%% TrustyAI Explainability - Security Network Diagram
%% Generated by: Claude Opus 4.6

graph TB
    subgraph External["EXTERNAL (Untrusted)"]
        User["User / Dashboard"]
    end

    subgraph Ingress["INGRESS (OpenShift Route)"]
        Route["trustyai Route<br/>80/TCP<br/>TLS: None"]
    end

    subgraph ClusterInternal["CLUSTER INTERNAL"]
        direction TB

        Service["trustyai-service<br/>ClusterIP 80/TCP → 8080/TCP<br/>No Encryption, No Auth"]

        subgraph TrustyAIPod["TrustyAI Service Pod"]
            direction TB
            InitContainer["config-map-overrider<br/>(Init Container, ose-cli)<br/>Creates model-serving-config"]
            ConsumerEP["/consumer/kserve/v2<br/>POST, No Auth"]
            MetricsEP["/metrics/group/fairness/*<br/>/metrics/drift/*<br/>POST, No Auth"]
            ExplainerEP["/explainers/local/*<br/>/explainers/global/*<br/>POST, No Auth"]
            HealthMetrics["/q/metrics<br/>GET, Bearer Token (SA)<br/>/q/health/*<br/>GET, No Auth"]
        end

        subgraph InboundSources["Inbound Sources (Cluster Internal)"]
            ModelMesh["ModelMesh Serving<br/>HTTP 80/TCP<br/>No Encryption, No Auth"]
            KServeLogger["KServe Inference Logger<br/>CloudEvents HTTP 80/TCP<br/>No Encryption, No Auth"]
            Prometheus["Prometheus<br/>HTTP 80/TCP<br/>Bearer Token (SA)"]
        end
    end

    subgraph EgressTargets["EGRESS DESTINATIONS"]
        direction TB
        ModelServer["Model Server<br/>(KServe/ModelMesh)<br/>gRPC Variable/TCP<br/>plaintext, No Auth"]
        MinIO["MinIO (Optional)<br/>HTTP 9000/TCP<br/>No Encryption<br/>Access Key/Secret Key"]
        PVC["PVC Storage<br/>/inputs mount<br/>File I/O"]
    end

    %% External to Ingress
    User -->|"HTTP 80/TCP<br/>No TLS<br/>No Auth"| Route

    %% Ingress to Service
    Route -->|"HTTP 80/TCP → 8080/TCP<br/>No Encryption"| Service

    %% Service to Pod endpoints
    Service --> ConsumerEP
    Service --> MetricsEP
    Service --> ExplainerEP
    Service --> HealthMetrics

    %% Inbound sources
    ModelMesh -->|"HTTP POST 80/TCP<br/>No Encryption<br/>Payload Processor Webhook"| ConsumerEP
    KServeLogger -->|"CloudEvent POST 80/TCP<br/>No Encryption<br/>inference.request/response"| ConsumerEP
    Prometheus -->|"HTTP GET 80/TCP<br/>Bearer Token (SA)<br/>ServiceMonitor"| HealthMetrics

    %% Egress
    ExplainerEP -->|"gRPC Variable/TCP<br/>plaintext<br/>No Auth"| ModelServer
    ConsumerEP -->|"File I/O"| PVC
    ConsumerEP -.->|"HTTP 9000/TCP<br/>Access Key/Secret Key"| MinIO

    %% Styling
    classDef external fill:#f9f9f9,stroke:#999,stroke-width:2px
    classDef ingress fill:#ffe6cc,stroke:#d79b00,stroke-width:2px
    classDef clusterinternal fill:#d5e8d4,stroke:#82b366,stroke-width:2px
    classDef egressTarget fill:#fff2cc,stroke:#d6b656,stroke-width:2px
    classDef pod fill:#dae8fc,stroke:#6c8ebf,stroke-width:2px
    classDef warning fill:#f8cecc,stroke:#b85450,stroke-width:2px

    class User external
    class Route ingress
    class Service,ModelMesh,KServeLogger,Prometheus clusterinternal
    class ConsumerEP,MetricsEP,ExplainerEP,HealthMetrics,InitContainer pod
    class ModelServer,MinIO,PVC egressTarget
