graph TB
    subgraph External["EXTERNAL (Untrusted)"]
        User["External User<br/>(Browser)"]
    end

    subgraph Ingress["INGRESS (OpenShift Routes - TLS Edge)"]
        RoutePlanner["Route: planner<br/>443/TCP → 8501/TCP<br/>TLS Edge Termination<br/>Auth: None"]
        RouteBackend["Route: planner-backend<br/>443/TCP → 8000/TCP<br/>TLS Edge Termination<br/>Auth: None"]
    end

    subgraph PlannerNS["NAMESPACE: planner"]
        direction TB

        subgraph FrontendZone["Frontend"]
            UI["Streamlit UI<br/>Service: ui (ClusterIP)<br/>8501/TCP HTTP<br/>No Auth"]
        end

        subgraph BackendZone["Backend (non-root, drop ALL caps, seccomp)"]
            Backend["FastAPI Backend<br/>Service: backend (ClusterIP)<br/>8000/TCP HTTP<br/>SA: planner-backend<br/>28 endpoints, No Auth"]
        end

        subgraph DataZone["Data Layer"]
            PostgreSQL["PostgreSQL 16<br/>Service: postgres (ClusterIP)<br/>5432/TCP<br/>Auth: Password<br/>Secret: planner-secrets"]
            Ollama["Ollama LLM<br/>Service: ollama (ClusterIP)<br/>11434/TCP HTTP<br/>granite3.3:2b / qwen2.5:7b<br/>No Auth"]
        end

        subgraph OptionalZone["Optional (dev/test only)"]
            Simulator["vLLM Simulator<br/>8080/TCP HTTP<br/>OpenAI-compatible<br/>No Auth"]
        end
    end

    subgraph InCluster["IN-CLUSTER SERVICES"]
        ModelCatalog["RHOAI Model Catalog<br/>NS: rhoai-model-registries<br/>8443/TCP HTTPS<br/>TLS: service-serving CA<br/>Auth: Bearer Token"]
        K8sAPI["Kubernetes API Server<br/>6443/TCP HTTPS<br/>TLS 1.2+<br/>Auth: SA Token"]
    end

    subgraph ExternalServices["EXTERNAL SERVICES"]
        HF["HuggingFace Hub API<br/>huggingface.co<br/>443/TCP HTTPS<br/>TLS 1.2+<br/>Auth: Bearer Token (opt)"]
    end

    %% External to Ingress
    User -->|"HTTPS/443<br/>TLS Edge"| RoutePlanner
    User -->|"HTTPS/443<br/>TLS Edge"| RouteBackend

    %% Ingress to Services
    RoutePlanner -->|"HTTP/8501<br/>No Encryption<br/>No Auth"| UI
    RouteBackend -->|"HTTP/8000<br/>No Encryption<br/>No Auth"| Backend

    %% Internal flows
    UI -->|"HTTP/8000<br/>No Encryption<br/>No Auth"| Backend
    Backend -->|"TCP/5432<br/>No Encryption<br/>Password Auth"| PostgreSQL
    Backend -->|"HTTP/11434<br/>No Encryption<br/>No Auth"| Ollama

    %% Egress flows
    Backend -->|"HTTPS/443<br/>TLS 1.2+<br/>Bearer Token (opt)"| HF
    Backend -->|"HTTPS/8443<br/>TLS (service-CA)<br/>Bearer Token<br/>NetworkPolicy allowed"| ModelCatalog
    Backend -->|"HTTPS/6443<br/>TLS 1.2+<br/>SA Token<br/>RBAC: planner-gpu-reader"| K8sAPI

    %% Styling
    classDef external fill:#f9f9f9,stroke:#999,stroke-width:2px
    classDef ingress fill:#ffe6cc,stroke:#d79b00,stroke-width:2px
    classDef internal fill:#d5e8d4,stroke:#82b366,stroke-width:2px
    classDef data fill:#dae8fc,stroke:#6c8ebf,stroke-width:2px
    classDef incluster fill:#e1d5e7,stroke:#9673a6,stroke-width:2px
    classDef externalservice fill:#fff2cc,stroke:#d6b656,stroke-width:2px
    classDef optional fill:#f8cecc,stroke:#b85450,stroke-width:1px,stroke-dasharray: 5 5

    class User external
    class RoutePlanner,RouteBackend ingress
    class UI,Backend internal
    class PostgreSQL,Ollama data
    class ModelCatalog,K8sAPI incluster
    class HF externalservice
    class Simulator optional
