Operate restricted AI workloads with controlled networking, storage, GPU access, security contexts, updates, backup, and recovery.
Learning outcomes
Curriculum
The chapters are individually addressable documentation pages. You can link directly to a concept from another program, architecture decision, or implementation guide.
Define the deployment boundary, platform dependencies, and controlled artifact path.
Operate AI workloads on Kubernetes or OpenShift within explicit security, dependency, and connectivity boundaries.
Compare public cloud, private cloud, on-premises, hybrid, edge, restricted-network, and air-gapped patterns without treating one as automatically sovereign.
Inventory the data, models, prompts, artifacts, identities, tools, interfaces, infrastructure, and evidence that require protection.
Identify software, models, data, prompts, policy, and configuration with verifiable origin and lineage.
Control workload placement, communication, storage, identity, secrets, administration, and accelerators.
Design namespace, admission, network, storage, secret, identity, and administrative controls.
Control accelerator dependencies, scheduling, isolation, health, model storage, and serving runtime changes.
Operate capacity, updates, backup, rollback, and recovery using internal dependencies.
Promote platform updates through internal channels and test workload, configuration, data, and evidence recovery.
Define capacity envelopes, degradation behavior, service objectives, recovery targets, and tested restoration evidence.
Design signals that explain service health, AI behavior, policy outcomes, change, and incidents without leaking sensitive content.
Version complete AI behavior, assess change impact, approve promotion, support rollback, and retire superseded assets.
Record design choices and retain evidence of controlled operation.
Record context, options, control consequences, evidence, dependencies, limitations, and reversal triggers for material decisions.
Design evidence alongside controls so important decisions, releases, configurations, and operating events can be verified.
Complete a restricted operations exercise and validate the runbook.
Design, deploy, update, and recover a restricted AI workload using an approved lab profile.
Verify cluster boundaries, workload security, GPU operations, disconnected updates, backup, recovery, and evidence.
Plan and validate restricted workload controls, disconnected updates, and recovery.
Design exercise; executable implementation pending
This curriculum is platform-neutral at the conceptual layer. Labs require a declared Kubernetes or OpenShift profile with tested cluster, operator, accelerator, storage, and runtime versions; no production cluster changes are authorized by this material.