Introduction to restricted cluster operations
Operate AI workloads on Kubernetes or OpenShift within explicit security, dependency, and connectivity boundaries.
Before you start
Module prerequisites: SAI-200, SAI-220. Check the exercise-specific tools and environment before running commands.
Module outcomes: Deploy AI workloads with restricted security controls; Operate storage, networking, and GPU dependencies; Plan controlled updates, backup, and recovery. This lesson contributes to that sequence.
The cluster is one layer of the boundary
Kubernetes and OpenShift provide orchestration capabilities, not automatic sovereignty. A restricted AI platform also depends on identity, admission, network, storage, secrets, registries, models, accelerators, operators, telemetry, backups, and administrative processes.
Operating principles
- Define authoritative internal dependencies before disconnection.
- Use least-privilege workload and administrative identities.
- Enforce workload admission, image identity, security context, and network paths.
- Treat accelerator drivers, operators, firmware, runtimes, and models as one compatibility lifecycle.
- Separate namespaces and tenants according to data and threat needs.
- Plan observable degradation, rollback, backup, rebuild, and restore.
- Record platform and workload change evidence.
Module outcome
You will produce a restricted-boundary and dependency map, workload security baseline, GPU/model/runtime operations plan, disconnected update process, and recovery evidence.
Concepts are portable; executable labs require a separately declared and tested Kubernetes or OpenShift adapter profile.
Module worked example
Inference works in a disconnected cluster, but the internal registry becomes unavailable.
- Apply the control
- Exercise registry and dependency recovery with the declared backup media and operator identities.
- Expected result
- The recovery record shows which services can be rebuilt and how long restoration takes.
- Troubleshooting
- Check artifact, identity, key and storage dependencies; restarting the model pod alone may not restore the platform.
Practice and completion check
Choose one control from this lesson. Identify its actor, target, enforcement point and expected result. Describe an allowed case and a denied or failed case. For a runnable exercise, retain observed output and separate it from expected output. Record unresolved limitations before marking the lesson complete.
Your lesson progress
Completion is self-reported learning progress; it does not certify practical competence.
Status: Not marked
Loading your learning record…