Skip to content

Architecture Overview

This document describes the major components of VeliKey Aegis and how they fit together.

Components

  • Axis (control plane): multi-tenant service for organizations, environments, agents, policies, rollouts, and telemetry.
  • Aegis Agent: runs in your infrastructure (Linux hosts and/or Kubernetes) to enforce TLS policy and report telemetry.
  • Management surface:
  • Web console (Axis UI)
  • API (for automation)
  • CLI/SDKs (optional)

Data Flows

Agent enrollment

  1. An admin generates a single-use bootstrap token (often embedded in an install script).
  2. The agent enrolls with Axis using the bootstrap token.
  3. Axis issues a per-agent credential scoped to the tenant and the agent.

Heartbeats and inventory

Agents send periodic heartbeats with status and endpoint metadata so Axis can display health and inventory.

Policy distribution

Axis stores policy configuration centrally. Agents fetch and apply policy updates.

Telemetry

Agents expose a local health/metrics endpoint and push aggregated telemetry to Axis.

Deployment Models

  • You run: Aegis Agents
  • VeliKey runs: Axis control plane
  • Network requirement: agents need outbound HTTPS to the control plane URL.

Self-hosted control plane

  • You run: control plane and agents
  • You own: database, TLS termination/PKI, backups, upgrades, and availability.

Ports and Endpoints (Typical Defaults)

Exact ports are configurable; these are the commonly-used defaults.

  • Axis UI: https://<axis-host>/
  • Axis control plane API: https://<axis-host>:8443/
  • Agent proxy listener: https://<agent-host>:8444/
  • Agent health/metrics:
  • http://<agent-host>:9080/health
  • http://<agent-host>:9080/metrics

Multi-Tenant Isolation

Axis enforces tenant isolation in data access and authorization.

  • User access is scoped to an organization/tenant with RBAC.
  • Agent credentials are tenant-scoped and must not be reusable across tenants.

See Also