%% Data Flow Diagram - Notebooks (Workbench Images)
%% Generated by: Claude Opus 4.6

sequenceDiagram
    participant User as User (Browser)
    participant Dashboard as RHOAI Dashboard<br/>443/TCP HTTPS
    participant Operator as rhods-operator<br/>443/TCP HTTPS
    participant K8sAPI as OpenShift API<br/>443/TCP HTTPS TLS 1.2+
    participant Controller as ODH Notebook Controller<br/>443/TCP HTTPS
    participant Runtime as Container Runtime
    participant Quay as quay.io/modh/*<br/>443/TCP HTTPS

    Note over Operator,K8sAPI: Flow 1: Workbench Image Selection and Launch

    Operator->>K8sAPI: Deploy ImageStream manifests<br/>HTTPS/443 | TLS 1.2+<br/>Auth: ServiceAccount token
    Dashboard->>K8sAPI: Read ImageStream annotations<br/>HTTPS/443 | TLS 1.2+<br/>Auth: User bearer token
    User->>Dashboard: Select workbench type<br/>HTTPS/443 | TLS 1.2+<br/>Auth: OAuth
    Dashboard->>K8sAPI: Create Notebook CR<br/>HTTPS/443 | TLS 1.2+<br/>Auth: User bearer token
    Controller->>K8sAPI: Watch Notebook CR, create Pod<br/>HTTPS/443 | TLS 1.2+<br/>Auth: ServiceAccount token
    Runtime->>Quay: Pull workbench image<br/>HTTPS/443 | TLS 1.2+<br/>Auth: Pull secret

    Note over User,Quay: Flow 2: Konflux Build Pipeline

    participant GitHub as GitHub<br/>443/TCP HTTPS
    participant Konflux as Konflux (PipelinesAsCode)<br/>443/TCP HTTPS

    GitHub->>Konflux: Webhook trigger<br/>HTTPS/443 | TLS 1.2+<br/>Auth: Webhook secret
    Konflux->>GitHub: git clone source<br/>HTTPS/443 | TLS 1.2+<br/>Auth: Git credentials
    Konflux->>Konflux: buildah build image<br/>Scan: Clair, ClamAV, SAST
    Konflux->>Quay: Push built image<br/>HTTPS/443 | TLS 1.2+<br/>Auth: Push secret
