Traffic, APIs, and global entry

Separate global edge traffic, VPC load balancing, Kubernetes routing, and service-to-service communication.

Outside to inside

Route 53 answers DNS. CloudFront can cache and protect global HTTP delivery. AWS WAF filters supported HTTP traffic and AWS Shield helps with DDoS protection. ACM provides certificates for supported endpoints.

The AWS Load Balancer Controller creates:

• Application Load Balancers for Layer 7 HTTP/HTTPS routing.
• Network Load Balancers for high-performance Layer 4 TCP/UDP/TLS patterns.

Gateway API gives role-oriented Kubernetes routing when supported by the chosen controller. Services provide stable discovery inside the cluster.

Inside the platform

Use timeouts, bounded retries with jitter, circuit breaking, idempotency, and graceful degradation. A service mesh can add traffic policy, workload identity, and telemetry, but it also adds proxies, upgrades, latency, cost, and a new failure surface. Adopt one only for a named requirement.

Hybrid and SaaS integration

Use Direct Connect or VPN for designed private hybrid connectivity. Use queues and events to protect slow ERP systems. Use PrivateLink for private service consumption without broad network routing. Never make a user request wait indefinitely for SAP, Salesforce, or Workday.

Feynman check

DNS tells visitors which building. The load balancer chooses a healthy door. The Kubernetes Service finds the right workers. Timeouts stop one slow room from trapping everyone.