API Key and Token Service  ·  View 16 of 22  ·  Act 6 · Operations

Deployment Architecture

Three regions verifying active-active, one control plane, and two different recovery objectives.

Editable source SVG draw.io All views
Google Cloud — three regions, one Spanner instance europe-west1 — control-plane leader GKE — control plane 3 zones GKE — product fleet sidecars verify Memorystore shared projection Snapshot bucket regional us-east4 GKE — control plane warm standby GKE — product fleet sidecars verify Memorystore shared projection Snapshot bucket regional asia-southeast1 GKE — control plane warm standby GKE — product fleet sidecars verify Memorystore shared projection Snapshot bucket regional Multi-region, not per-region Cloud Spanner nam-eur-asia1 · RPO ≤ 5 s Revocation log quorum write · RPO 0 Pub/Sub global topic Cloud KMS / HSM multi-region key ring writes publish overlay Deployment — active-active verification, one control plane Application we own Data store Queue / topic Security / platform synchronous event / async Losing a region is a capacity event for verification (RTO 0) and a failover for the control plane (RTO ≤ 15 min). Each region's snapshot bucket warms a cold projection at start-up; those edges are omitted. v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • Verification is active-active in every region, so losing one is a capacity event (RTO 0) rather than an availability event.
  • The control plane has a leader region and warm standbys (RTO ≤ 15 min). Issuance failing for fifteen minutes is survivable; verification failing for one second is not.
  • Spanner is configured multi-region rather than per-region because a revocation that is durable in one region only is not durable.

Assumptions

  • europe-west1, us-east4, asia-southeast1 — representative, not prescriptive.
  • RPO ≤ 5 s for credential records, RPO 0 for revocation state.
  • Per-region snapshot buckets on a 60-second cadence, sized for a full cold fleet restart.

Cost note

  • A multi-region Spanner instance is the single largest line in this architecture, and it is justified by exactly one requirement: RPO 0 on revocation. If that requirement were relaxed, this page would look quite different.
◀  Leak to Containment All views Release and Config Pipeline  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0916-deployment-architecture