Architecture¶

This section is the architectural map of ElasticBLAST Control Plane.

Core references¶

High Level Architecture — browser and optional queue ingress, the shipped six-sidecar Container App, private Storage, and AKS execution.
Container Apps Architecture — authoritative reference for the deployed topology, ingress, identity, secrets, and the Azure Functions retirement history.
Runtime Plan — supporting infrastructure (VNet/subnets, private DNS, shared MI + RBAC, Storage rules, AKS plan, post-deploy smoke checklist).
Identity Architecture — the two managed identities (shared id-elb-dashboard-* and the runtime-created id-elb-openapi workload MI), their lifecycle, federated identity credentials, full role-ID matrix, and recovery playbooks.
Storage Isolation & Browser ↔ Storage Proxy — the load-bearing security contract: publicNetworkAccess: Disabled, no SAS to the browser, streaming proxy through the api sidecar.
Authentication & Authorization — MSAL Auth Code + PKCE handshake, managed identity, and the full RBAC role matrix.
Service Bus BLAST Integration — optional request queue, execution admission, completion events, DLQ handling, and durable outbox contract.
Service Bus Examples — standalone producer, monitor, and consumer examples for the external integration.
Diagnostics — read-only reliability, availability, and security checks surfaced by the Diagnostics page.

These pages capture investigations that informed design decisions. They are not user-facing documentation.

BLAST Search Space Discovery — how the control plane discovers BLAST databases and searchsp metadata.
Web BLAST Compatibility Plan — implementation ledger for Web BLAST scientific compatibility.
AKS Capacity Gate — historical Redis capacity-gate design plus current implementation and supersession status.
Cross-Path Submit Coordination — implemented Kubernetes Lease and active-job-count coordination shared with OpenAPI.
Unbounded Socket Timeouts — postmortem and bounded-timeout design rules for external network calls.