Akka / Deployment / How AAO works / Data flows

End users

End user accessing an Akka service from outside your environment

End user

Akka Region

Public (through your firewall)

Your keys, secrets, and tokens

End users

End user accessing an Akka service from inside your environment

End user

Akka Region

Private (peering)

Your keys, secrets, and tokens

Deployed services

Access to your private internal systems

Your service

Your APIs

Private (peering)

Your keys, secrets, and tokens

Deployed services

Pushing observability metrics for your services to your observability

Akka Region

Your observability

Private (peering)

Your keys, secrets, and tokens

Operators and developers

Akka CLI or console authentication initiation

CLI or console

Federation Plane

Public (firewall, Federation Plane allowlisted)

Akka authentication

Operators and developers

OpenID authentication

Console

Your IAM

Public

OpenID

Operators and developers

Add a region to a project

CLI

Federation Plane

Public (firewall, Federation Plane allowlisted)

Akka authenticated, valid access token

Operators and developers

Initiate multi-region failover

CLI

Akka Region

Private (peering)

Akka authenticated, valid access token

Operators and developers

List services and projects

CLI

Akka Region

Private (peering)

Akka authenticated, valid access token

Operators and developers

Create a project

CLI

Federation Plane

Public (firewall, Federation Plane allowlisted)

Akka authenticated, valid access token

Operators and developers

Add a user, role, or permission

CLI

Federation Plane

Public (firewall, Federation Plane allowlisted)

Akka authenticated, valid access token

Operators and developers

Inspect service components in a region

CLI

Akka Region

Private (peering)

Akka authenticated, valid access token

Operators and developers

Deploy a service: initiate deployment

CI/CD or developer

Akka Region

Private (peering)

Akka authenticated, valid access token

Operators and developers

Deploy a service: region pulls the image

Akka Region

Your image registry

Private (peering)

Akka authenticated, valid access token

Akka SRE

Troubleshoot a region (cloud console or kubectl)

Your VDI, when needed

Akka Region

Private (your remote desktop)

Your cloud credentials, granted through Teleport

Akka Region

Region observability metadata to the Federation Plane

Akka Region

Federation Plane

Public (Akka NAT gateway)

Kubernetes RBAC and Federation Plane observability token

Akka Region

Region requests the public key set

Akka Region

Federation Plane

Public (Akka NAT gateway)

Internal Akka JWT authentication

Akka Region

Certificate expiration monitoring (can be disabled)

Akka Region

Akka SRE

Public (Akka NAT gateway)

Kubernetes RBAC

Akka Region

Replication to another Akka Region

Akka Region

Akka Region

Private (peering)

Mutual TLS and ACLs

Federation Plane

Bootstrap a new Akka Region

Federation Plane

Akka Region

Public (pre-authorized IP ranges)

Federation Plane

Install a new version of Akka into a region

Federation Plane

Akka Region

Public (pre-authorized IP ranges)

Federation Plane

Maintain infrastructure (drift detection)

Federation Plane

Akka Region

Public (pre-authorized IP ranges)

Federation Plane

Upgrade infrastructure (Kubernetes, database)

Federation Plane

Akka Region

Public (pre-authorized IP ranges)

Federation Plane

Multi-region root CA management for cross-region mTLS

Federation Plane

Akka Region

Public (pre-authorized IP ranges)

Federation Plane

Synchronize project, user, role, organization, and region metadata

Federation Plane

Akka Region

Public (pre-authorized IP ranges)