Deployment Architecture Overview
This document gives a brief overview of the components that make up a Riptides deployment and where each one runs.
The control plane is hosted and operated by Riptides: see Control Plane for how to connect to it. An on-premises control plane is also available; contact info@riptides.io to discuss your requirements. The daemon and kernel module described below run in your own environment regardless of where the control plane is hosted.
Components
Section titled “Components”Control Plane
Section titled “Control Plane”The control plane is hosted and operated by Riptides. It stores your configuration (WorkloadIdentities, Services, CredentialSources, and more), issues certificates, and distributes policy to daemons. You interact with it through the UI and riptides-cli.
Frontend
Section titled “Frontend”A web-based UI that shows registered workloads and their identities, active connections and mTLS status, and policy configuration and enforcement state.
Daemon
Section titled “Daemon”The daemon is the node-level component that runs on every machine in your workload environment. It connects to the control plane to authenticate the node, receives policy and certificates, loads them into the kernel module, and collects metadata from the host environment (process info, cloud instance metadata, Kubernetes pod context) used to match workloads to identities.
On Kubernetes, the daemon is deployed as a DaemonSet. On bare metal or VMs, it runs as a systemd service or standalone process.
Driver (Kernel Module)
Section titled “Driver (Kernel Module)”The Riptides kernel module provides transparent, in-kernel security for TCP sockets:
- TLS/mTLS termination without application changes
- SPIFFE-based identity enforcement
- Policy-driven access control
- Works with kTLS offload when available, falls back to an in-kernel TLS 1.3 implementation
The daemon loads the driver on startup. See Daemon on Kubernetes and Daemon on Bare Metal for installation details.
Mixed Environments
Section titled “Mixed Environments”Riptides supports mixed environments where some workloads run on Kubernetes and others on bare-metal servers or VMs: all daemons connect to the same control plane regardless of where each workload runs. See Daemon on Kubernetes and Daemon on Bare Metal for per-environment installation steps.
Network Requirements
Section titled “Network Requirements”Workload nodes (Kubernetes or bare metal) must be able to reach the control plane on these endpoints, all over HTTPS/TLS on port 443:
| Source | Destination | Protocol | Purpose |
|---|---|---|---|
| Daemon | <base-hostname> | HTTPS | API communication, certificate issuance |
| Daemon | grpc.<base-hostname> | gRPCS | Information sync and streaming, including real-time policy updates |
| Daemon | tunnel.<base-hostname> | TLS | Telemetry retrieval (pull model) |
The control plane does not initiate connections to daemons. All communication is daemon-initiated, making deployment behind NAT and firewalls straightforward.