Microservices 3

Anand Nerurkar
5 hours ago
7 min read

Section 2 – BFSI Use Case Architectures (Azure Cloud)

Use Case 1: Loan Microservices

1. High-Level Architecture Flow

[Customer App/Web]

Azure Front Door --> Azure API Management (APIM)

Istio Service Mesh on Azure AKS (mTLS, routing, RBAC)

(Microservices on AKS Pods)

Loan Service | KYC Service | Credit Score Service | Fraud Detection Service | Disbursement Service

Azure SQL (Loan DB) | Cosmos DB (KYC DB) | Redis (Cache) | Azure ML (Fraud Model)

Event Hub (Event Sourcing + CQRS) → Synapse Analytics (Reporting & Compliance)

2. Microservices Breakdown

Loan Service (Spring Boot)
- Handles loan applications, approval logic
- DB: Azure SQL Database (transactional ACID)
KYC Service
- Verifies identity via Aadhaar/PAN APIs
- DB: Cosmos DB (flexible JSON schema for customer documents)
Credit Score Service
- Calls bureau APIs; caches responses
- Cache: Azure Cache for Redis (reduce API costs)
Fraud Detection Service
- Consumes loan events, applies ML models (Azure ML)
- Publishes alerts to Event Hub for downstream action
Disbursement Service
- Triggers payout via payment gateways (NPCI, UPI)
- Uses Azure Service Bus for guaranteed delivery

3. Azure Services Mapping

API Gateway: Azure API Management
Service Mesh: Istio on Azure AKS
Event Streaming: Azure Event Hubs (Kafka-compatible)
Cache: Azure Cache for Redis
DBs: Azure SQL (loan), Cosmos DB (KYC), Blob Storage (documents)
ML Integration: Azure ML for fraud detection
Observability: Azure Monitor + Log Analytics + Application Insights
Secrets: Azure Key Vault

4. Step-by-Step Flow (Loan Approval)

Loan Application Submission
- User applies via mobile → Azure Front Door → API Management → routed to Loan Service via Istio.
KYC Verification
- Loan Service publishes KYCRequired event to Event Hub → KYC Service validates (Cosmos DB).
Credit Check
- Credit Service fetches bureau data → caches in Redis → publishes CreditScoreReady event.
Fraud Detection
- Fraud Service consumes loan events → invokes Azure ML model → publishes FraudClear event.
Approval & Disbursement
- Loan Service aggregates events (CQRS pattern) → sends LoanApproved event → Disbursement Service triggers payout via Service Bus → Payment Gateway.
Compliance Logging
- All events stored in Event Hub → replicated to Azure Data Lake (WORM enabled) → Synapse for regulatory reporting.

5. Deployment to Azure

Microservices Packaging: Docker images pushed to Azure Container Registry (ACR)
Orchestration: Deploy on Azure Kubernetes Service (AKS)
Service Mesh: Istio for traffic routing, mTLS, canary rollouts
CI/CD: Azure DevOps pipeline (GitHub → Build → Push to ACR → Deploy to AKS)
Scaling: KEDA for event-driven scaling (scale pods based on Event Hub lag)

6. Compliance Hooks

RBI: Data residency in Azure India regions; immutable event logs in Data Lake
PCI DSS: Payment microservice isolates cardholder data; tokenization via Key Vault
GDPR: Pseudonymize customer data in analytics (Synapse)

Use Case 2: Mutual Fund Microservices

1. High-Level Architecture Flow

[Investor Portal/Mobile App]

Azure Front Door → Azure API Management (Tenant-aware JWT Auth)

Istio Service Mesh on Azure AKS

NAV Service | Portfolio Service | SIP Service | Payment Service | Analytics Service

Azure SQL (NAV) | PostgreSQL (Portfolio) | Redis (Cache) | Event Hub (SIP events)

Azure Data Lake (Audit) → Synapse Analytics (SEBI Reports)

2. Microservices Breakdown

NAV Service
- Publishes NAV daily; time-series data storage (Azure SQL or TimescaleDB on AKS)
Portfolio Service
- Manages investor holdings; supports multiple mutual fund schemes
- DB: Azure Database for PostgreSQL
SIP Service
- Handles recurring investments (Event Hub + Timer triggers)
Payment Service
- Integrates with bank mandates; PCI DSS compliant
Analytics Service
- Aggregates data for dashboards; uses Redis for quick portfolio views

3. Azure Services Mapping

API Gateway: Azure API Management with tenant filters (ICICI vs HDFC)
Cache: Azure Cache for Redis for NAV and portfolio snapshots
Event Streaming: Azure Event Hub for SIP triggers
Data Storage: Azure SQL (NAV), PostgreSQL (Portfolio), Blob (KYC docs)
Analytics: Synapse Analytics + Power BI for investor dashboards
Security: Key Vault + Azure AD B2C for auth

4. Step-by-Step Flow (SIP Execution)

SIP Setup
- Investor registers SIP → API Gateway → SIP Service stores details in PostgreSQL.
Monthly Execution
- Azure Function/Timer triggers SIP debit → event published to Event Hub.
NAV Calculation
- NAV Service updates latest NAV daily (Azure SQL) → cached in Redis.
Portfolio Update
- Portfolio Service consumes events, updates holdings → triggers Analytics Service.
Audit/Compliance
- All SIP/NAV events stored in Event Hub → exported to Data Lake → Synapse for SEBI reporting.

