graph TB
    subgraph External["EXTERNAL (Untrusted)"]
        Client["External Client"]
    end

    subgraph Ingress["INGRESS (Platform-Managed)"]
        Gateway["RHOAI Gateway / HTTPRoute<br/>443/TCP → 8000/TCP<br/>TLS 1.2+ (SIMPLE)<br/>Model Endpoint Hostname"]
    end

    subgraph PodBoundary["POD BOUNDARY (KServe-Managed)"]
        direction TB

        Proxy["kube-rbac-proxy Sidecar<br/>Auth Enforcement<br/>Bearer Token Validation"]

        subgraph Container["vLLM Container (User 2000)"]
            direction TB
            HTTPAPI["OpenAI HTTP API<br/>8000/TCP<br/>/v1/completions<br/>/v1/chat/completions<br/>/v1/models<br/>/v1/embeddings<br/>/health"]
            GRPCAPI["TGIS gRPC Service<br/>8033/TCP<br/>GenerationService"]
            VLLMEngine["vLLM Engine<br/>PagedAttention<br/>Continuous Batching"]
        end

        GPU["NVIDIA GPU<br/>CUDA Compute"]

        Proxy -->|"HTTP/8000<br/>Plaintext<br/>Pre-verified"| HTTPAPI
        HTTPAPI --> VLLMEngine
        GRPCAPI --> VLLMEngine
        VLLMEngine -->|"CUDA API"| GPU
    end

    subgraph ClusterInternal["CLUSTER-INTERNAL (Trusted)"]
        InternalSvc["Internal Service"]
        KServe["KServe Operator<br/>ServingRuntime CR<br/>InferenceService CR"]
    end

    subgraph ExternalServices["EGRESS (External Services)"]
        ModelStorage["Model Storage<br/>S3 / HuggingFace Hub<br/>443/TCP HTTPS<br/>TLS 1.2+<br/>Bearer Token / AWS IAM"]
    end

    %% External flows
    Client -->|"HTTPS/443<br/>TLS 1.2+<br/>Bearer Token"| Gateway
    Gateway -->|"HTTP/8000<br/>TLS Terminated<br/>Auth Header"| Proxy

    %% Internal flows
    InternalSvc -->|"gRPC/8033<br/>Plaintext<br/>No Auth (cluster-internal)"| GRPCAPI
    KServe -.->|"Kubernetes API<br/>Manages lifecycle"| Container

    %% Egress flows
    VLLMEngine -->|"HTTPS/443<br/>TLS 1.2+<br/>Bearer / AWS IAM<br/>Model download at startup"| ModelStorage

    %% Styling
    classDef external fill:#f9f9f9,stroke:#999,stroke-width:2px
    classDef ingress fill:#ffe6cc,stroke:#d79b00,stroke-width:2px
    classDef pod fill:#dae8fc,stroke:#6c8ebf,stroke-width:2px
    classDef container fill:#d5e8d4,stroke:#82b366,stroke-width:2px
    classDef gpu fill:#f5a623,stroke:#333,stroke-width:2px,color:#fff
    classDef internal fill:#e1d5e7,stroke:#9673a6,stroke-width:2px
    classDef externalservice fill:#fff2cc,stroke:#d6b656,stroke-width:2px

    class Client external
    class Gateway ingress
    class Proxy pod
    class HTTPAPI,GRPCAPI,VLLMEngine container
    class GPU gpu
    class InternalSvc,KServe internal
    class ModelStorage externalservice
