graph LR
    KAP["kube-auth-proxy<br/>(Dual-Mode Sidecar)"]

    %% Kubernetes / OpenShift Platform Dependencies
    KAP -->|"TokenReview +<br/>SubjectAccessReview<br/>HTTPS/443"| K8sAPI["Kubernetes API Server"]
    KAP -->|"OAuth discovery +<br/>token exchange<br/>HTTPS/443"| OAuthServer["OpenShift OAuth Server"]
    KAP -->|"User info +<br/>token revocation<br/>HTTPS/443"| UserAPI["OpenShift User API"]

    %% External Identity Provider
    KAP -->|"OIDC discovery +<br/>JWKS + token exchange<br/>HTTPS/443"| OIDC["OIDC Provider<br/>(Keycloak, Azure AD, etc.)"]

    %% Optional Session Storage
    KAP -.->|"Session storage +<br/>distributed locking<br/>TCP/6379"| Redis["Redis<br/>(optional)"]

    %% Build Dependencies
    KAP -.->|"build"| Go["Go 1.25.3"]
    KAP -.->|"base image"| UBI["UBI 9 Minimal<br/>(FIPS runtime)"]

    %% Key Go Libraries
    subgraph GoLibraries["Key Go Libraries"]
        direction TB
        GoOIDC["coreos/go-oidc/v3<br/>v3.18.0"]
        GoRedis["redis/go-redis/v9<br/>v9.17.0"]
        ClientGo["k8s.io/client-go<br/>v0.35.3"]
        APIServer["k8s.io/apiserver<br/>v0.35.3"]
        GorillaMux["gorilla/mux<br/>v1.8.1"]
        PromClient["prometheus/client_golang<br/>v1.23.2"]
    end
    KAP -.->|"libraries"| GoLibraries

    %% Integration Points - Consuming
    Envoy["Envoy / Service Mesh<br/>(ext_authz)"] -->|"ext_authz check<br/>HTTP/4180"| KAP
    Prometheus["OpenShift Monitoring<br/>(Prometheus)"] -->|"metrics scraping<br/>hardcoded SA allowlist"| KAP
    RhodsOp["rhods-operator"] -->|"deploys as sidecar<br/>configures RBAC/secrets"| KAP

    %% Upstream Target
    KAP -->|"forward authn/authz<br/>requests<br/>HTTP/HTTPS/H2C"| Upstream["Upstream RHOAI<br/>Component Services"]

    %% Styling
    style KAP fill:#4a90e2,stroke:#333,stroke-width:4px,color:#fff
    style K8sAPI fill:#dae8fc,stroke:#6c8ebf
    style OAuthServer fill:#dae8fc,stroke:#6c8ebf
    style UserAPI fill:#dae8fc,stroke:#6c8ebf
    style OIDC fill:#999,stroke:#333,color:#fff
    style Redis fill:#999,stroke:#333,color:#fff
    style Go fill:#f0f0f0,stroke:#999
    style UBI fill:#f0f0f0,stroke:#999
    style GoLibraries fill:#f5f5f5,stroke:#ccc
    style Envoy fill:#7ed321,stroke:#333,color:#fff
    style Prometheus fill:#7ed321,stroke:#333,color:#fff
    style RhodsOp fill:#7ed321,stroke:#333,color:#fff
    style Upstream fill:#7ed321,stroke:#333,color:#fff
