Deployment shapes¶
A shape is where the sluis process runs and what stands in front of it. Decided in: 0037, 0041.
| Shape | State | Runs on | Front door | Page |
|---|---|---|---|---|
| AWS Lambda | available | Lambda, DynamoDB, S3, KMS | API Gateway with an ACM certificate | AWS Lambda |
| AWS Lambda behind Cloudflare | available | as above | Cloudflare proxy, Authenticated Origin Pulls, mutual TLS | AWS behind Cloudflare |
| AWS Lambda with the AWS edge module | planned | as above | API Gateway custom domain, ACM validated in Route 53 | below |
| Kubernetes with AWS storage | available | a pod on EKS; DynamoDB, S3, KMS | the cluster gateway | Kubernetes with AWS storage |
| Kubernetes with OpenBao | planned | a pod; OpenBao KV and transit | the cluster gateway | below |
AWS edge module¶
The module deploy/pulumi/edge/aws does not exist yet. It fronts the AWS Lambda shape with an API Gateway custom domain, an ACM certificate validated in Route 53 and the Route 53 records. There is no mutual TLS. Until it exists, put a domain in front of Lambda.FrontDoor() with your own Pulumi code, or use the Cloudflare edge.
Kubernetes with OpenBao¶
The preset is not built; see adapters. The OpenBao backends are in the storage module. Today, use Kubernetes with AWS storage. Audit installs beside sluis by default; see audit deployment.