Autoscaling Controller  ·  View 06 of 37  ·  2 · Structure

Container Architecture

Every deployable unit, and the regional state it is allowed to touch.

Editable source SVG draw.io All views
Azure Region · control plane on AKS Signal services Collector Set Go · one per class Normaliser common shape Qualification Gate fresh + plausible Decision services Shard Manager lease per shard Decision Engine Go · 15 s tick Journal Writer at-least-once Actuation services Reconciler idempotent Adapter Set VMSS, AKS, K8s Warm-Pool Manager Drain Coordinator lease aware Control surface Config API targets, policies Override API expiry enforced Explain API why this capacity Regional state and evidence Authoritative · strongly consistent PostgreSQL Flexible Server registry + desired Derived · rebuildable or append-only Grafana Mimir signal store Event Hubs journal transport Azure Data Explorer journal query Blob · immutable WORM · 13 months Microsoft Entra ID workload identity Azure Key Vault no standing creds Azure Resource Manager capacity APIs desired write desired read scoped identity decision record Container Architecture — Deployable Units (C4 L2) Application we own Decision point Security / platform Interface / broker Data store Queue / topic External / third party synchronous event / async Every service is stateless. All regional state is in the row below it, and no service reads another region's copy. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Every service is stateless. All state is in the row below, and no service reads another region's copy of it.
  • PostgreSQL Flexible Server holds both authoritative stores, because the registry and the desired state must be written in one transaction when a bound changes.
  • The journal leaves through Event Hubs rather than being written synchronously, so a journal outage cannot stall a decision.

Technology

  • Control plane: Go services on AKS, three availability zones.
  • Signal store: Grafana Mimir on Blob storage — Prometheus-compatible, and the rollup story is native.
  • Journal: Event Hubs → Azure Data Explorer for query, plus an immutable Blob copy for the tamper-evident record.

Assumptions

  • Azure Data Explorer is chosen over self-hosted ClickHouse to keep the controller's own operational cost inside the 1.5% budget; ClickHouse is the portable substitute if that budget is spent elsewhere.
  • AKS hosts the controller but is also a scaling target. The controller's own node pool is excluded from its own management, and sized statically.
◀  The Critical Design Decision All views Signal Plane  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 37 views · Azure and open source06-container-architecture