Passkey Authentication Service  ·  View 16 of 21  ·  Operations

Deployment Topology

Two regions, one global credential cluster, and two ceremony stores that never speak to each other.

Editable source SVG draw.io All views
Region eu-central — serves EU-pinned tenants Zone A Verification pods Kubernetes, 24 Redis shard ceremony, primary CockroachDB node Zone B Verification pods Kubernetes, 24 Redis replica CockroachDB node Zone C CockroachDB node quorum third Network HSM pair PKCS#11 Region us-east — serves unpinned tenants Zones A to C Verification pods Kubernetes, 16 Redis cluster independent, pinned CockroachDB nodes same global cluster Shared platform services Argo CD GitOps, per region Prometheus and Grafana Kafka and ClickHouse evidence Anycast ingress region per tenant pin FIDO Metadata Service Raft, cross-region pinned tenants everyone else Passkey Authentication Service — Deployment Topology Application we own Data store Security / platform External / third party batch synchronous Deliberately absent: any replication between the two Redis clusters. Ceremony state is never replicated, so a region loss costs a retry and never a wrong decision. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • The credential store is one globally replicated cluster with per-row region pinning, which is how tenant residency is satisfied without running a separate deployment per tenant.
  • Each region's ceremony store is independent and never replicated. A region loss costs in-flight users a retry and can never produce a wrong decision in the surviving region.
  • Three zones carry the credential quorum; the third zone holds no verification capacity, only the quorum member and the HSM pair.
  • Anycast ingress routes by tenant pin first and proximity second, because residency outranks latency.

Assumptions

  • 24 verification replicas per zone in the home region, 16 in us-east; RTO 60 seconds for regional failover of the authentication path.
  • Global credential convergence p99 2 seconds, with read-your-write guaranteed in the registering region.
  • Self-hosted Kubernetes on owned hardware in both regions; no managed control plane.

Risks

  • Cross-region quorum latency is on the credential write path, which makes registration slower than authentication. That is accepted because registrations are rare and logins are not.
  • An HSM pair per region is a standing cost that does not scale down, and it is the floor under the per-region cost model.
◀  Recovery Routes and Their Assurance All views Code and Policy Release Pipeline  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1016-deployment