Network Interactions and Private Connections for ULZ — Unique AI Documentation
Network Interactions and Private Connections for ULZ
Scope
This document provides an overview of the Unique AI connectivity architecture, including:
- Architecture Overview: High-level depiction of system connectivity.
- Component Breakdown: Descriptions of key components and their interactions.
- Security Measures: Outline of protocols ensuring data integrity and confidentiality.
- Integration Points: Details on external service and database integration.
- Data Flow: Explanation of data movement through the system.
Audience
This document is intended for the following audiences:
- Development Teams: To understand the architecture, components, and integration points for effective implementation and maintenance.
- Operations Teams: To manage, monitor, and troubleshoot the system based on its connectivity and security protocols.
- Security Analysts: To assess and ensure the integrity and confidentiality of data within the system.
- Stakeholders: To gain insight into the system's design, capabilities, and integration with external services.
The goal is to provide a clear, comprehensive understanding of the Unique AI connectivity architecture to all relevant parties involved in its lifecycle.
Architecture Diagrams
High-Level Connectivity Diagram
Components:
unique.app: User-facing application accessible via HTTPS.
- Application Gateway: Manages incoming HTTP/HTTPS traffic and forwards it to the appropriate services.
- AKS (Azure Kubernetes Service): Orchestrates containerized applications.
- Persistent Volumes: Storage for stateful applications.
- Document Intelligence: Document processing service.
- AI Services (LLM): Integration with OpenAI services or other LLMs like Claude or Gemini.
- Redis Cache: In-memory data structure store, used as a cache.
- Flexible Postgres: Managed PostgreSQL database service.
Data Flow:
Incoming traffic from unique.app and Integrations hits the Application Gateway.
- The gateway routes traffic to the AKS cluster.
- AKS interacts with storage accounts, external services, and databases via secure protocols (HTTPS, TCP-TLS).
Connectivity matrix:
| From | To | Nature | Protocol | Description |
|---|---|---|---|---|
| Unique App (Client) | Application Gateway | API Calls | HTTPS | The client application interacts with the system via secure HTTP API calls to the Application Gateway. |
| Integrations | Application Gateway | API Calls | HTTPS | External systems or services send and receive data through secure API calls to the Application Gateway. |
| Application Gateway | AKS | API Calls/Data Exchanges | HTTPS | The Application Gateway forwards incoming API requests and data to the AKS for processing. |
| AKS | Storage Accounts (Ingestion Cache, Knowledge Base, App Logs) | Data Exchanges/API Calls | HTTPS | AKS interacts with storage accounts to read and write data, including caching, accessing the knowledge base, and logging. |
| AKS | Redis Cache | Data Exchanges | TCP-TLS | AKS communicates with Redis Cache through a private endpoint to store and retrieve cached data securely. |
| AKS | Flexible Postgres | Data Exchanges | TCP-TLS | AKS interacts with Flexible Postgres for database operations, using a private network link to ensure secure communication. |
| AKS | Kubernetes Services API | API Calls | HTTPS | Internal API calls within the Kubernetes cluster for management, orchestration, and service discovery. |
| AKS | Persistent Volumes | Data Exchanges | NFS | AKS uses NFS protocol to interact with persistent storage volumes for reading and writing persistent data. |
| AKS | Document Intelligence | API Calls | HTTPS | AKS makes secure API calls to the Document Intelligence service to process and analyze documents. |
| AKS | OpenAI | API Calls | HTTPS | AKS communicates with OpenAI services via secure API calls for leveraging AI capabilities. |
Detailed Component Diagram
Component Descriptions:
Storage Accounts: Different storage accounts for ingestion cache, knowledge base, and application logs.
- Private Endpoints: Secure links to internal services ensuring data does not traverse the public internet.
- Kubernetes Services Service API: Manages interactions with the Kubernetes cluster.
- NFS: Network File System for persistent storage.
- Various Integrations: Including monitoring, logging, security, and external API interactions.
Security Considerations
- HTTPS and TCP-TLS: All communications are encrypted using HTTPS or TCP-TLS ensuring data integrity and confidentiality.
- Private Endpoints and Network Links: Securely connect resources within the Azure network, reducing exposure to potential threats.
- Workload Identity: Managed identities are used for secure access to resources, minimizing the need for secrets in the code.
Conclusion
The Unique AI solution is architected to provide robust, scalable, and secure interactions between various components. The architecture leverages Azure's managed services to ensure high availability and performance.