🏗 Project Architecture
Private AKS · Flask + PostgreSQL · Full stack overview
Internet / Client
│
▼
┌───────────────────────┐
│ DNS / Azure DNS │
│ (public hostname) │
└───────────┬───────────┘
│ HTTPS
▼
┌───────────────────────┐
│ Azure Load Balancer │
│ (public front door) │
└───────────┬───────────┘
│
▼
┌───────────────────────┐
│ Traefik Ingress │
│ + cert-manager TLS │
│ (Let's Encrypt) │
└───────────┬───────────┘
│
▼
┌───────────────────────┐
│ Flask App (Pods) │
│ Gunicorn · Deployment│
│ Service: ClusterIP │
└───────────┬───────────┘
│
▼
┌───────────────────────┐
│ PostgreSQL │
│ StatefulSet + PVC │
│ Service: postgres │
└───────────────────────┘
CI/CD path (side channel):
Azure DevOps → Self-hosted Agent (private VNet)
→ Build image → Azure ACR
→ Helm upgrade → AKS (private API)
Layers
1. Edge & Ingress
Public traffic hits Azure Load Balancer, then Traefik. cert-manager issues and renews Let's Encrypt certificates so all external traffic is HTTPS.
Azure LB
Traefik
cert-manager
Let's Encrypt
2. Application
Flask app runs under Gunicorn in Deployment pods. ClusterIP Service fronts the pods. Liveness uses /health; readiness can include DB checks via /api/db-status.
Flask
Gunicorn
Deployment
ClusterIP
3. Data
PostgreSQL runs as a StatefulSet with persistent volume claims. The app reaches it via the in-cluster service name postgres.
StatefulSet
PVC
Service: postgres
4. Platform & Networking
Private AKS cluster — control plane is not publicly reachable. Workloads live in a private VNet. Images come from Azure Container Registry.
Private AKS
Private VNet
Azure ACR
Kubernetes
5. CI/CD
Azure DevOps pipelines run on a self-hosted agent inside the private VNet. Pipeline builds the image, pushes to ACR, and deploys via Helm without exposing the cluster API publicly.
Azure DevOps
Self-hosted agent
Helm
ACR