On-Prem Enterprise Kubernetes Architecture Diagram:

┌─────────────────────────────────────────────────────────────┐
│                     EXTERNAL USERS                          │
├─────────────────────────────────────────────────────────────┤
│ Desktop Browser │ Mobile Browser │ Mobile App │ Partners    │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                           DNS                               │
├─────────────────────────────────────────────────────────────┤
│ Infoblox │ Active Directory DNS │ BIND DNS                 │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                    SECURITY LAYER                           │
├─────────────────────────────────────────────────────────────┤
│ F5 ASM / Cloudflare / Akamai / ModSecurity                 │
│ (WAF, DDoS Protection, Bot Protection, SSL)               │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                  LOAD BALANCER LAYER                        │
├─────────────────────────────────────────────────────────────┤
│ F5 LTM / HAProxy / NGINX Plus                              │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                  INGRESS CONTROLLER                         │
├─────────────────────────────────────────────────────────────┤
│ NGINX Ingress / HAProxy Ingress / Traefik                  │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼

═══════════════════════════════════════════════════════════════════════
                    ON-PREMISE KUBERNETES CLUSTER
═══════════════════════════════════════════════════════════════════════

┌─────────────────────────────────────────────────────────────┐
│                        UI LAYER                             │
├─────────────────────────────────────────────────────────────┤
│ Product-UI Service                                          │
│ ├─ product-ui-pod-1                                         │
│ ├─ product-ui-pod-2                                         │
│ └─ product-ui-pod-3                                         │
│                                                             │
│ Order-UI Service                                            │
│ ├─ order-ui-pod-1                                           │
│ └─ order-ui-pod-2                                           │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼

┌─────────────────────────────────────────────────────────────┐
│                    API GATEWAY LAYER                        │
├─────────────────────────────────────────────────────────────┤
│ Spring Cloud Gateway Service                               │
│ ├─ gateway-pod-1                                            │
│ ├─ gateway-pod-2                                            │
│ └─ gateway-pod-3                                            │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼

┌─────────────────────────────────────────────────────────────┐
│                   MICROSERVICES LAYER                       │
├─────────────────────────────────────────────────────────────┤
│ Product Service (ClusterIP)                                │
│ ├─ product-svc-pod-1                                        │
│ ├─ product-svc-pod-2                                        │
│ └─ product-svc-pod-3                                        │
│                                                             │
│ Order Service (ClusterIP)                                  │
│ ├─ order-svc-pod-1                                          │
│ ├─ order-svc-pod-2                                          │
│ └─ order-svc-pod-3                                          │
└─────────────────────────────────────────────────────────────┘
                              │
              ┌───────────────┴───────────────┐
              ▼                               ▼

┌─────────────────────────┐     ┌─────────────────────────┐
│      CACHE LAYER        │     │    MESSAGE BROKER       │
├─────────────────────────┤     ├─────────────────────────┤
│ Redis                   │     │ Kafka                   │
│ Hazelcast               │     │ RabbitMQ               │
└─────────────────────────┘     └─────────────────────────┘
              │                               │
              └───────────────┬───────────────┘
                              ▼

┌─────────────────────────────────────────────────────────────┐
│                    DATABASE LAYER                           │
├─────────────────────────────────────────────────────────────┤
│ PostgreSQL Primary                                          │
│ PostgreSQL Replica                                          │
│                                                             │
│ OR                                                          │
│                                                             │
│ Oracle RAC                                                  │
│ SQL Server AlwaysOn                                         │
└─────────────────────────────────────────────────────────────┘

═══════════════════════════════════════════════════════════════════════
                       OBSERVABILITY STACK
═══════════════════════════════════════════════════════════════════════

┌─────────────────────────────────────────────────────────────┐
│ LOGGING                                                     │
├─────────────────────────────────────────────────────────────┤
│ Fluent Bit → Elasticsearch/OpenSearch → Kibana            │
│ Splunk                                                     │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ MONITORING                                                  │
├─────────────────────────────────────────────────────────────┤
│ Prometheus → Grafana                                       │
│ Zabbix / Nagios                                            │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ DISTRIBUTED TRACING                                         │
├─────────────────────────────────────────────────────────────┤
│ Jaeger / Tempo / Zipkin                                    │
└─────────────────────────────────────────────────────────────┘

