Location Research Breakthrough Possible @S-Logix pro@slogix.in

Office Address

Social List

Containerized Microservices Architecture for a Multi-Tenant SaaS Business Management Application

Description

This project focuses on a multi-tenant SaaS business management application where multiple companies can use the same platform while keeping their data and access separate. The application is organized into services such as Billing, Inventory, and Client Reporting. The project focuses on designing a cloud-native architecture to deploy, manage, secure, scale, and monitor these services while ensuring reliable performance and tenant isolation.

Aim

To implement a scalable and secure cloud-native environment for a multi-tenant SaaS application using Docker containers and a self-hosted Kubernetes cluster on Cloud, with secure tenant access, automated scaling, fault recovery, and centralized monitoring.

Objectives

01 Divide the application into separate services such as Billing, Inventory, and Client Reporting.
02 Package each service into lightweight Docker containers.
03 Deploy and manage the containers using a self-hosted Kubernetes cluster.
04 Provide secure user login and tenant-based access using Keycloak.
05 Manage incoming application requests through the Kong API Gateway.
06 Automatically create and manage Cloud infrastructure using OpenTofu.
07 Automate server and Kubernetes configuration using Ansible.
08 Monitor application and cluster performance using Prometheus, Grafana, and Jaeger.

Application Workflow

01

Stage 1 – User Login & Tenant Identification

Process

A business user logs into the SaaS application. The system authenticates the user and identifies the organization they belong to.

Tools
Keycloak Kong PostgreSQL
Implementation

Keycloak authenticates the user and provides the tenant identity. Kong receives the request and routes it to the appropriate microservice. The application uses the tenant ID to access only that tenant's data.

02

Stage 2 – Customer & Product Management

Process

Business users create and manage customers, products, and service information.

Tools
PostgreSQL REST API
Implementation

The Customer and Product microservices receive requests through Kong and store the corresponding tenant-specific records in PostgreSQL.

03

Stage 3 – Order & Sales Management

Process

Users create orders, update order status, and manage sales transactions.

Tools
PostgreSQL REST API
Implementation

The Order microservice validates the tenant and customer information, creates the order, and stores the transaction in PostgreSQL.

04

Stage 4 – Billing & Payment Management

Process

The application generates invoices and maintains payment information.

Tools
PostgreSQL REST API
Implementation

The Billing microservice calculates invoice amounts, stores invoice records, and updates payment status for the appropriate tenant.

05

Stage 5 – Reporting & Business Monitoring

Process

Business users view sales, customer, product, and billing reports.

Tools
PostgreSQL Prometheus Grafana
Implementation

The Reporting microservice retrieves tenant-specific data from PostgreSQL and generates reports. Prometheus collects application and infrastructure metrics, while Grafana displays monitoring dashboards.

06

Stage 6 – Tenant Data Isolation

Process

The system prevents one business from accessing another business's data.

Tools
PostgreSQL Row-Level Security (RLS)
Implementation

Each business record contains a tenant_id. PostgreSQL RLS policies restrict queries so users can access only records belonging to their tenant.

Cloud Infrastructure and Tools

Cloud Compute Cloud EC2

Provides the virtual servers where the Kubernetes cluster runs. The business management microservices are deployed as containers on the Kubernetes worker nodes.

Operating System Ubuntu Server 24.04 LTS

Provides the operating environment for the EC2 servers. Kubernetes, Docker, and the supporting microservices run on these Ubuntu servers.

Cloud Network Cloud VPC

Provides the private network for the SaaS application. It allows the Kubernetes nodes, microservices, and PostgreSQL database to communicate securely.

Cloud Storage Cloud EBS

Provides persistent storage for PostgreSQL. Customer, product, order, and billing data remain available even if a database container is restarted.

Containerization Tool Docker

Packages the Customer, Product, Order, Billing, and Reporting services into separate containers so each service can run independently.

Container Orchestration Tool Kubernetes

Runs and manages the Docker containers. It restarts failed services and allows individual microservices to be scaled when business workload increases.

Database PostgreSQL 14

Stores tenant information, users, customers, products, orders, invoices, and business transactions.

Tenant Data Isolation PostgreSQL Row-Level Security (RLS)

Uses tenant_id to restrict database records. When a business user requests data, PostgreSQL returns only records belonging to that user's tenant.

API Gateway Tool Kong

Acts as the entry point for the SaaS application. For example, an order request from a user enters through Kong and is routed to the Order microservice.

