Skip to content
@ThreatLensAI

ThreatLens AI

K8s Infrastructure

Overview

This project presents a highly scalable and flexible architecture for data processing and analysis, leveraging Kubernetes, Apache Kafka, and Large Language Models (LLMs). The system is designed to handle large-scale data ingestion, processing, and storage while providing an intuitive interface for querying and interacting with processed information.

Architecture

The architecture is built on a Kubernetes cluster, utilizing its powerful orchestration capabilities. The system is composed of several key components distributed across multiple node groups for optimal performance and resource utilization.

Kubernetes Cluster

The cluster is organized into multiple node groups, each serving specific purposes. The nodegroups shown in the diagram are examples, and the actual deployment can scale to include many more nodes and pods as needed.

Node Groups

  • NodeGroup: General-purpose nodes for running various services and workloads.
  • GPU-NodeGroup: Dedicated to GPU-intensive tasks like model inference.

Node Groups

Each node group can host multiple pods, and the pods shown in the diagram are representative examples of the types of services that might run in each group.

DaemonSets

These DaemonSets provide essential functionality across all nodes in the cluster, ensuring consistent operations and monitoring capabilities. The architecture includes several default DaemonSets:

  • kube-proxy: Maintains network rules on nodes.
  • kubelet: Ensures that containers are running in a Pod.
  • aws-node: Manages AWS-specific networking features.
  • aws-ebs-csi: Handles AWS Elastic Block Store operations.
  • fluent-bit: Collects and forwards logs from all nodes.
  • prometheus-exporter: Exports node-level metrics for monitoring.

Key Components

Namespaces and Network Flow

Namespaces and Network Flow

Data Ingestion and Processing

Data Ingestion

The data ingestion and processing pipeline is designed for high throughput and scalability:

Kafka Cluster

Utilizes three Kafka brokers for fault-tolerant data streaming. This allows for parallel processing of incoming data streams and ensures high availability.

Consumers Groups

Multiple consumer groups process incoming data streams.

  • Webapp Consumer: Inserts raw data into the database for further processing.
  • Ingestors: LLM-based ingestors for advanced data processing and embedding generation. These ingestors use large language models to analyze and enrich incoming data, generating vector embeddings for efficient querying.

Kubernetes Operator

  • GithubReleaseMonitor: A custom kubernetes operator that watches for new GitHub releases and triggers the data processing pipeline on a new release

  • GithubRelease: A Custom Resource Definition (CRD) that represents a GitHub release. The operator creates a new GithubRelease object for each new release, triggering the data processing pipeline.

  • Job (Producer): A Kubernetes Job that produces data for processing, triggered by GitHub events or other external stimuli.

Custom Pipelines

  • Pipelines: Custom data processing pipelines that can be tailored to specific data types or analysis requirements.

Storage

  • PostgreSQL Database: Serves as the primary data store for processed information and embeddings. It's designed to handle large volumes of structured and semi-structured data efficiently.

User Interface and Querying

  • WebUI: Provides a RAG-based (Retrieval-Augmented Generation) querying interface. This allows users to interact with the system using natural language queries.
  • LLM Models: Integrated for advanced query processing and response generation. These models can understand complex queries and generate human-like responses based on the processed data.

Monitoring and Operations

  • Prometheus & Grafana: Offer comprehensive monitoring and visualization of system metrics, allowing for real-time performance tracking and anomaly detection.
  • Fluent Bit: Handles log collection and forwarding, ensuring centralized log management for easier troubleshooting and analysis.
  • Istio: Implements service mesh for enhanced network communication, security, and observability. It includes components like Istio Gateway and Istio Pilot for traffic management and service discovery.
  • Cluster Autoscaler: Automatically adjusts the size of the Kubernetes cluster based on resource demands, ensuring optimal resource utilization.
  • External DNS & Cert Manager: Manage DNS records and SSL/TLS certificates automatically, simplifying external access and security configuration.

Scalability and Performance

The architecture is designed to scale horizontally, allowing for the addition of more nodes and pods as demand increases. The use of Kubernetes allows for efficient resource allocation and automatic scaling of components based on load.

Popular repositories Loading

  1. llm-ingestor llm-ingestor Public

    Pipelines for llm data ingestion

    Python 1

  2. ami-jenkins ami-jenkins Public

    Jenkins Server Packer image builder

    Shell

  3. infra-jenkins infra-jenkins Public

    Infrastructure as a service code for Jenkins Server

    HCL

  4. static-site static-site Public

    Static Site hosted with Caddy

    HTML

  5. helm-chart-caddy helm-chart-caddy Public

    Helm charts for static site

  6. webapp-cve-processor webapp-cve-processor Public

    Webapp to process CVEs and store in database

    Go

Repositories

Showing 10 of 16 repositories
  • .github Public

    AWS EKS K8s Infrastructure with data ingestion pipelines for LLM

    ThreatLensAI/.github’s past year of commit activity
    0 0 0 0 Updated Aug 19, 2024
  • infra-aws Public

    AWS Kubernetes(EKS) Infrastructure

    ThreatLensAI/infra-aws’s past year of commit activity
    HCL 0 0 0 0 Updated Aug 19, 2024
  • infra-jenkins Public

    Infrastructure as a service code for Jenkins Server

    ThreatLensAI/infra-jenkins’s past year of commit activity
    HCL 0 0 0 0 Updated Aug 19, 2024
  • static-site Public

    Static Site hosted with Caddy

    ThreatLensAI/static-site’s past year of commit activity
    HTML 0 0 0 0 Updated Aug 19, 2024
  • helm-chart-caddy Public

    Helm charts for static site

    ThreatLensAI/helm-chart-caddy’s past year of commit activity
    0 0 0 0 Updated Aug 19, 2024
  • helm-webapp-cve-processor Public

    Helm charts to deploy webapp CVE Processor

    ThreatLensAI/helm-webapp-cve-processor’s past year of commit activity
    Smarty 0 0 0 0 Updated Aug 19, 2024
  • helm-eks-autoscaler Public

    Helm charts for eks autoscaler

    ThreatLensAI/helm-eks-autoscaler’s past year of commit activity
    Dockerfile 0 0 0 0 Updated Aug 19, 2024
  • webapp-cve-processor Public

    Webapp to process CVEs and store in database

    ThreatLensAI/webapp-cve-processor’s past year of commit activity
    Go 0 0 0 0 Updated Aug 19, 2024
  • cve-operator Public

    Kubernetes Operator - CVE Operator

    ThreatLensAI/cve-operator’s past year of commit activity
    Go 0 0 0 0 Updated Aug 19, 2024
  • webapp-cve-consumer Public

    Code for webapp cve consumer

    ThreatLensAI/webapp-cve-consumer’s past year of commit activity
    Go 0 0 0 0 Updated Aug 19, 2024

Top languages

Loading…

Most used topics

Loading…