> ## Documentation Index
> Fetch the complete documentation index at: https://team.k0labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Architecture of the k0rdent platform

## High-Level Architecture

<img src="https://mintcdn.com/retrospct-44ae124d/8J79JmhP712b7CXk/images/k0rdent-product-architecture.png?fit=max&auto=format&n=8J79JmhP712b7CXk&q=85&s=76817c49ba1adf078b35236df0c784b3" alt="k0rdent Product Architecture" width="10288" height="6390" data-path="images/k0rdent-product-architecture.png" />

## OAuth Organization Auto-Creation & Invite Handling

<img src="https://mintcdn.com/retrospct-44ae124d/gXEJWVlWVW_2NTbw/images/organization-auto-create-invite.png?fit=max&auto=format&n=gXEJWVlWVW_2NTbw&q=85&s=d777ce901e6ede0bc546c0301f4f7ec1" alt="k0rdent OAuth Organization Join Flow" width="695" height="1167" data-path="images/organization-auto-create-invite.png" />

## OAuth AWS Cognito Integration

<img src="https://mintcdn.com/retrospct-44ae124d/gXEJWVlWVW_2NTbw/images/aws-cognito-oauth.png?fit=max&auto=format&n=gXEJWVlWVW_2NTbw&q=85&s=0d401cff76399e9fb71a70e4b652b032" alt="k0rdent OAuth AWS Cognito Integration" width="1366" height="615" data-path="images/aws-cognito-oauth.png" />

## Optional Global API Gateway Registry

An optional registry setup to remove any path based routing for internal services.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/retrospct-44ae124d/images/api-gw-registry.png" alt="k0rdent Global API Gateway Registry" />

```mermaid theme={null}
graph TB
    subgraph Tenants["🔐 Tenants"]
        TA["Tenant A (JWT)"]
        TB["Tenant B (JWT)"]
        TN["Tenant N (JWT)"]
    end

    subgraph Edge["☁️ CloudFront + Lambda@Edge"]
        CF["CloudFront"]
        LE["Lambda@Edge<br/>1. Extract tenant ID<br/>2. Parse resource type + ID<br/>3. Check cache<br/>4. Lookup DC<br/>5. Route"]
        EC["Edge Cache<br/>tenant:type:id → DC"]
        CF --> LE
        LE <-.-> EC
    end

    subgraph USWest["🟢 Region: US-West-2"]
        AGW1["API Gateway<br/>Auth + Rate Limit"]
        ALB1["ALB"]
        BE1["Backend Services<br/>K8s | Bare Metal | VMs"]
        AGW1 --> ALB1 --> BE1
    end

    subgraph EUWest["🔵 Region: EU-West-1"]
        AGW2["API Gateway<br/>Auth + Rate Limit"]
        ALB2["ALB"]
        BE2["Backend Services<br/>K8s | Bare Metal | VMs"]
        AGW2 --> ALB2 --> BE2
    end

    subgraph APSouth["🟣 Region: AP-Southeast-1"]
        AGW3["API Gateway<br/>Auth + Rate Limit"]
        ALB3["ALB"]
        BE3["Backend Services<br/>K8s | Bare Metal | VMs"]
        AGW3 --> ALB3 --> BE3
    end

    subgraph Registry["🔶 Registry & Event-Driven Updates"]
        IT["Infrastructure Tools<br/>Terraform / k0rdent"]
        EB["EventBridge"]
        LU["Lambda<br/>Registry Updater<br/>+ Cache Invalidation"]
        DDB["DynamoDB Global Table<br/>PK: TENANT#id<br/>SK: resource_type#id<br/>DC: region"]
        IT -->|event| EB --> LU -->|write| DDB
    end

    TA & TB & TN --> CF
    LE -->|route| AGW1
    LE -->|route| AGW2
    LE -->|route| AGW3
    LE -.->|cache miss| DDB
    LU -.->|invalidate| EC

    style Edge fill:#eef2ff,stroke:#6366f1
    style USWest fill:#f0fdf4,stroke:#86efac
    style EUWest fill:#eff6ff,stroke:#93c5fd
    style APSouth fill:#fdf4ff,stroke:#e879f9
    style Registry fill:#fff7ed,stroke:#ea580c
    style Tenants fill:#f5f3ff,stroke:#c4b5fd
```