Traffic Flow

User
 ↓
DNS
 ↓
WAF (F5 ASM)
 ↓
Load Balancer (F5 LTM)
 ↓
NGINX Ingress
 ↓
Product UI / Order UI
 ↓
Spring Cloud Gateway
 ↓
Product Service / Order Service
 ↓
Redis / Kafka
 ↓
Database

External API Consumer Flow

Partner System
      ↓
F5 ASM
      ↓
F5 LTM
      ↓
NGINX Ingress
      ↓
Spring Cloud Gateway
      ↓
Product Service / Order Service

Internal Service Communication

Gateway
   ↓
product-svc (ClusterIP)
   ↓
product pods

Gateway
   ↓
order-svc (ClusterIP)
   ↓
order pods

This is a realistic enterprise on-prem architecture suitable for banks, insurance, retail, telecom, and large-scale Java/Spring microservices platforms.

Below is a detailed explanation of each layer, why it exists, what problems it solves, and what happens if you don’t have it.

---

1. Client Layer

Desktop Browser
Mobile Browser
Mobile App
Partner Systems

Purpose

This is where requests originate.

Examples:

• Customer opens website
• Mobile app calls APIs
• External partner consumes APIs
• Internal applications integrate with your platform

Why Needed?

Without clients, there is no traffic.

Different clients have different requirements:

Client	Typical Need
Browser	HTML/CSS/JS
Mobile App	JSON APIs
Partner System	Secure API Integration

Example

User
 |
https://shop.company.com

---

2. DNS Layer

Infoblox
AD DNS
BIND

Purpose

Convert:

shop.company.com

into

10.10.20.100

Why Needed?

Humans remember:

api.company.com

not

10.20.30.40

Without DNS

Users would need to type IP addresses.

Impossible at enterprise scale.

---

3. Security / WAF Layer

F5 ASM
Cloudflare
Akamai
ModSecurity

Purpose

Protect applications before requests enter your environment.

Typical Attacks

SQL Injection

' OR 1=1 --

Cross Site Scripting

<script>alert('hack')</script>

API Abuse

1,000,000 requests/minute

DDoS

Millions of fake requests

---

Why Needed?

Without WAF:

Internet
   |
Application

Attackers directly hit application.

With WAF:

Internet
   |
WAF
   |
Application

Bad requests are blocked.

---

4. Load Balancer Layer

F5 LTM
HAProxy
NGINX Plus

Purpose

Distribute traffic across multiple application instances.

Example:

10000 Requests
       |
Load Balancer
   /     |      \
App1   App2   App3

---

Why Needed?

Without LB:

Users
  |
App1

If App1 crashes:

Application Down

With LB:

Users
  |
LB
 / \
A1 A2

Traffic automatically shifts.

---

5. Ingress Controller

NGINX Ingress
HAProxy Ingress
Traefik

Purpose

Acts as Kubernetes entry point.

Routes requests.

Example:

/api/*
   |
Gateway

/shop/*
   |
Product UI

/orders/*
   |
Order UI

---

Why Needed?

Without Ingress:

Every service needs external exposure.

product-ui
order-ui
gateway

Each needs:

LoadBalancer
NodePort

Hard to manage.

Ingress centralizes access.

---

6. UI Layer

Product UI
Order UI

Purpose

Present information to users.

Example:

React
Angular
Vue

---

Responsibilities

• Render pages
• Display products
• Accept user input
• Call APIs

---

Why Needed?

Users do not call databases.

Users interact with UI.

Example:

User
 |
Product UI
 |
Gateway

---

7. API Gateway Layer

Spring Cloud Gateway
Kong
Apigee

Purpose

Single entry point for APIs.

---

Responsibilities

Authentication

JWT Validation
OAuth2

Authorization

Can user access API?

Rate Limiting

100 req/min

Logging

Capture request details

Routing

/products -> product-service
/orders -> order-service

---

Why Needed?

