Flipkart Marketplace Platform  ·  View 19 of 25  ·  6 · Operations

Deployment Topology

What runs where, what is redundant, and what a region loss actually costs.

Editable source SVG draw.io All views
Global · Azure Front Door Premium (anycast, 190+ PoPs) Front Door + WAF latency routing Azure DNS health probes CDN cache media, static Azure Central India · primary, active Zone 1 AKS system + app 800 nodes Citus coordinators writer Kafka brokers 100 of 300 Zone 2 AKS app + spot 800 nodes Citus workers sync replica Kafka brokers 100 of 300 Zone 3 AKS app + GPU ranking, embed OpenSearch data 3 replicas Kafka brokers 100 of 300 Azure South India · secondary, read-active and failover Zone 1 AKS read plane 30% capacity Citus read replica async Zone 2 OpenSearch replica full index Kafka mirror MirrorMaker 2 Multi-region managed services Cosmos DB NoSQL multi-region write ADLS / Blob GZRS Key Vault paired region sync · RPO 0 async 30 s primary origin read spill Deployment — Regions, Zones and Failure Domains Interface / broker Security / platform Data store Queue / topic synchronous event / async RTO 20 min, RPO 30 s for the transactional tier; catalog and media are RPO 0 by construction. Regional failover is a rehearsed runbook with a human decision, not an automatic flip. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Two Indian Azure regions: Central India active, South India read-active at about 30% capacity and warm for failover
  • Three availability zones in the primary region with synchronous replication inside the region and asynchronous across regions
  • Catalog and media are genuinely multi-region by construction; the transactional tier is not, and pretending otherwise would be the lie in this set

Recovery targets

  • In-region zone loss: RPO 0, RTO measured in seconds, handled by the platform
  • Region loss: RPO 30 seconds, RTO 20 minutes, a rehearsed runbook with a human decision point
  • Failover is rehearsed quarterly and before every major sale event

Risks

  • A cross-region failover during a sale hour loses up to 30 seconds of writes — the reconciliation of those orders is a manual playbook
  • Kafka mirroring lag is the leading indicator of a bad failover and is alerted separately
  • Spot node pools carry batch and stream work only; nothing on the checkout path runs on spot
◀  Fulfilment and Last Mile All views Delivery Pipeline and Environments  ▶
Solution Architecture v1.0 · Open source on Microsoft Azure · Enterprise Architecture · 2026-0919-deployment-topology