Untitled

graph TB
    subgraph "☁️ AWS Cloud - Account: paastry-1-int-np"
        subgraph "🌐 Region: us-east-1"
            
            %% AWS Control Services
            subgraph "🎛️ AWS Management & Control"
                IAM[🔐 IAM<br/>Cross-account roles<br/>IRSA integration]
                CW[📊 CloudWatch<br/>EKS control plane logs<br/>90-day retention]
                S3[🗄️ S3<br/>NLB access logs<br/>lifecycle management]
            end
            
            %% Core EKS Service
            subgraph "🚀 Amazon EKS Service"
                EKSCP[⚙️ EKS Control Plane<br/>Kubernetes 1.30<br/>Fully managed<br/>Multi-AZ]
            end
            
            %% Compute Infrastructure
            subgraph "💻 EC2 Compute Infrastructure"
                subgraph "🏗️ Node Groups (Auto Scaling)"
                    SYSTEM[🔧 System Nodes<br/>m5a.xlarge<br/>1-3 nodes<br/>Platform services]
                    OPS[⚙️ Ops Nodes<br/>m5a.xlarge<br/>1-3 nodes<br/>GitOps & monitoring]
                    SERVICES[🎯 Services Nodes<br/>m6a.xlarge<br/>1-2 nodes<br/>Applications]
                end
                
                subgraph "💾 Storage"
                    EBS[📀 EBS Volumes<br/>Dynamic provisioning<br/>CSI driver]
                end
            end
            
            %% Networking Layer
            subgraph "🌐 Networking Infrastructure"
                subgraph "🏠 VPC"
                    ALB[⚖️ Application Load Balancer<br/>Internal ingress<br/>Multi-target]
                    NLB[⚖️ Network Load Balancer<br/>TCP/UDP services<br/>Low latency]
                end
                
                subgraph "🛡️ Security Groups"
                    CLSG[🔒 Cluster Security Group<br/>Control plane access<br/>Port 443]
                    NODESG[🔒 Node Security Group<br/>Inter-node communication<br/>Kubelet, DNS]
                    LBSG[🔒 Load Balancer SG<br/>Ingress traffic<br/>80/443]
                end
                
                subgraph "🌍 DNS Management"
                    R53[🌐 Route53<br/>Public DNS<br/>Health checks]
                    INFOBLOX[🌍 Infoblox<br/>Corporate DNS<br/>Internal zones]
                end
            end
            
            %% Applications & Workloads
            subgraph "🎯 Kubernetes Workloads"
                subgraph "🔄 GitOps Platform"
                    ARGOCD[🚀 ArgoCD<br/>Continuous deployment<br/>16 applications]
                end
                
                subgraph "👥 Multi-Tenant Development"
                    CTCX[🛒 CT-CX Team<br/>E-commerce development<br/>3 environments]
                    GWW[🌍 GWW Team<br/>Global platform<br/>2 environments]
                    PAASTRY[🔧 PaaStry Team<br/>Platform engineering<br/>3 environments]
                    SHOP[🛍️ Shop Team<br/>Shopping apps<br/>3 environments]
                    EXPERIMENTAL[🧪 Experimental<br/>Prototype projects<br/>5 namespaces]
                end
                
                subgraph "📊 Platform Services"
                    MONITORING[📈 Datadog<br/>Full-stack monitoring<br/>APM + Logs]
                    SECURITY[🔐 HashiCorp Vault<br/>Secret management<br/>Policy enforcement]
                    GOVERNANCE[📋 Kyverno<br/>Policy engine<br/>Resource validation]
                end
            end
        end
        
        %% External Services
        subgraph "🌐 External Services"
            VAULT_EXT[🔐 HashiCorp Vault<br/>hvault-nonprod.sysco.net<br/>Central secret store]
            HARBOR[🐳 Harbor Registry<br/>harbor.cloud.sysco.net<br/>Container images]
            DATADOG_EXT[📊 Datadog SaaS<br/>Cloud monitoring<br/>Analytics platform]
            CONSUL[🗄️ HashiCorp Consul<br/>Service discovery<br/>Config management]
        end
    end
    
    %% AWS Service Connections
    EKSCP -.->|Manages| SYSTEM
    EKSCP -.->|Manages| OPS
    EKSCP -.->|Manages| SERVICES
    
    ALB -.->|Routes to| CTCX
    ALB -.->|Routes to| GWW
    ALB -.->|Routes to| PAASTRY
    ALB -.->|Routes to| SHOP
    
    ARGOCD -.->|Deploys to| CTCX
    ARGOCD -.->|Deploys to| GWW
    ARGOCD -.->|Deploys to| PAASTRY
    ARGOCD -.->|Deploys to| SHOP
    ARGOCD -.->|Deploys to| EXPERIMENTAL
    
    SECURITY -.->|Connects to| VAULT_EXT
    MONITORING -.->|Sends to| DATADOG_EXT
    ARGOCD -.->|Pulls from| HARBOR
    
    EKSCP -.->|Logs to| CW
    ALB -.->|Logs to| S3
    
    %% DNS Connections
    ALB -.->|Updates| R53
    ALB -.->|Updates| INFOBLOX
    
    %% Styling
    classDef awsService fill:#ff9900,stroke:#232f3e,stroke-width:2px,color:#fff
    classDef compute fill:#ec7211,stroke:#232f3e,stroke-width:2px,color:#fff
    classDef network fill:#5294cf,stroke:#232f3e,stroke-width:2px,color:#fff
    classDef security fill:#dd344c,stroke:#232f3e,stroke-width:2px,color:#fff
    classDef workload fill:#7aa116,stroke:#232f3e,stroke-width:2px,color:#fff
    classDef external fill:#9d5aa8,stroke:#232f3e,stroke-width:2px,color:#fff
    
    class EKSCP,IAM,CW,S3 awsService
    class SYSTEM,OPS,SERVICES,EBS compute
    class ALB,NLB,R53,CLSG,NODESG,LBSG network
    class SECURITY,GOVERNANCE,VAULT_EXT security
    class CTCX,GWW,PAASTRY,SHOP,ARGOCD,MONITORING workload
    class HARBOR,DATADOG_EXT,CONSUL external
```