API Key and Token Service  ·  View 07 of 22  ·  Act 3 · Structure

Control Plane Components

The services that issue, scope, rotate and revoke — and the state they own.

Editable source SVG draw.io All views
Google Cloud — control-plane project Edge and identity Global load balancer Cloud Armor Console access IAP + step-up Workload identity no static creds Credential services — GKE Lifecycle Issuance service entropy + digest Rotation service overlap, expiry Quota and exemptions 250 live default Authority Scope registry versioned vocabulary Revocation intake single and bulk Leak-response engine policy per tenant Distribution Snapshot builder regional, 60 s Feed publisher Pub/Sub Heartbeat emitter liveness of the feed State Credential store Spanner, tenant-partitioned Revocation log append-only Audit store chained records Cloud KMS / HSM pepper, envelope keys Platform IdP console + machine auth Scanning partner rate-limited, live-or-not management API write append candidate string Control Plane — components and boundaries Interface / broker Security / platform Application we own Queue / topic Data store External / third party synchronous Four edges of many. Every lifecycle service also writes the audit store and reads the pepper from KMS; the feed publisher's read of the revocation log is view 14's subject and is omitted here. v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • Revocation intake is separated from issuance so that a revocation can be accepted while the rest of the control plane is degraded or read-only.
  • The snapshot builder reads the credential store on a 60-second cadence rather than on demand, which is what keeps a cold verification point off the store's critical path.
  • The scope registry is a service, not a config file, because refusing an escalation has to happen at issuance time, with the principal's own scopes in hand.

Assumptions

  • Management-API throughput 500/s per region, issuance p99 ≤ 400 ms — invented, and generous: issuance is rare and a human is usually waiting.
  • Default quota of 250 live credentials per tenant, raisable with an attributable exemption.

Omitted from the page

  • Every lifecycle service writes the audit store unconditionally; drawing eight audit edges would have hidden the structure.
  • The load balancer fronts all of them; only one edge is drawn.
◀  Layered Architecture All views Verification Data Plane  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0907-control-plane-components