AI & Data Science Workbench as a Service

Secure self-service for namespaces

Users should be able to provision namespaces but should not have access to resources outside of their namespaces

Infrastructure as Code (IaC) support

Support for TF or GitOps first approaches, including private Git repos, that accelerate infrastructure deployment

Resource quotas for teams & applications

Define quotas to prevent noisy neighbor issues so total namespace resource requests do not exceed the configured limits

Management of namespace compliance

Easily manage compliance of pre-existing namespaces in the same manner (i.e. same guardrails) as new namespaces

Integrate with continuous delivery

Work with CD tools like Argo, enforcing guardrails (e.g. quotas, network policies) on namespaces created out of band

Centralized visibility into namespaces

Use cross account and cross cloud visibility to manage complex multi-cloud environments across teams, geos, and domains

Streamlined disaster recovery

Leverage one step workflows to quickly and safely restore data from backups during disaster recovery events

Flexible interfaces

Ability to consume the platform through the preferred interface: UI, Backstage, GitOps or CMDBs (e.g. ServiceNow)

Simple, streamlined process for requesting compute

No time consuming ticket driven process where the Platform team has to manually provision namespaces

Visualization of namespace resources

View into “what resources” are violating policies so that it is easy to remediate and course correct (for future actions)

Streamlined experience for kubectl access

To help with scenarios such as:

• Application right sizing exercises
• Requesting platform team for additional compute

Repository of approved applications

Integrated, low touch experience for installing applications that have been scanned for vulnerabilities etc.

Network policies for namespace isolation

Enforce network policies so that namespaces belonging to different teams cannot communicate with each other

Just in Time (JIT) user identity driven access

Implement RBAC at scale with your Identity Provider, without implementing expensive solutions (bastion, VPN, etc.) so users access only their namespaces.

Centralized kubectl access audits

Centralized visibility into user actvities + ability to export audits to an external system (e.g. Splunk, Datadog)

Chargeback and showback

Collect cluster utilization metrics for chargeback / showback models, including sharing costs across tenants for unallocated resources and common services

Identify underutilized namespaces

Collect of Granular utilization metrics from namespaces to show usage by CPU, Memory

Centralized policy enforcement

Enforce policies for security, reliability and operational efficiency, with centralized visibility into policy violations

Compliance benchmarks

Run periodic scans against benchmarks (CIS, NSA hardening recommendations etc.) and centrally aggregate the benchmark reports

SaaS based

The default option – providing maximum efficiency and reliability for mature and growing customers

Self-hosted

A self-hosted, airgapped option may be necessary for highly regulated industries

Multi-tenant

“Namespace as a service” across multiple teams, with isolation and tight access controls