prevent noisy-neighbour CPU contention.

Stateless Anti-Affinity Zone Spread Node Isolation

Non-Functional Requirements — Summary Reference

NFR Category	Requirement	Target / Standard	Status
Availability	Platform availability SLO	99.99% (≈ minutes per year)	Mandatory
Latency	API P99 latency (tier-1 services)	< Sub-second P99	Mandatory
Throughput	CDR processing rate	Very High — stream processing sustained	Mandatory
RTO	Revenue-critical service recovery	<Minutes (Tier 0 — near-zero)	Mandatory
RPO	Maximum data loss window	Near-zero (Tier 0 — synchronous replication)	Mandatory
Security	Encryption in transit	TLS 1.3+ on external traffic, mTLS on all inter-service communication	Mandatory
Security	Encryption at rest	AES-256-GCM all data stores	Mandatory
Identity	Authentication protocol	OAuth 2.0 / OIDC + Workload Identity Standard workload identity	Mandatory
PII Compliance	GDPR — Right to Erasure SLA	Confirmed deletion within the regulatory SLA window	Mandatory
Resilience	Circuit breaker on all external calls	Error rate >50% in 10 s window triggers open	Mandatory
Idempotency	All financial mutation endpoints	Idempotency key + 24 h dedup store	Mandatory
Scalability	HPA on all stateless services	CPU target 60%, scale within a short cool-down window	Mandatory
Anti-Affinity	Pod distribution	Required: no two replicas on same node; Preferred: spread across AZs	Mandatory
Technical Debt	Sprint debt remediation allocation	Minimum 20% per sprint	Recommended
Observability	Distributed tracing coverage	100% of requests carry traceId; 10% sampled	Mandatory
CI/CD Security	SAST + SCA in every pipeline	Critical/High CVEs block merge	Mandatory

Network & Infrastructure

Telecom

Apps

Company