Cloud Architecture: Front-End & Back-End | Draftsbook

Lesson Focus & Objectives

Cloud computing systems are fundamentally loosely coupled, highly distributed architectures. Unlike monolithic enterprise mainframes where user interfaces and database storage run on the same chassis, cloud environments cleanly partition the user-facing Front-End from the scalable Back-End through decoupled network gateways. In Part 3, we analyze the architectural anatomy of modern cloud platforms, dissecting ingress gateways, central management orchestration nodes, compute runtime engines, and persistent storage fabrics.

1. The Loosely Coupled Cloud Paradigm

At the architectural level, a cloud computing environment is divided into two primary sub-systems connected via an asynchronous or HTTP-based transport network (typically the public Internet or a software-defined WAN):

The Front-End System

The client-facing boundary through which users interact with cloud services. Includes client software, user interfaces, browser Single Page Applications (Next.js/React), mobile native apps (iOS/Android), and terminal CLIs interacting over standard HTTP/3, WebSocket, or gRPC endpoints.

• Web Browsers (Chrome, Firefox, Safari)
• Mobile Operating Systems & Hybrid Apps
• Enterprise CLI Tools & SDKs (AWS CLI, kubectl)
• Thin Clients & Virtual Desktop (VDI) Receivers

The Back-End System

The core cloud data center infrastructure providing computing power, storage capacity, operating virtual machines, services, security mechanisms, and traffic orchestration.

• Central Management Server & Provisioning Engine
• Compute Hypervisors & Container Clusters (Kubelet, KVM)
• Distributed Storage Fabrics (Ceph, EBS, S3 Object Store)
• Traffic Load Balancers & Ingress Gateways

2. Ingress & The API Gateway Decoupling Layer

The bridge connecting the Front-End to the Back-End is the Cloud API Gateway (e.g., Kong, Envoy Proxy, AWS API Gateway). The gateway serves as the single point of entry, terminating external client TLS connections and handling cross-cutting operational concerns:

Token Verification & Authentication: Validates JWT bearer tokens and OIDC session cookies before admitting requests into internal virtual networks.
Rate Limiting & DDoS Throttling: Implements token-bucket algorithms to protect backend microservices from traffic surges.
Protocol Translation: Translates incoming HTTP/1.1 or HTTP/2 JSON REST calls into high-performance internal binary gRPC calls traversing service mesh sidecars.
Dynamic Request Routing: Resolves path patterns (/api/v1/auth, /api/v1/courses) to internal Kubernetes ClusterIP service endpoints.

3. Back-End Architectural Subsystems

1. Central Management Server

The brain of the cloud operating system (e.g., OpenStack Nova/Neutron, Kubernetes control plane). Monitors cluster health, schedules worker pods across physical compute racks, balances traffic loads, and executes provisioning API calls.

2. Compute & Virtualization Runtime

The physical servers running Type-1 hypervisors (KVM, Xen) or lightweight container runtimes (containerd, runc). Allocates isolated CPU cores, virtual RAM pages, and network interfaces to tenant workloads.

3. Storage & Persistence Tier

Stores virtual machine disk images, application binaries, and user data across clustered redundant storage nodes. Employs erasure coding and multi-zone replication to ensure eleven-nines (99.999999999%) data durability.

4. Internal Software-Defined Network (SDN)

Creates isolated virtual private clouds (VPCs) using VXLAN overlay encapsulation. Prevents packet snooping between competing tenants sharing identical physical top-of-rack (ToR) network switches.