graph TB
    subgraph External["EXTERNAL (Untrusted)"]
        User[User/Admin]
    end

    subgraph ControlPlane["KUBERNETES CONTROL PLANE"]
        APIServer["Kubernetes API Server<br/>6443/TCP HTTPS TLS1.2+<br/>Auth: ServiceAccount Token"]
    end

    subgraph OperatorNS["OPERATOR NAMESPACE (redhat-ods-operator)"]
        direction TB

        subgraph OperatorPod["RHODS Operator Pod<br/>SA: controller-manager<br/>SecCtx: runAsNonRoot, drop ALL caps"]
            Webhook["Webhook Server<br/>9443/TCP HTTPS<br/>mTLS<br/>Cert: webhook-server-cert"]

            Metrics["Metrics Endpoint<br/>8080/TCP HTTP → 8443/TCP HTTPS<br/>Auth: kube-rbac-proxy<br/>Cert: prometheus-tls"]

            Health["Health Probes<br/>8081/TCP HTTP<br/>/healthz, /readyz<br/>Auth: None"]

            Controllers["Controllers:<br/>DSC, DSCI, SecretGen, CertGen"]

            ManifestFetcher["Manifest Fetcher<br/>Kustomize"]
        end
    end

    subgraph ExternalServices["EXTERNAL SERVICES"]
        GitHub["GitHub<br/>443/TCP HTTPS TLS1.2+<br/>Public Repos<br/>Auth: None"]
    end

    subgraph ManagedNS["MANAGED NAMESPACES"]
        direction TB

        subgraph MonitoringNS["Namespace: redhat-ods-monitoring"]
            Prometheus["Prometheus<br/>SA: prometheus<br/>9091/TCP HTTPS<br/>Cert: prometheus-tls"]
            Alertmanager["Alertmanager<br/>9093/TCP HTTP<br/>Cert: serving-cert"]
            BlackboxExporter["Blackbox Exporter<br/>9115/TCP HTTP"]
        end

        subgraph ApplicationsNS["Namespace: redhat-ods-applications"]
            Dashboard["ODH Dashboard"]
            Workbenches["Workbenches"]
        end

        subgraph IstioNS["Namespace: istio-system (Conditional)"]
            SMCP["ServiceMeshControlPlane<br/>Istio"]
        end

        subgraph AuthProviderNS["Namespace: redhat-ods-applications-auth-provider"]
            Authorino["Authorino<br/>External Authorization"]
        end

        subgraph KnativeNS["Namespace: knative-serving"]
            KnativeServing["Knative Serving"]
        end
    end

    subgraph Ingress["INGRESS (User Access)"]
        PromRoute["OpenShift Route<br/>prometheus-redhat-ods-monitoring<br/>443/TCP HTTPS<br/>TLS: edge<br/>Auth: OAuth"]

        AlertRoute["OpenShift Route<br/>alertmanager-redhat-ods-monitoring<br/>443/TCP HTTPS<br/>TLS: edge<br/>Auth: OAuth"]
    end

    subgraph OpenShiftMon["OPENSHIFT MONITORING"]
        OSMonitoring["OpenShift Monitoring<br/>openshift-monitoring<br/>openshift-user-workload-monitoring"]
    end

    %% External to Control Plane
    User -->|HTTPS/6443<br/>TLS 1.2+<br/>OpenShift OAuth| APIServer

    %% Control Plane to Operator
    APIServer -->|HTTPS/9443<br/>mTLS<br/>API Server Client Cert| Webhook

    %% Operator to Control Plane
    Controllers -->|HTTPS/6443<br/>TLS 1.2+<br/>ServiceAccount Token| APIServer

    %% Operator to External Services
    ManifestFetcher -->|HTTPS/443<br/>TLS 1.2+<br/>Public Access| GitHub

    %% Monitoring to Operator
    Prometheus -->|HTTPS/8443<br/>TLS 1.2+<br/>Bearer Token| Metrics

    %% OpenShift Monitoring to Prometheus
    OSMonitoring -->|HTTPS/9091<br/>TLS 1.2+<br/>ServiceAccount Token| Prometheus

    %% Ingress Routes
    PromRoute -.->|edge TLS<br/>OAuth| Prometheus
    AlertRoute -.->|edge TLS<br/>OAuth| Alertmanager

    %% Operator manages namespaces
    Controllers -.->|creates/manages| MonitoringNS
    Controllers -.->|creates/manages| ApplicationsNS
    Controllers -.->|creates/manages| IstioNS
    Controllers -.->|creates/manages| AuthProviderNS
    Controllers -.->|creates/manages| KnativeNS

    %% Service Mesh Integration
    Controllers -->|creates CRs| SMCP
    Controllers -->|creates CRs| Authorino

    %% Styling
    classDef external fill:#f9f9f9,stroke:#999,stroke-width:3px
    classDef controlplane fill:#e1f5ff,stroke:#0288d1,stroke-width:3px
    classDef operator fill:#fff3e0,stroke:#f57c00,stroke-width:3px
    classDef monitoring fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
    classDef managed fill:#e8f5e9,stroke:#388e3c,stroke-width:2px
    classDef externalservice fill:#fff9c4,stroke:#f57f17,stroke-width:2px
    classDef ingress fill:#fce4ec,stroke:#c2185b,stroke-width:2px

    class User external
    class APIServer controlplane
    class OperatorPod,Webhook,Metrics,Health,Controllers,ManifestFetcher operator
    class Prometheus,Alertmanager,BlackboxExporter,OSMonitoring monitoring
    class Dashboard,Workbenches,SMCP,Authorino,KnativeServing managed
    class GitHub externalservice
    class PromRoute,AlertRoute ingress