5. Deployment to Azure

Microservices: Packaged in Docker, deployed on AKS with Istio
SIP Scheduler: Azure Functions (Timer Trigger) + Event Hub
CI/CD: Azure DevOps pipelines with staged environments (Dev → UAT → Prod)
Observability: Application Insights + Log Analytics

6. Compliance Hooks

SEBI: 7-year NAV data retention in WORM-enabled Data Lake
Multi-Tenancy: Isolate portfolios using separate PostgreSQL schemas or Cosmos DB partitions
Data Masking: Implement at API Management level for PII protection

Use Case 3: Digital Wallet Microservices

1. High-Level Architecture Flow

[Wallet Mobile App]

Azure Front Door → API Management (APIM)

Istio Service Mesh on AKS

Wallet Service | Transaction Service | Fraud Service | Notification Service

Azure SQL (Wallet DB) | Redis (Balance Cache) | Event Hub (Transaction Stream) | Azure ML (Fraud Model)

Azure Data Lake (Audit) → Synapse (RBI Compliance Reports)

2. Microservices Breakdown

Wallet Service
- Manages user balances, top-ups, and withdrawals
Transaction Service
- Event-sourced ledger (Kafka-compatible Event Hub)
Fraud Detection Service
- Kafka Streams + Azure ML model for real-time anomaly detection
Notification Service
- Sends SMS/email via Azure Communication Services or SendGrid

3. Azure Services Mapping

Gateway: API Management + Front Door for global routing
Event Bus: Azure Event Hub (Kafka API for Spring Boot apps)
Cache: Azure Cache for Redis for balance reads
Database: Azure SQL for wallet balance, Cosmos DB for transaction metadata
Fraud Analysis: Azure ML pipelines + Logic Apps for manual review workflows

4. Step-by-Step Flow (Top-Up + Payment)

Top-Up Initiation
- User adds funds via UPI → Payment Service triggers API → updates Wallet DB (Azure SQL).
Cache Update
- Redis cache updated immediately for faster balance retrieval.
Transaction Event
- Transaction Service writes immutable ledger events to Event Hub.
Fraud Monitoring
- Fraud Service consumes events from Event Hub → runs ML checks → triggers alerts via Logic App if suspicious.
Notification
- Notification Service sends SMS/email confirmations via Azure Communication Services.
Audit
- All events archived to Data Lake (immutable) → Synapse for RBI reporting.

5. Deployment to Azure

Microservices: Docker → ACR → AKS with Istio (mTLS + traffic shaping)
CI/CD: Azure DevOps with YAML pipelines; Blue-Green deployments for wallet updates
Autoscaling: KEDA based on Event Hub lag or Redis queue length

6. Compliance Hooks

RBI: Daily transaction reconciliation; event retention for 10 years in Data Lake
PCI DSS: Encrypt payment card details; store only tokens in DB
Data Residency: Deploy all services in Azure India Central/South

DevSecOps Pipeline – Azure BFSI Microservices

1. High-Level Text Flow

[Developer Commit → GitHub]

Azure DevOps CI Pipeline

- Code Build (Maven/Gradle)

- Unit Tests

- SAST (SonarQube, Azure DevOps Security)

- Dependency Scans (OWASP, Snyk)

Docker Build & Push → Azure Container Registry (ACR)

Azure DevOps CD Pipeline

- Helm Deploy to AKS

- Istio Canary Routing (20/80 rollout)

- DAST (OWASP ZAP) + Pen Tests

- Compliance Checks (Azure Policy)

[AKS + Istio Production Environment]

Observability: Azure Monitor, Log Analytics, App Insights

2. Step-by-Step DevSecOps Flow

Step 1 – Code Commit & Trigger

Developer pushes code to GitHub (e.g., loan-service microservice).
GitHub webhook triggers Azure DevOps CI pipeline.

Step 2 – Continuous Integration (CI)

Checkout Code (GitHub → Azure DevOps)
Build Stage: Use Maven/Gradle for Spring Boot microservices.
Static Code Analysis:
- SonarQube: Code smells, coverage, maintainability.
- Azure DevOps Security: SAST (CWE, OWASP Top 10).
Dependency Scanning:
- OWASP Dependency Check/Snyk: Check for vulnerable libraries.
Unit & Integration Tests:
- Run JUnit + Testcontainers for DB/Kafka integration tests.

Step 3 – Containerization & Image Scan

Build Docker image:docker build -t acr.azurecr.io/loan-service:v1 .
Push image to Azure Container Registry (ACR).
Scan image using Microsoft Defender for Containers or Trivy.

