as S/W 엔지니어

graph TD
    User((<b>User / Operator</b>))
    KagentCLI["<b>kagent CLI</b><br/><i>Client</i>"]
    LLM["<b>LLM</b><br/>(ChatGPT, Gemini, Claude, etc.)"]

    subgraph K8s["Kubernetes Cluster"]
        direction TB

        AGController["<b>agentgateway-controller</b><br/><i>1 Deployment</i>"]
        KagentUI["<b>kagent-ui</b><br/><i>1 Deployment</i>"]
        subgraph KagentCPGroup[" "]
            direction TB
            KagentCtrl["<b>kagent-controller</b><br/><i>1 Deployment</i>"]
            KMCP["<b>kmcp-controller</b><br/><i>1 Deployment</i>"]
        end

        Agent["<b>Agent</b><br/><i>1..N Deployments</i>"]
        MCPServer["<b>MCP / Tool Server</b><br/><i>1..N Deployments</i>"]
        AG["<b>agentgateway</b><br/><i>1..N Deployments</i><br/><i>(one per Gateway)</i>"]

        Service["<b>Service</b><br/><i>Workloads</i>"]
    end

    %% Control Plane Logic
    KagentUI <-->|User Interaction / Manage| KagentCPGroup
    KagentCLI <-->|User Interaction / Manage| KagentCPGroup
    KagentCtrl -->|"Tool Discovery<br/>(streamable HTTP or SSE)"| MCPServer
    KagentCtrl <-->|"User Interaction / Manage"| Agent
    AGController -.->|"Program Config / Policy"| AG
    KMCP -.->|Manage| MCPServer


    %% User flow
    User -->|"- User Interaction<br/>- Manage (Operator)"| KagentCLI
    User -->|"- User Interaction<br/>- Manage (Operator)"| KagentUI
    User -.->|"Manage via Agent / MCP CRDs (Operator)"| KagentCPGroup
    User -.->|"Manage via Gateway API / CRDs (Operator)"| AGController

    %% Traffic Flows via `agentgateway`
    Agent <-->|A2A / MCP / LLM Traffic| AG
    AG -->|Routing / Policy Enforcement| MCPServer
    AG -->|Unified API / Guardrail| LLM

    %% Execution
    MCPServer -->|API Call| Service

    %% 스타일 정의
    classDef external fill:#eceff1,stroke:#90a4ae,stroke-width:2px,color:#37474f
    classDef actor_user fill:#e8f5e9,stroke:#2e7d32,stroke-width:3px,color:#1b5e20,font-size:18px
    classDef actor_operator fill:#e3f2fd,stroke:#1565c0,stroke-width:3px,color:#0d47a1,font-size:18px
    classDef external_llm fill:#e3f2fd,stroke:#1565c0,stroke-width:3px,color:#0d47a1,font-size:16px

    %% [그룹 1] `kagent / kmcp` 라인 (보라 계열)
    classDef highlight_kagent fill:#6200ee,stroke:#3700b3,stroke-width:4px,color:#fff
    classDef highlight_kagentUI fill:#8200ee,stroke:#5700b3,stroke-width:4px,color:#fff
    classDef runtime_kagent fill:#f3e5f5,stroke:#7e57c2,stroke-width:2px,color:#311b92

    %% [그룹 2] `agentgateway` 라인 (오렌지 계열)
    classDef highlight_ag fill:#ff6d00,stroke:#e65100,stroke-width:4px,color:#fff
    classDef control_kgateway fill:#fff3e0,stroke:#fb8c00,stroke-width:2px,color:#e65100

    %% 기타
    classDef backend fill:#ffffff,stroke:#c2185b,stroke-width:1px,color:#880e4f

    %% 서브그래프 스타일
    style K8s fill:#f8f9fa,stroke:#37474f,stroke-width:2px,stroke-dasharray: 5 5
    style KagentCPGroup fill:none,stroke:#7e57c2,stroke-width:2px,stroke-dasharray: 5 5

    %% 클래스 적용
    class LLM external_llm
    class User actor_user
    class KagentUI,KagentCtrl,KMCP,KagentCLI runtime_kagent
    class Agent highlight_kagent
    class MCPServer highlight_kagentUI
    class AGController control_kgateway
    class AG highlight_ag
    class Service backend

graph LR

classDef default font-family:Inter,font-size:13px;

classDef req fill:#ffffff,stroke:#718096,stroke-width:2px,color:#2d3748;

classDef proxy fill:#edf2f7,stroke:#2d3748,stroke-width:2px,color:#2d3748;

classDef oef fill:#5a67d8,stroke:#ffffff,stroke-width:2px,color:#ffffff;

classDef internal fill:#4c51bf,stroke:#ffffff,color:#ffffff;

classDef svc fill:#48bb78,stroke:#ffffff,stroke-width:2px,color:#ffffff;

classDef tele fill:#ed8936,stroke:#ffffff,stroke-width:2px,color:#ffffff;

  

REQ(["<b>Request</b><br/>GET /v1/users/42"]) -- ":path,<br/> :method" --> PROXY

  

subgraph PROXY ["<b>ISTIO PROXY</b><br/>(Sidecar, Ingress Gateway, Waypoint)"]

direction TB

subgraph OEF ["<b>openapi-endpoint-filter</b>"]

M[OpenAPI Matching /<br/> Header Injection]

end

TELE["<b>Telemetry API</b><br/><small>Metric Tag Overriding</small>"]

M -.-> TELE

end

  

PROXY -- "<b>Injected Headers:</b><br/>x-api-endpoint: GET /users/{id}<br/>x-path-template: /users/{id}<br/>x-service-name: userservice" --> C(["<b>Upstream Service</b>"])

