Programmable Messaging API  ·  View 08 of 22  ·  Structure

Container View

The deployable parts on Google Cloud, and the one plane that cannot be stateless.

Editable source SVG draw.io All views
Google Cloud — messaging project Tenant-facing plane Global load balancer Cloud Armor Submit service Cloud Run Status service Cloud Run Callback dispatcher Cloud Run Admission and ownership Admission service Compliance evaluator Message ledger Cloud Spanner Body store Cloud Storage State projection Bigtable Delivery plane Scheduler class lanes Lane topics Pub/Sub Route pacing queues Cloud Tasks Attempt executor Cloud Run Lease and quality store Memorystore Session plane (stateful, pinned) SMPP session pods GKE StatefulSet Static egress Cloud NAT Carrier credential custody Secret Manager + KMS Ingest plane Receipt endpoint Inbound endpoint Receipt and inbound streams Pub/Sub Correlate and apply Quarantine Control plane and evidence Registry service routes, senders, rules Consent store Spanner Analytics and evidence BigQuery Audit archive Bucket Lock Carriers and aggregators 220 routes Channel business APIs WhatsApp, RCS Metering and billing HTTPS fails closed append then ack pace submit bind HTTPS receipts no match Container View — Services, Stores and the Boundaries Between Them Interface / broker Application we own Security / platform Data store Queue / topic Risk / gap External / third party synchronous event / async two-way failure / alternate Omitted: console, IaC and the per-service sidecars. The session plane is the only stateful workload. v 1.0 · owner Integration Platform Architecture

Decisions

  • The session plane is a separate, stateful, pinned tier: SMPP binds hold sequence windows and allowlisted source addresses, which do not survive an elastic stateless fleet.
  • Carrier credentials never enter the attempt fleet; executors exchange workload identity for a short-lived, single-route token at the custody boundary.
  • The state projection is a distinct store from the ledger, so status reads scale separately from the write path that owns the truth.

Assumptions

  • Cloud Spanner for the ledger, consent and registry; Bigtable for the projection; Pub/Sub for lanes and ingest; Cloud Tasks for per-route pacing; Memorystore for leases.
  • Roughly 6,000 concurrent carrier protocol sessions across 220 routes.

Risks

  • The ledger write path is the platform's hottest and most expensive component; if it is not priced explicitly it will be discovered in the bill.
  • The quarantine store is the one place a platform bug surfaces as data rather than as an error — it needs an owner, not just a bucket.
◀  Layered Architecture All views Interface Catalogue  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-10 · 22 views · 16 architecture decision records08-platform-components