Architecture Diagram

Architecture diagram provides you a visual representation of all the services deployed in your environment. It is an interactive way to view and manage relationships between different services.

You can access the architecture diagram by switching to the diagram view () toggle from the services overview page.

Managing Connections

You can define relationships between application services and infrastructure resources by drawing connections between them. When you connect two services, relevant attributes from the resource are injected into the application's environment variables, while also ensuring that the application has the necessary permissions to access the resource.

Creating a new connection

1. Go into 'Edit' mode by clicking on the lock button in the bottom right corner.
2. Hover over the application service you wish to create the connection from.
3. When you see the dots appear around the card, click and drag it up to a resource to create a connection between the two.

4. You can modify the names of the environment variables that will be injected. Once done, click on 'Save' to create the connection.

Deleting a connection

1. Go into 'Edit' mode by clicking on the lock button in the bottom right corner.
2. Click anywhere on the connection arrow you wish to delete.
3. Select 'Delete Connection' from the dropdown that appears.

info

Once you add or remove a connection, you'll need to redeploy the service to see the changes.

Understanding the Diagram

Service Statuses

Appearance	Status
	Service is deployed and running
	Service is ready to be deployed
	Last deployment of service has failed
	Service is currently being deployed
	Service is currently being uninstalled or deleted
	Service is currently being provisioned

Connection Statuses

Appearance	Status
	Connection is successful
	Connection is created but service is not deployed
	Connection is deleted but service is not deployed
	Connection has failed

Behind the Scenes

When you link two services, Kapstan ensures your application service has the appropriate permissions to access the specified resource. In AWS cloud account environments, this is achieved using IRSA (IAM Roles for Service Accounts), as detailed in the AWS EKS documentation. For Google Cloud, we rely on Google Service Accounts to accomplish the same.