%% Kubeflow Notebook Controller - Data Flow Diagram
%% Generated by: Claude Opus 4.6
%% Source: architecture/rhoai-2.19/kubeflow.md

sequenceDiagram
    participant User as User / ODH Dashboard
    participant K8sAPI as Kubernetes API<br/>443/TCP HTTPS TLS 1.2+
    participant NBC as Notebook Controller<br/>(NotebookReconciler)
    participant Culling as Culling Controller<br/>(CullingReconciler)
    participant NB as Notebook Pod<br/>8888/TCP HTTP

    Note over User,NB: Flow 1: Notebook Creation
    User->>K8sAPI: Create Notebook CR<br/>Auth: Bearer Token
    K8sAPI->>NBC: Watch event (Notebook created)<br/>Auth: ServiceAccount token
    NBC->>K8sAPI: Create StatefulSet (1 replica)<br/>HTTPS/443, SA token
    NBC->>K8sAPI: Create ClusterIP Service (80->8888)<br/>HTTPS/443, SA token
    NBC->>K8sAPI: Create VirtualService (if USE_ISTIO=true)<br/>HTTPS/443, SA token
    K8sAPI-->>NBC: Resources created

    Note over User,NB: Flow 2: Idle Notebook Culling
    loop Every IDLENESS_CHECK_PERIOD (default: 1 min)
        Culling->>NB: GET /api/kernels<br/>HTTP/80, No Auth
        NB-->>Culling: Kernel status
        Culling->>NB: GET /api/terminals<br/>HTTP/80, No Auth
        NB-->>Culling: Terminal status
    end
    Note over Culling: If idle > CULL_IDLE_TIME (default: 1440 min)
    Culling->>K8sAPI: Set kubeflow-resource-stopped annotation<br/>HTTPS/443, SA token
    K8sAPI->>NBC: Watch event (annotation changed)
    NBC->>K8sAPI: Scale StatefulSet replicas to 0<br/>HTTPS/443, SA token

    Note over User,NB: Flow 3: Notebook Restart (via annotation)
    User->>K8sAPI: Set notebook-restart annotation<br/>Auth: Bearer Token
    K8sAPI->>NBC: Watch event (annotation changed)
    NBC->>K8sAPI: Delete Pod<br/>HTTPS/443, SA token
    NBC->>K8sAPI: Remove restart annotation<br/>HTTPS/443, SA token
