Cloud Infrastructure
Relevant source files
The following files were used as context for generating this wiki page:
- archive/enterprise_legacy/deploy-complete.sh
- deployment-packs/aws/backstage/template.yaml
- deployment-packs/azure/backstage/template.yaml
- deployment-packs/kubernetes/backstage/template.yaml
- scripts/deploy-gcp.sh
- archive/enterprise_legacy/backstage/template.yaml
- archive/enterprise_legacy/terraform/outputs.tf
The Cloud Infrastructure for Fixops is designed as a multi-cloud, bank-grade automated deployment system. It utilizes Infrastructure as Code (IaC) via Terraform and Kubernetes manifests to provision resources across major cloud providers, including AWS, Azure, and GCP, as well as vanilla Kubernetes environments. The infrastructure supports high availability (HA), persistent storage for the "Evidence Lake," and integrated monitoring for security operations.
The primary goal of the infrastructure is to provide a consistent environment for the Fixops Decision Engine. This is achieved through standardized deployment packs that integrate with Backstage.io for simplified developer self-service. These packs handle the lifecycle of components such as the backend decision engine, frontend UI, MongoDB for data persistence, and Redis for caching.
Sources: archive/enterprise_legacy/deploy-complete.sh:3-7, deployment-packs/aws/backstage/template.yaml:4-8, deployment-packs/kubernetes/backstage/template.yaml:4-8
Multi-Cloud Deployment Architecture
Fixops provides specialized deployment templates for different cloud environments. Each template ensures that the specific managed services of the provider (e.g., AWS EKS, Azure AKS, GCP GKE) are configured according to bank-grade security standards, including network isolation, RBAC, and encrypted storage.
Infrastructure Provisioning Flow
The deployment process follows a standardized sequence regardless of the target cloud provider. It typically involves validating prerequisites, initializing Terraform backends, planning the infrastructure, and applying the changes to the Kubernetes cluster.
The diagram shows the standard pipeline flow for provisioning Fixops infrastructure and deploying the application.
Sources: archive/enterprise_legacy/deploy-complete.sh:32-108, scripts/deploy-gcp.sh:103-125
Provider-Specific Managed Services
| Provider | Kubernetes Service | Storage Solution | Ingress / Networking |
|---|---|---|---|
| AWS | EKS (Elastic Kubernetes Service) | EBS (Elastic Block Store) | ALB (Application Load Balancer) |
| Azure | AKS (Azure Kubernetes Service) | Azure Disk | Application Gateway |
| GCP | GKE (Google Kubernetes Engine) | Persistent Disk | GCP Cloud Load Balancer |
| Vanilla K8s | Standard K8s Distribution | Persistent Volume Claims | Nginx / Traefik Ingress |
Sources: deployment-packs/aws/backstage/template.yaml:4-7, deployment-packs/azure/backstage/template.yaml:4-7, deployment-packs/kubernetes/backstage/template.yaml:4-7, scripts/deploy-gcp.sh:6-10
Core Infrastructure Components
1. Kubernetes Workloads
The infrastructure deploys several key workloads into a dedicated namespace (defaulting to fixops).
- fixops-backend: The core decision engine, typically deployed with 3 replicas for high availability.
- fixops-frontend: The user interface for security teams.
- mongodb: Used for the Evidence Lake, requiring persistent storage and encrypted volumes.
- redis: Used for caching and session management.
Sources: archive/enterprise_legacy/backstage/template.yaml:145-215, deployment-packs/kubernetes/backstage/template.yaml:126-130
2. Evidence Lake Storage
Persistence for audit trails and security evidence is handled by a MongoDB instance. In enterprise deployments, this requires a specific storage_class (e.g., bank-encrypted-ssd) and a minimum storage size, often defaulting to 10Gi but scalable up to 1Ti.
Sources: deployment-packs/aws/backstage/template.yaml:70-75, archive/enterprise_legacy/backstage/template.yaml:166-180
3. Networking and Ingress
Fixops exposes multiple endpoints for different operational needs. The infrastructure configuration handles the creation of hostnames and the application of security headers and TLS certificates.
| Endpoint Type | Purpose | Example URL |
|---|---|---|
| API | CI/CD Integration | https://api.fixops.devops.ai |
| UI | Security Team Dashboard | https://fixops.devops.ai |
| Metrics | Prometheus Scrape Target | https://api.fixops.devops.ai/metrics |
| Health | Readiness/Liveness Checks | https://api.fixops.devops.ai/health |
Sources: archive/enterprise_legacy/terraform/outputs.tf:5-32, archive/enterprise_legacy/backstage/template.yaml:263-275
Security and Compliance Controls
The infrastructure is designed to meet strict banking compliance requirements (e.g., PCI DSS, SOX, FFIEC).
- Identity and Access Management: Uses Kubernetes RBAC with minimal permissions for service accounts (e.g.,
fixops-backendonly gets, lists configmaps/secrets/pods). - Network Isolation: Implements Kubernetes network policies and restricted pod security standards.
- Secrets Management: Environment variables such as
EMERGENT_LLM_KEY,MONGODB_PASSWORD, andREDIS_PASSWORDare injected as Kubernetes Secrets and are marked as sensitive in Terraform. - Data Integrity: Audit trails in the Evidence Lake consist of cryptographically signed JSON records with SHA256 hash validation.
Sources: archive/enterprise_legacy/backstage/template.yaml:145-165, archive/enterprise_legacy/terraform/outputs.tf:80-105, deployment-packs/kubernetes/backstage/template.yaml:111-122
Infrastructure Configuration
Cloud infrastructure is configured using a set of standard parameters across the deployment packs.
| Parameter | Type | Default | Description |
|---|---|---|---|
deployment_name | string | fixops-decision-engine | Unique identifier for the deployment. |
environment | enum | production | Deployment stage (development, staging, production). |
backend_replicas | integer | 3 | Number of engine replicas for HA. |
storage_size | string | 10Gi | Size of the persistent volume for the Evidence Lake. |
enable_monitoring | boolean | true | Whether to deploy Prometheus/Grafana stacks. |
Sources: deployment-packs/aws/backstage/template.yaml:23-53, deployment-packs/kubernetes/backstage/template.yaml:21-45
Conclusion
The Cloud Infrastructure of Fixops provides a resilient and secure foundation for automated security decision-making. By leveraging multi-cloud Terraform modules and Kubernetes-native configurations, it ensures that security teams can deploy the decision engine consistently across various environments while maintaining strict compliance and operational visibility through integrated monitoring and evidence storage.
Sources: archive/enterprise_legacy/deploy-complete.sh:176-183, archive/enterprise_legacy/terraform/outputs.tf:106-115