What changes—and what governs the design
The existing work establishes a deployed network plane, pilot vending and telemetry paths, application artifacts and operational experience. The next stage separates workloads so API demand, ingestion and background work can evolve independently.
The target uses Amazon EKS as the Kubernetes platform. This is an architecture and migration plan, not a claim that the cluster or its availability characteristics have been demonstrated. Hardware sessions and site-level constraints remain outside the cluster’s scaling logic.
Responsibilities by boundary
- Public delivery
- Cloudflare CDN serves versioned public assets. HTTPS API requests reach the origin with explicit cache bypass for vending, authentication, account and telemetry responses. Origin TLS, host validation and access controls are verified before exposure.
- Kubernetes workloads
- Eligible API/core and ingestion services run on EKS in private subnets. Health probes, resource limits, topology spread and disruption budgets support controlled rollouts. Replicas are added only where application state and ordering permit.
- Private connectivity
- Tailscale connects operators and supported edge gateways. A planned Kubernetes operator/proxy provides scoped private access to selected services. Kubernetes RBAC, network policy and tailnet access rules remain independent controls.
- Persistence
- RDS PostgreSQL is the proposed core-state store. Separate S3 buckets hold controlled artifacts and versioned infrastructure state, with distinct access policies. The telemetry store is selected by retention, query and replay benchmarks before migration. Existing history remains authoritative through reconciliation.
- Delivery & infrastructure
- Terraform manages environment foundations and platform resources through reviewed plans and gated applies. CI publishes versioned images to ECR; Kubernetes releases use immutable references and reversible configuration changes.
- Operations
- Logs, metrics and traces distinguish API latency, queue age, device reachability and confirmed outcomes. Backup restoration, broker recovery and site reconnect behavior are exercised before cutover.
Each project has a different scaling constraint
ZuriNet: preserve ownership
Scale network reads and the business core independently. The core remains authoritative for subscriptions and device links. Migrate the network controller only after validating persistent state, VPN reachability and controller-specific recovery.
Vending: one active writer per site
Scale across sites while serializing work within each constrained coordinator. Before multiple workers run, introduce durable request claims and a single-writer lease with fencing. After a crash or uncertain device response, reconcile meter history before attempting another action. API and CDN layers must never imply a vend succeeded merely because a request was accepted.
Telemetry: preserve meaning through replay
Partition consumers by stable device/site identity, preserve required ordering and deduplicate replays. Separate raw records from normalized measurements, retain scaler/unit provenance and test slow-consumer behavior. A faster pipeline is useful only when the resulting record still agrees with the device.
Migration stages and release gates
1. Establish the baseline
Inventory workloads, data ownership, secrets and current recovery paths. Measure representative traffic and confirm the cloud resource budget. Record rollback criteria and an agreed recovery objective.
Gate: owned dependencies, restorable backups and a reviewed migration scope.
2. Provision a separate environment
Use Terraform for network, IAM, EKS, registry and state storage. Apply least-privilege CI identity and private access. Exercise a complete rebuild and an independent restore.
Gate: reviewed plan, reproducible environment and verified access boundaries.
3. Prove workload behavior
Move stateless services first. Run shadow telemetry without contaminating the authoritative record; test broker recovery, duplicate requests, site ownership, loss of connectivity and CDN cache bypass.
Gate: data reconciliation, safe failure behavior and documented rollback.
4. Cut over progressively
Expand by controlled service/site cohorts with explicit monitoring and rollback. Reconcile history, confirm device results and complete operational handover before retiring the old path.
Gate: agreed service objectives met with repeatable recovery; no invented availability or capacity claims.
Why this direction
Kubernetes offers a shared deployment model but introduces cluster and workload-operating responsibilities. Terraform makes infrastructure changes reviewable; its state remains sensitive and requires access control, locking and versioning. Managed core persistence reduces the amount of stateful platform administration, while telemetry storage still needs workload-specific evaluation.
Tailscale provides a private reachability layer; it does not replace application authorization. Cloudflare accelerates public content; it does not belong in the raw MQTT/device protocol path. These boundaries keep the architecture tied to the system’s actual responsibilities.