TELE -.-> |"<b>Exported Metrics:</b><br/>request_endpoint: GET /users/{id}"| METRIC(["<b>Istio Metrics</b>"])

%% Apply Classes

class REQ req;

class PROXY proxy;

class OEF oef;

class M internal;

class SVC svc;

class TELE tele;

class METRIC tele;

graph TD
  %% ===== root cgroup : node/system + pods subtree (Kubernetes) =====
  subgraph RootCG["<b>root 수준(node) cgroup</b><br/>(limit 없음)"]
    RootProcs["<b>root 소속 프로세스</b><br/>- 시스템 프로세스(e.g. systemd, sshd)<br/>- k8s 프로세스(e.g. containerd, kubelet, kube-proxy)<br/>- etc."]
    
    subgraph PodCG["<b>pod 단위 cgroup</b><br/>(limit = Σ container limit)"]
      subgraph CtrCG["<b>container 단위 cgroup</b><br/>(memory limit 설정 지점 - optional)"]
        Proc1["app process A"]
        Proc2["app process B"]
      end
    end
  end
  RootProcs --"node 전체 메모리 고갈 경우 발생"--> GlobalOOM["global OOM 발생"]
  Proc2 --"node 전체 메모리 고갈, limit이 없는 경우 발생"--> GlobalOOM
  PodCG --"limit 초과 경우 발생"--> cgroupOOM["cgroup OOM 발생"]
  CtrCG --"limit 초과 경우 발생"--> cgroupOOM["cgroup OOM 발생"]

  %% ===== 스타일 =====
  style RootCG fill:#fcf4fc,stroke:#880e4f
  style PodCG fill:#e8f5e9,stroke:#2e7d32
  style CtrCG fill:#e3f2fd,stroke:#1565c0

  style RootProcs fill:#fff0f2,stroke:#fb8c00
  style Proc1 fill:#bbdefb,stroke:#1565c0
  style Proc2 fill:#bbdefb,stroke:#1565c0

  style GlobalOOM fill:#ffcdd2,stroke:#d32f2f,stroke-width:2px
  style cgroupOOM fill:#ffecb3,stroke:#ffa000,stroke-width:2px

graph TD

subgraph Cluster_Level ["Cluster"]

Scheduler["kube-scheduler"]

  
  

end

  

subgraph Node_Level ["Node (Host)"]

Kubelet["kubelet"]

GlobalOOM["Linux global OOM (killer)"]

subgraph Pod_Level ["Pod/Container (cgroup)"]

CgroupOOM["Linux cgroup OOM (killer)"]

TargetPod["Pod / Container"]

end

TargetSys["System Processes (kubelet, containerd, etc.)"]

end

  
  

%% 관계 설정

Scheduler -. "* 선점(Preemption)에 의한 eviction trigger<br/>(via kube-apiserver)" .-> Kubelet

Kubelet -. "* 선점(Preemption)에 의한 eviction<br/>1. Node pressure에 의한 eviction" .-> TargetPod

CgroupOOM -- "2. limit 초과 시 강제 종료 (OOMKilled)" --> TargetPod

GlobalOOM -- "3. 메모리 할당 실패 시 강제 종료 (OOMKilled)" --> TargetPod

GlobalOOM -- "3. 메모리 할당 실패 시 강제 종료 (OOMKilled)" --> TargetSys

  

%% 스타일링

style Cluster_Level fill:#ffffff,stroke:#01579b

style Node_Level fill:#f9f9f9,stroke:#666

style Pod_Level fill:#e1f5fe,stroke:#01579b

style Scheduler fill:#e8f5e9,stroke:#2e7d32

style Kubelet fill:#fff9c4,stroke:#fbc02d

style CgroupOOM fill:#ffecb3,stroke:#ffa000

style GlobalOOM fill:#ffcdd2,stroke:#d32f2f

graph LR
	subgraph NIST["NIST SP 800-207 ZTA"]
	direction LR
	PE["Policy Engine"]
	PA["Policy Administrator"]
	PEP_N["PEP"]
	PKI_N["PKI / ID Management"]
	Logs_N["Activity Logs"]
end

subgraph Istio["Istio" / OPA]
	direction LR
	OPA["OPA"]
	Istiod["Istio: istiod"]
	Envoy["Istio: istio-proxy / Waypoint"]
	SPIFFE["Istio: istiod<br/>(SPIFFE, Citadel)"]
	Logs_I["Istio: Access Log"]
end

PE -.-> OPA
PA -.-> Istiod
PEP_N -.-> Envoy
PKI_N -.-> SPIFFE
Logs_N -.-> Logs_I

style NIST fill:#f1f5f9,stroke:#64748b,color:#0f172a
style Istio fill:#f8fafc,stroke:#2563eb,color:#0f172a
style PE fill:#ffffff,stroke:#64748b,color:#0f172a
style PA fill:#ffffff,stroke:#64748b,color:#0f172a
style PEP_N fill:#ffffff,stroke:#64748b,color:#0f172a
style PKI_N fill:#ffffff,stroke:#64748b,color:#0f172a
style Logs_N fill:#ffffff,stroke:#64748b,color:#0f172a
style OPA fill:#fffbeb,stroke:#b45309,color:#78350f
style Istiod fill:#eff6ff,stroke:#2563eb,color:#1e3a8a
style Envoy fill:#ecfdf5,stroke:#059669,color:#065f46
style SPIFFE fill:#fdf2f8,stroke:#db2777,color:#831843
style Logs_I fill:#f5f3ff,stroke:#7c3aed,color:#4c1d95