Without Gateway:

Internet
 |
Product Service

Internet
 |
Order Service

Every service becomes internet-facing.

Security nightmare.

---

8. Microservices Layer

Product Service
Order Service
Payment Service
Inventory Service

Purpose

Implement business logic.

Example:

Product Service

Search Products
Create Products
Update Products

Order Service

Create Order
Cancel Order
Track Order

---

Why Needed?

Separation of concerns.

Instead of:

Huge Monolith

Use:

Product Team
Order Team
Payment Team

Independent deployment.

---

9. Service Discovery Layer

Kubernetes DNS
CoreDNS
ClusterIP

Purpose

Allow services to find each other.

Gateway calls:

http://product-svc

instead of:

10.1.1.45

---

Why Needed?

Pods constantly change IPs.

Example:

Pod Restart

New IP assigned.

Service Discovery hides this complexity.

---

10. Cache Layer

Redis
Hazelcast
Memcached

Purpose

Reduce database traffic.

---

Example

Product Search:

Without cache:

10000 Requests
10000 DB Queries

With cache:

10000 Requests
100 DB Queries

---

Benefits

• Faster response
• Reduced DB load
• Better scalability

---

11. Message Broker Layer

Kafka
RabbitMQ
ActiveMQ

Purpose

Enable asynchronous processing.

---

Example

Order Placement:

Instead of:

Create Order
Send Email
Update Inventory
Process Payment

synchronously,

use:

Order Created Event
        |
      Kafka
       / | \
 Email Inventory Payment

---

Benefits

• Loose coupling
• Better scalability
• Event-driven architecture

---

12. Database Layer

PostgreSQL
Oracle
SQL Server
MongoDB

Purpose

Store application data.

Examples:

Product Table

Product
Price
Category

Order Table

Order
Status
Amount

---

Why Needed?

Services are stateless.

Database stores persistent state.

---

13. Logging Layer

FluentBit
Elasticsearch
Kibana

or

OpenSearch

---

Purpose

Centralized logging.

---

Example

Logs from:

Ingress
Gateway
Services
Database

go into:

ELK

---

Why Needed?

Without centralized logs:

SSH to every server

Very difficult troubleshooting.

---

14. Monitoring Layer

Prometheus
Grafana

Purpose

Track health.

Metrics:

CPU
Memory
Latency
Error Rate
Requests/sec

---

Example

Dashboard:

Gateway CPU 90%

Alert before outage.

---

Why Needed?

Without monitoring:

Users report issue first

With monitoring:

Ops team knows before users

---

15. Distributed Tracing Layer

Jaeger
Tempo
Zipkin

Purpose

Track a request across services.

---

Example

User request:

Gateway
  |
Product Service
  |
Inventory Service
  |
Database

Tracing shows:

Gateway      20ms
Product      50ms
Inventory   900ms
Database     10ms

Root cause immediately visible.

---

16. Alerting Layer

Alertmanager
PagerDuty
OpsGenie

Purpose

Notify operations team.

Examples:

CPU > 90%

Database Down

Gateway Errors > 5%

---

Complete Request Flow

User
 |
DNS
 |
F5 ASM (Security)
 |
F5 LTM (Load Balancing)
 |
NGINX Ingress
 |
Product UI
 |
Spring Cloud Gateway
 |
Product Service
 |
Redis Cache
 |
PostgreSQL
 |
Kafka Events
 |
ELK / Prometheus / Jaeger

In One Sentence

• DNS → Find application
• WAF → Protect application
• Load Balancer → Distribute traffic
• Ingress → Kubernetes entry point
• UI → User experience
• API Gateway → Secure API entry
• Microservices → Business logic
• Service Discovery → Find services
• Cache → Improve performance
• Message Broker → Async processing
• Database → Persist data
• Logging → Troubleshooting
• Monitoring → Health visibility
• Tracing → Performance analysis
• Alerting → Incident response

This layered architecture is what you’d typically see in large-scale on-prem enterprise systems built on Kubernetes and Spring Boot microservices.

How to convert same design in AWS ?

Web Application Architecture in AWS (Amazon)