Skip to content
centiceps

Architecture

Centiceps has three trust zones with different responsibilities.

Management plane on the left with the control plane and Postgres. Runtime on the right with the gateway backend, gateway pods, Redis, and upstream services. Configuration flows from the control plane to the backend to the pods. Consumer traffic enters the pods only.

Control plane

Section titled “Control plane”

The control plane serves human administration. It owns authoring, validation, immutable revisions, deployment intent, RBAC, and audit. It does not serve consumer API traffic and does not push configuration directly into gateway pods.

Gateway backend

Section titled “Gateway backend”

The gateway backend is the machine-facing core. It builds runtime snapshots from durable state, streams configuration and resources to gateway pods, and serves request-time registry and token operations that should not be embedded in an environment snapshot.

Gateway backend replicas are stateless over shared Postgres, content-addressed storage, and Redis. Any replica can construct the same snapshot.

Gateway pods

Section titled “Gateway pods”

Gateway pods process consumer traffic. Each pod holds an immutable runtime generation in memory and swaps to a new generation only after validation and compilation succeed.

JavaScript callouts run with the gateway. Python callouts use an optional localhost sidecar; a sidecar failure affects only those steps and follows their configured onError behavior.

Failure boundaries

Section titled “Failure boundaries”
Component unavailable Expected behavior
Control plane Authoring and deployment stop; runtime continues.
Gateway backend Configuration already in gateway memory keeps serving. Anything a policy must fetch — consumer identity, entitlements, uncached registry data — fails closed, and new pods cannot start. Treat the backend as part of the request path.
Redis Gateways use L1 caches and guarded backend calls according to policy failure modes.
Postgres Services degrade to cached state; warm gateways continue.
Python sidecar Python callouts degrade; the remaining policy engine continues.

Invariants

Section titled “Invariants”
  1. The control plane never sends configuration directly to gateways.
  2. Gateway pods never connect to Postgres.
  3. Consumer traffic never enters the management plane.
  4. A failed generation apply never replaces last-known-good configuration.
  5. Version skew is observable but does not make a healthy gateway unready.