Part of my notebook. Terse by design.

CDN

A globally distributed network of proxy servers (PoPs, each server an “edge server” acting as a reverse proxy with a huge cache) serving content from near the user. If you serve HTTP traffic, you should be behind one. Modern CDNs also minify/optimize assets, terminate TLS at the edge, absorb DDoS, and improve availability.

Push vs pull: push CDNs (Akamai NetStorage, BunnyCDN) receive content when you upload it; you own freshness and URLs. Pull CDNs (CloudFront, Cloudflare) fetch from your origin on first request and cache per TTL; first hit is slow, everything after is fast.

Two integration modes, and the trade-off that actually bites:

  • Reverse-proxy CDN (Cloudflare): change your nameservers, CDN intercepts all traffic, zero code changes.
  • Pull CDN via CNAME (CloudFront): keep your nameservers, add cdn.myapp.com → CloudFront, but your app must reference the CDN URLs.

Zero code changes requires giving up your nameservers; keeping them requires touching your asset URLs. Pick your inconvenience.

Load balancers

Distribute requests across servers; skip unhealthy ones; remove the single point of failure; hold session persistence via cookies; terminate SSL. Routing strategies: random, least-loaded, session-sticky, round robin and weighted variants.

The L4/L7 split:

  • Layer 4 routes on transport info (source/dest IP and port), never reads the payload. Fast and dumb: HAProxy in TCP mode, AWS NLB.
  • Layer 7 terminates the connection, reads headers/cookies/content, and routes on meaning: video traffic to video servers, billing traffic to hardened servers. NGINX, AWS ALB, Envoy.

Above both sits GSLB (global server load balancing, e.g. Route 53): traffic across data centers, closest-DC routing, cross-DC failover. The full menu: hardware appliances (enterprise DCs), software (cloud/hybrid), DNS-based (geo routing), cloud-managed (auto-scaling), hybrid stacks.

Proxy vs reverse proxy

Forward proxy: sits in front of clients, acts on their behalf: hides client identity, bypasses or enforces browsing restrictions (the school firewall).

Reverse proxy: sits in front of servers at the network edge: shields origin identity, absorbs DDoS, load balances, caches, terminates SSL, serves static content, compresses. NGINX, Varnish.

Modern serving stacks layer several: CDN edge servers are the first reverse proxy, your provider’s load balancer or API gateway the second, maybe an in-cluster ingress the third.

API gateway

The front door between clients and backend services: authentication, rate limiting, load balancing, protocol translation, service discovery, monitoring/billing, caching, circuit breaking, parameter validation, allow/deny lists, dynamic routing. The pattern: cross-cutting concerns move out of N services into one place.

Service discovery

Consul, etcd, ZooKeeper: registries of names, addresses, and ports so services find each other; health checks (usually an HTTP endpoint) verify integrity; the built-in key-value stores double as config storage. The same machinery underlies leader election, covered in distributed systems.

Bare metal, VMs, containers

  • Bare metal: isolated physical servers; no noisy neighbors, strongest isolation story, least flexible.
  • VMs: hypervisor emulates machines, multiple OS instances per box; cheaper to run and scale.
  • Containers: lightweight standalone application packages sharing the host kernel; the unit Kubernetes orchestrates.

Kubernetes, the 60-second architecture

Open-sourced by Google in 2014 from the internal Borg lineage. Two halves:

  • Control plane: API server (the front door), etcd (distributed KV store holding cluster state), scheduler (assigns pods to nodes), controller manager (reconciliation loops).
  • Worker nodes: kubelet (node daemon talking to the control plane), container runtime (pulls images, runs containers), kube-proxy (routes and load-balances traffic to pods).

EKS/GKE/AKS exist because running this yourself is a full-time job. Cloud native is the umbrella habit: microservices + containers + DevOps

  • open standards (service mesh, metrics, logging) as one operating model.

Deployment strategies

  • Big bang: everything at once; you’d better mean it.
  • Rolling: replace instances gradually.
  • Blue-green: two full production environments; flip traffic when the idle one is verified. Fast rollback, double cost.
  • Canary: 1% of servers, then 10%, then everyone; pair with feature flags for API-level toggles; the natural A/B testing hook.

Observability

The Grafana LGTM stack (Loki logs, Grafana dashboards, Tempo traces, Mimir metrics) is the open-source default that keeps winning. A good end-to-end adoption story: super.money’s path to observability.

Message queues

Receive, hold, deliver: Redis streams, RabbitMQ, Kafka, SQS. The five ways they’ve broken on me over a decade got a full essay instead of a note: A Decade of Message Queues.