> ## Documentation Index
> Fetch the complete documentation index at: https://odigos-cursor-browser-instrumentation-security-2830.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Learn about the architecture of Odigos Central, including the central cluster components, remote cluster proxies, VM agents, and optional Cloud Connectors.

Odigos Central consists of components deployed in a **central (management) cluster**, plus connections to remote platforms: a lightweight proxy in each **remote Kubernetes cluster**, [VM Agent](/central/adding-connections/vmagent) hosts, and optional [Cloud Connectors](/cloud-connectors/overview) for cloud accounts.

```mermaid theme={null}
flowchart TB
    subgraph central [Central Cluster]
        direction TB
        UI[Central UI<br/>Port 3000]
        Backend[Central Backend<br/>Port 8081]
        Redis[Redis<br/>Port 6379]
        Keycloak[Keycloak<br/>Port 8080]
        CC[Cloud Connectors]
        UI --> Backend
        Backend --> Redis
        Backend --> Keycloak
    end

    subgraph remotes [Remote Kubernetes Clusters]
        direction TB
        Proxy[Central Proxy]
        Odigos[Odigos Components]
        Proxy --> Odigos
    end

    subgraph vms [VM Hosts]
        VMA[VM Agent]
    end

    subgraph cloud [Cloud Accounts]
        CloudAcct[AWS / GCP / …]
    end

    Backend <-->|WebSocket| Proxy
    Backend <-->|WebSocket| VMA
    Backend <-->|WebSocket| CC
    CC -->|Cloud APIs| CloudAcct

    central ~~~ remotes
    remotes ~~~ vms
    vms ~~~ cloud
```

When [Cloud Connectors are enabled](/cloud-connectors/enable), the Central cluster also runs the connector-runtime controller, a dedicated PostgreSQL store for connector state, and per-account provider connector workloads (for example AWS, GCP, and other supported providers) that you create from the UI.

## Backend URLs (Helm values)

Several Helm values are named `centralBackendURL`. They are **not interchangeable**.

| Value                            | Chart                              | Who uses it                                          | When to set                                                                                                              |
| -------------------------------- | ---------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `centralProxy.centralBackendURL` | `odigos` (each **remote** cluster) | Central Proxy WebSocket to `/ws/proxy`               | **Required** to connect a remote cluster. See [Connecting Remote Clusters](/central/adding-connections/remote-clusters). |
| `centralUI.centralBackendURL`    | `odigos-central`                   | Central UI → backend HTTP                            | Optional. Default is in-cluster `http://central-backend.<namespace>:8081`.                                               |
| `auth.externalUrl`               | `odigos-central`                   | Browser SSO redirects (Keycloak issuer / proxy URLs) | Set to the **browser-accessible** Central Backend URL (ingress hostname). See [Authentication](/central/authentication). |

`centralProxy.centralBackendURL` is the URL **remote clusters** use to reach Central. `auth.externalUrl` is the URL **browsers** use for SSO. They are often the same public hostname when you terminate TLS on ingress, but they serve different clients.

## Components

| Component                       | Description                                                                                                                                                                                                                |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Central UI**                  | Web interface for managing connected clusters, VM agents, cloud connectors, sources, destinations, and sampling configurations                                                                                             |
| **Central Backend**             | API server that stores configuration in Redis and communicates with remote platforms                                                                                                                                       |
| **Central Proxy**               | Lightweight service deployed in each remote cluster that bridges the central backend to local Odigos components                                                                                                            |
| **Cloud Connectors** (optional) | Provider runtimes in the Central cluster that discover and instrument cloud workloads for one cloud account boundary each (for example an AWS account or GCP project). See [Cloud Connectors](/cloud-connectors/overview). |