Step 4 – Continuous Delivery (CD)

Helm Chart Deployment to AKS:
- Helm charts include Istio VirtualService + DestinationRule for routing.
Canary Deployment with Istio:
- Start 20% traffic to new version; monitor KPIs (error rate, latency).
- Gradually shift to 100% if healthy.

Step 5 – Security & Compliance Gates

DAST: Run OWASP ZAP or Burp scans post-deployment on staging.
Azure Policy: Validate container images from ACR only; enforce TLS 1.2+.
Key Vault Integration: Ensure secrets are not in code.
Audit Logs: Push to Azure Monitor + Log Analytics for RBI/SEBI compliance.

Step 6 – Observability & Feedback Loop

Azure Monitor: Metrics (CPU, memory, request rate).
Log Analytics: Query errors across microservices.
Application Insights: Distributed tracing for debugging loan/SIP flows.
Alert Rules: SLA breaches (e.g., loan disbursement > 5 mins) trigger Teams/Email alerts.

3. Example: Azure DevOps Pipeline YAML

trigger:

branches:

include:

- main

stages:

- stage: Build

jobs:

- job: BuildAndScan

steps:

- checkout: self

- task: Maven@3

inputs:

goals: 'clean install'

- task: SonarQubePrepare@4

inputs:

SonarQube: 'SonarQubeServiceConnection'

scannerMode: 'CLI'

- task: SonarQubeAnalyze@4

- task: Docker@2

inputs:

containerRegistry: 'ACRServiceConnection'

repository: 'loan-service'

command: 'buildAndPush'

Dockerfile: '**/Dockerfile'

tags: '$(Build.BuildId)'

- stage: Deploy

jobs:

- deployment: DeployToAKS

environment: production

strategy:

canary:

increments: [20, 50, 100]

steps:

- task: HelmInstaller@1

inputs:

helmVersionToInstall: 'latest'

- task: HelmDeploy@0

inputs:

connectionType: 'Azure Resource Manager'

azureSubscription: 'AzureSubscriptionConnection'

azureResourceGroup: 'RG-BFSI'

kubernetesCluster: 'AKS-BFSI'

namespace: 'loan'

command: 'upgrade'

chartType: 'FilePath'

chartPath: 'helm/loan-service'

releaseName: 'loan-service'

4. BFSI-Specific Security Add-Ons

PCI DSS: Validate no sensitive cardholder data leaves AKS; tokenization in Key Vault.
RBI: Geo-fence workloads to Azure India Central/South regions.
SEBI: SIP transaction logs → Event Hub → Data Lake with WORM lock.
Multi-Tenant: API Management policy enforces tenant isolation for mutual funds (ICICI/HDFC).

5. Deployment Across Use Cases

Loan

Canary deployments for fraud detection ML updates (reduce false positives).

Mutual Fund

Blue/green deployments for NAV service updates (critical for end-of-day NAV publishing).

Wallet

Rolling updates with Istio traffic shifting (ensure wallet balances remain consistent).

6. Integrated Flow Diagram (Text Version)

[GitHub Commit]

Azure DevOps (CI)

| Build → Test → SAST → Dependency Scan

Azure Container Registry (ACR)

Azure DevOps (CD)

| Helm Deploy → Istio Canary → DAST → Policy Check

Azure Kubernetes Service (AKS) + Istio Mesh

Azure Monitor + App Insights → Alerts → Teams/Email

Section 2 – BFSI Use Case Architectures (Azure Cloud)

Use Case 1: Loan Microservices

1. High-Level Architecture Flow

2. Microservices Breakdown

3. Azure Services Mapping

4. Step-by-Step Flow (Loan Approval)

5. Deployment to Azure

6. Compliance Hooks

Use Case 2: Mutual Fund Microservices

1. High-Level Architecture Flow

2. Microservices Breakdown

3. Azure Services Mapping

4. Step-by-Step Flow (SIP Execution)

5. Deployment to Azure

6. Compliance Hooks

Use Case 3: Digital Wallet Microservices

1. High-Level Architecture Flow

2. Microservices Breakdown

3. Azure Services Mapping

4. Step-by-Step Flow (Top-Up + Payment)

5. Deployment to Azure

6. Compliance Hooks

DevSecOps Pipeline – Azure BFSI Microservices

1. High-Level Text Flow

2. Step-by-Step DevSecOps Flow

Step 1 – Code Commit & Trigger

Step 2 – Continuous Integration (CI)

Step 3 – Containerization & Image Scan

Step 4 – Continuous Delivery (CD)

Step 5 – Security & Compliance Gates

Step 6 – Observability & Feedback Loop

3. Example: Azure DevOps Pipeline YAML

4. BFSI-Specific Security Add-Ons

5. Deployment Across Use Cases

Loan

Mutual Fund

Wallet

6. Integrated Flow Diagram (Text Version)

Comments