The infrastructure is entirely containerised (Docker) and orchestrated via Amazon EKS. No pet servers — every compute resource is defined in code (Terraform) and reproduced identically across environments. The deployment pipeline enforces immutable image tags, environment-specific secrets, and mandatory security scanning before any image reaches production.

The production EKS cluster runs in Amazon EKS v1.29+ across three availability zones (ap-south-1a, 1b, 1c). Three node groups separate compute concerns and enable independent scaling policies.

Namespace Strategy

Pod Security & mTLS

Istio service mesh is deployed cluster-wide with STRICT mTLS mode — all pod-to-pod communication is mutually authenticated and encrypted. PodSecurityPolicy (or Pod Security Admission in newer K8s) enforces: no privilege escalation, read-only root filesystem, non-root user, no host network/PID. Secrets are injected via AWS Secrets Manager CSI driver — never as environment variables or ConfigMaps.

TLS & Certificate Management

All external TLS is terminated at the ALB with ACM-managed certificates (auto-renewed). Internal pod-to-pod TLS is managed by Istio using SPIFFE/SPIRE identities — certificates rotate every 24 hours automatically. ERP connector mTLS uses per-distributor client certificates issued by AltScore's internal CA (cert-manager on K8s), rotated every 90 days. All certificates are SHA-256/RSA-4096 or EC P-256.

Every service follows an identical pipeline enforced by GitHub Actions. Merges to main automatically deploy to staging; promotion to production requires manual approval from two engineers. No direct production access — all changes go through the pipeline.

ML Model Deployment

ML model promotion follows a separate path governed by the Guardrail Committee process (GRD-ALTSCORE-001, Section 10). Model artifacts are stored in MLflow on S3 with SHA-256 hash verification. The Scoring Engine pulls the active model at startup — it never bakes model weights into a container image. Model promotion is triggered via the Admin Service (two-person sign-off), which updates a model pointer in the database; the Scoring Engine reloads the new artifact within 60 seconds without a container restart.

GitOps Repository Structure

Three fully isolated environments — Development, Staging, Production — each in separate AWS accounts (AWS Organizations). No shared resources; no prod credentials accessible from dev or staging. Staging mirrors production configuration exactly (same instance types, same security policies) to prevent "works in staging" surprises.

Environment Promotion Flow

Code flows dev → staging → production only. No hot-patches to production without staging validation except for P1 incidents (break-glass procedure with post-incident review required). Environment-specific secrets are managed in AWS Secrets Manager per account; no secrets in code repositories.

Key Alerts

Backup Schedule

All capacity estimates assume a 2× headroom buffer over peak measured load. The cluster autoscaler and HPA are configured to scale before hitting 70% utilization on any node group, ensuring buffer for traffic spikes without service degradation.