ktms-admin Architecture

ktms-admin Architecture An architecture diagram generated by Archify. Admin Browser · SPA & SSE Streaming · Architecture component Admin Browser SPA & SSE Streaming Sign-in Methods · Password · OIDC · GitHub · Proxy · Architecture component · Google, Keycloak, CF Access… Sign-in Methods Password · OIDC · GitHub · Proxy Google, Keycloak, CF Access… Ingress & Guard · Auth, Session & CSRF · ktms-admin Runtime (:8080) · RBAC + Allowlist Ingress & Guard Auth, Session & CSRF RBAC + Allowlist Admin Gateway · CRUD, Playground, Judge · ktms-admin Runtime (:8080) Admin Gateway CRUD, Playground, Judge Analytics Engine · Cost & Efficiency Scoring · ktms-admin Runtime (:8080) Analytics Engine Cost & Efficiency Scoring Keystone (KTMS) · Admin & Data gRPC (:9090) · Architecture component · Bearer KTMS_ADMIN_KEY Keystone (KTMS) Admin & Data gRPC (:9090) Bearer KTMS_ADMIN_KEY light-tokenmeter · HTTP Usage API (:8080) · Architecture component · Bearer TOKENMETER_TOKEN (read) light-tokenmeter HTTP Usage API (:8080) Bearer TOKENMETER_TOKEN (read) Sign in Verified e-mail HTTPS / UI & API Authorized /api/* /api/usage Admin & Data gRPC Summary & /readyz ktms-admin Runtime (:8080) Legend Backend Security External

Authentication & Guard

  • • Password (argon2id), Google or any OpenID Connect provider, GitHub, a trusted access proxy or Cloudflare Access
  • • Allowlists decide the role on every request: admin, read-only viewer, or a team workspace
  • • Signed session cookie, CSRF header, same-origin checks and a strict CSP

Dual-Backend Console

  • • Keystone (KTMS) gRPC: models, rules, keys, limits, tenants, nodes, playground and Judge
  • • light-tokenmeter HTTP with a read token: daily usage, estimated cost and readiness
  • • Greedy / worthy verdicts per project, user, model, action or vendor