Authentication Tool Keycloak

Authenticates business users during login and provides their identity and tenant information to the application.

Deployment Tool Helm

Deploys the Customer, Product, Order, Billing, and Reporting microservices into the Kubernetes cluster using Kubernetes configuration packages.

Infrastructure as Code Tool OpenTofu

Creates the Cloud infrastructure required for the application, including VPC, subnets, EC2 instances, EBS volumes, and security groups.

Tracing Tool Jaeger

Tracks a request as it moves through different microservices in the SaaS business application and helps identify where delays or failures occur.

Configuration Automation Tool Ansible

Configures the Ubuntu EC2 servers and installs the required Docker and Kubernetes components.

Monitoring Tool Prometheus

Collects metrics from the Kubernetes cluster, microservices, PostgreSQL, and EC2 servers, such as CPU usage, memory usage, service health, and database performance.

Monitoring Dashboard Tool Grafana

Displays the Prometheus metrics in dashboards so administrators can monitor the health and performance of the SaaS application.

Network Security Cloud Security Groups

Controls which network traffic can reach the EC2 servers and other Cloud resources. For example, database access can be restricted to the application layer.

Implementation Process

01
Step 1 – Plan the Application Services
  • Study the existing business application requirements.
  • Divide the application into separate services.
  • Create services for Billing, Inventory, and Client Reporting.
  • Define how these services communicate with each other.
  • Identify the CPU, memory, storage, and other requirements for each service.
02
Step 2 – Create the Cloud Infrastructure
  • Use OpenTofu to create the Cloud VPC and required network components.
  • Create the EC2 Master Node and Worker Nodes.
  • Install Ubuntu Server 24.04 LTS on the EC2 instances.
  • Create and attach EBS storage to the required servers.
  • Configure Security Groups and Network ACLs to control network access.
03
Step 3 – Build the Container and Kubernetes Environment
  • Use Ansible to configure the Ubuntu servers automatically.
  • Install and configure the self-hosted Kubernetes cluster.
  • Create Dockerfiles for the Billing, Inventory, and Client Reporting services.
  • Build Docker images for each service.
  • Use Helm to deploy the Docker containers to Kubernetes.
  • Configure Kubernetes to scale and restart containers when required.
04
Step 4 – Configure Security and Application Access
  • Deploy Keycloak to manage user authentication and tenant access.
  • Configure different users and companies in Keycloak.
  • Deploy Kong API Gateway at the application entry point.
  • Configure Kong to route requests to the correct application services.
  • Configure network and storage access for the Kubernetes workloads.
05
Step 5 – Monitoring and Testing
  • Deploy Prometheus to collect Kubernetes and application metrics.
  • Connect Grafana to Prometheus to create monitoring dashboards.
  • Configure Jaeger to trace requests between application services.
  • Test multiple tenants using the application at the same time.
  • Test service failures and verify that Kubernetes automatically restarts failed containers.
  • Check application performance and stability before production deployment.

Proposed Solution

The proposed solution is a multi-tenant SaaS application running on Docker and a self-hosted Kubernetes cluster on Cloud. The application is divided into separate services such as Billing, Inventory, and Client Reporting. Each service runs in its own Docker container, while Kubernetes manages the containers and provides scaling and automatic recovery. Cloud EC2 provides the servers, Ubuntu provides the operating system, and Cloud VPC provides the private network. Kong manages incoming API requests, while Keycloak handles authentication and tenant access. PostgreSQL stores the application data. OpenTofu and Ansible automate infrastructure and server configuration. Helm manages application deployment, while Prometheus, Grafana, and Jaeger provide monitoring and tracing.

Benefits

Tenant Isolation: Each company's users and data are separated from other companies.
Automatic Recovery: Kubernetes automatically restarts failed containers.
Consistent Deployment: Docker ensures services run with the same environment.
Automated Infrastructure: OpenTofu and Ansible reduce manual configuration work.
Better Monitoring: Prometheus and Grafana provide real-time application and cluster monitoring.
Request Tracking: Jaeger helps identify where problems occur between services.

Challenges

Tenant Data Separation: Ensuring that one company's users cannot access another company's data.
Service Communication: Managing communication between multiple independent services.
Kubernetes Management: Maintaining the self-hosted Kubernetes cluster and its worker nodes.
Monitoring Overhead: Managing the amount of metrics and tracing data generated by the application.
Network Configuration: Correctly configuring communication between users, Kong, Kubernetes services, and internal containers.
← Back to Project Titles