<ol>
<li>Does traefik / traefik mesh can handle multi regional arquitecture to solve request to the right user region?</li>
<li>Any other self hosted solution recomendation?</li>
</ol>
<p><strong>Rules:</strong></p>
<ul>
<li>Each region is independent and one region downtime does'nt affect other region</li>
<li>User authentication metadata is replicated across all regions</li>
<li>Requests with an authentication token can enter the network from any region and be verified</li>
<li>The default entry point for authentication request is usa-region-1</li>
<li>The ingress controller / service mesh determines who the user is and in which region their account is hosted</li>
<li>The authentication service add &quot;user_region&quot; headers to the request and &quot;precedence_region&quot; to prevent internal loop</li>
<li>Detects that destionation region is not current region and proxies the request to the correct region with extra headers added</li>
</ul>
<p><strong>Diagram:</strong></p>
<pre><code>                                   ┌───────────────────────────────────────────────┐
                                   │                                               │
                                   │ usa-region-1                                  │
                                   │                                  ┌───►/app-1/*│
                                   │                                  │            │
                               ┌───┼──► Load  ──────► ┌── Ingress ────┤            │
                               │   │   Balancer       │ Controller    ├───►/app-2/*│
                               │   │                  │     │         │            │
                               │   │                  │     │         │            │
                               │   │                  │     │         └───►/app-3/*│
                               │   │                  │     │                      │
                               │   │                  │     │                      │
                               │   │                  │     └─Authentication       │
 User──────► Cloudflare ──────►│   │                  │          Service           │
Request                        │   │                  │                            │
                               │   └──────────────────┼────────────────────────────┘
                               │                      │ *proxie the request*
                               │   ┌──────────────────┼────────────────────────────┐
                               │   │                  │                            │
                               │   │ europe-region-1  │                            │
                               │   │                  │               ┌───►/app-1/*│
                               │   │                  │               │            │
                               └───┼──► Load ───────► └── Ingress ────┤            │
                                   │   Balancer         Controller    ├───►/app-2/*│
                                   │                        │         │            │
                                   │                        │         │            │
                                   │                        │         └───►/app-3/*│
                                   │                        │                      │
                                   │                        │                      │
                                   │                        └─Authentication       │
                                   │                             Service           │
                                   │                                               │
                                   └───────────────────────────────────────────────┘
</code></pre>

<p><strong>LOCAL DATA STORAGE REQUIREMENT</strong></p>
<p>In some markets, there could be regulatory reasons for keeping a user's data stored within their home region. So if a European user has travelled to the USA, they should continue to be routed to European servers, and their data will remain in Europe.</p>
<p><strong>SIMPLE ROUTING BASED ON HEADERS</strong></p>
<p>First you need something in each HTTP request, such as the <code>user_region</code> header that you mention. The ingress controller is the logical place to do this, rather than for each service. Here is a <a href="https://gist.github.com/jirikuncar/6ed34b2bceeba2f3d7fc93ed5539bd3c" rel="nofollow noreferrer">Traefik header based routing example</a>.</p>
<p><strong>ROUTING IN INGRESS CONTROLLERS</strong></p>
<p>If you need more complex logic, then a plugin can be written, using either the extensibility features of the ingress controller, or a dedicated API gateway placed in front of APIs. For an example see <a href="https://github.com/curityio/dynamic-user-routing/blob/main/reverse-proxy/nginx/nginx.conf" rel="nofollow noreferrer">this NGINX configuration file</a>, which sets the target host name based on <a href="https://github.com/curityio/dynamic-user-routing/blob/main/reverse-proxy/nginx/zonetransfer.lua" rel="nofollow noreferrer">this Lua plugin</a>.</p>
<p><strong>FURTHER INFO</strong></p>
<p>These links may also be of interest. In particular note how <a href="https://curity.io/resources/learn/dynamic-user-routing/#associating-users-to-regions" rel="nofollow noreferrer">unauthenticated requests</a> can be handled, by identifying the user first, then transferring the user to their home region so that authentication takes place there. This can allow credentials for users to only be stored in their home region.</p>
<ul>
<li><a href="https://curity.io/resources/learn/dynamic-user-routing/" rel="nofollow noreferrer">Dynamic User Routing</a></li>
<li><a href="https://curity.io/resources/learn/integrating-plugins-with-kubernetes-ingress/" rel="nofollow noreferrer">Implementing Plugins in Ingress Controllers</a></li>
</ul>
