graph TB
    subgraph External["EXTERNAL - Untrusted"]
        User["User/Data Scientist"]
        KServeExt["KServe Controller<br/>external requests"]
    end

    subgraph K8sControlPlane["KUBERNETES CONTROL PLANE"]
        APIServer["Kubernetes API Server<br/>6443/TCP HTTPS<br/>TLS 1.2+ RBAC"]
    end

    subgraph ControllerNamespace["CONTROLLER NAMESPACE<br/>opendatahub / redhat-ods-applications"]
        direction TB

        subgraph ControllerPod["ODH Model Controller Pod"]
            Controller["Controller Process<br/>User: 65532:65532<br/>runAsNonRoot: true<br/>Leader-Elected 1 of 3"]
            MetricsEndpoint["Metrics Endpoint<br/>:8080/metrics<br/>HTTP SA Token"]
            HealthProbe["Health Probes<br/>:8081 healthz readyz<br/>HTTP No Auth"]
            WebhookServer["Webhook Server<br/>:9443 HTTPS TLS"]

            Controller --> MetricsEndpoint
            Controller --> HealthProbe
            Controller --> WebhookServer
        end

        MetricsSvc["Service: metrics<br/>ClusterIP<br/>8080/TCP HTTP"]
        WebhookSvc["Service: webhook<br/>ClusterIP<br/>443/TCP HTTPS TLS"]

        MetricsEndpoint -.->|exposed by| MetricsSvc
        WebhookServer -.->|exposed by| WebhookSvc
    end

    subgraph MonitoringNamespace["MONITORING NAMESPACE<br/>optional if monitoring-namespace set"]
        PrometheusOp["Prometheus Operator<br/>Reads ServiceMonitor CRD"]
        Prometheus["Prometheus<br/>Scrapes metrics"]

        PrometheusOp -->|configures| Prometheus
    end

    subgraph UserNamespace["USER NAMESPACE<br/>InferenceService namespace"]
        InferenceServiceCR["InferenceService CR<br/>serving.kserve.io/v1beta1"]

        subgraph CreatedResources["Resources Created by Controller"]
            Route["OpenShift Route<br/>443/TCP HTTPS<br/>TLS passthrough/edge"]
            VirtualService["Istio VirtualService<br/>8080 8443/TCP<br/>HTTP/HTTPS mTLS"]
            PeerAuth["PeerAuthentication<br/>STRICT/PERMISSIVE mTLS"]
            Telemetry["Telemetry<br/>Metrics collection"]
            AuthConfig["AuthConfig<br/>authorino.kuadrant.io<br/>Auth rules"]
            NetworkPolicy["NetworkPolicy<br/>Ingress: 8080 8443/TCP"]
            ServiceMeshMember["ServiceMeshMember<br/>maistra.io/v1"]
            ServiceMonitor["ServiceMonitor<br/>monitoring.coreos.com/v1"]
            StorageSecret["Storage Secrets<br/>S3/PVC credentials"]
        end
    end

    subgraph ExternalDependencies["EXTERNAL DEPENDENCIES"]
        IstioCP["Istio Control Plane<br/>15012/TCP gRPC mTLS"]
        Authorino["Authorino<br/>Processes AuthConfigs"]
        ModelRegistry["Model Registry<br/>8080/TCP HTTP<br/>optional flag-enabled"]
    end

    %% External to Control Plane
    User -->|6443 HTTPS TLS1.2+<br/>OIDC ServiceAccount| APIServer
    KServeExt -->|6443 HTTPS TLS1.2+<br/>ServiceAccount| APIServer

    %% API Server to Controller watch events
    APIServer -->|Event Stream<br/>InferenceService Watch<br/>Controller Cache| Controller

    %% API Server to Webhook
    APIServer -->|443 HTTPS TLS<br/>service-ca<br/>Webhook Call| WebhookSvc
    WebhookSvc -->|route to| WebhookServer

    %% Controller Egress
    Controller -->|6443 HTTPS TLS1.2+<br/>SA Token<br/>CRUD Resources| APIServer
    Controller -->|15012 gRPC mTLS<br/>SA Identity<br/>Mesh Config| IstioCP
    Controller -->|8080 HTTP<br/>SA Token<br/>Optional| ModelRegistry

    %% Prometheus Scraping
    Prometheus -->|8080 HTTPS TLS<br/>internal CA<br/>Bearer Token| MetricsSvc

    %% Controller creates resources in user namespace
    Controller -.->|creates/manages| InferenceServiceCR
    Controller -.->|creates| Route
    Controller -.->|creates| VirtualService
    Controller -.->|creates| PeerAuth
    Controller -.->|creates| Telemetry
    Controller -.->|creates| AuthConfig
    Controller -.->|creates| NetworkPolicy
    Controller -.->|creates| ServiceMeshMember
    Controller -.->|creates| ServiceMonitor
    Controller -.->|creates| StorageSecret

    %% External dependencies consume resources
    IstioCP -.->|processes| VirtualService
    IstioCP -.->|enforces| PeerAuth
    IstioCP -.->|collects| Telemetry
    Authorino -.->|processes| AuthConfig
    PrometheusOp -.->|reads| ServiceMonitor

    %% Styling
    classDef external fill:#f9f9f9,stroke:#999,stroke-width:2px
    classDef controlplane fill:#e1f5ff,stroke:#0288d1,stroke-width:2px
    classDef controller fill:#c8e6c9,stroke:#388e3c,stroke-width:3px
    classDef monitoring fill:#fff9c4,stroke:#f57f17,stroke-width:2px
    classDef usernamespace fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
    classDef externaldep fill:#ffccbc,stroke:#d84315,stroke-width:2px
    classDef service fill:#b2dfdb,stroke:#00796b,stroke-width:2px
    classDef created fill:#e1bee7,stroke:#8e24aa,stroke-width:1px

    class User,KServeExt external
    class APIServer controlplane
    class Controller,ControllerPod,MetricsEndpoint,HealthProbe,WebhookServer controller
    class MetricsSvc,WebhookSvc service
    class PrometheusOp,Prometheus monitoring
    class InferenceServiceCR,UserNamespace usernamespace
    class Route,VirtualService,PeerAuth,Telemetry,AuthConfig,NetworkPolicy,ServiceMeshMember,ServiceMonitor,StorageSecret created
    class IstioCP,Authorino,ModelRegistry externaldep
