A short path from code to production
DeploymentsTLS & DNSCost
Kubernetes standardized the primitives. Nobody standardized the platform.
Compose it from shared capabilities. Run it in your own account.
Provision new clusters or register the ones you already run; deploy applications and add capabilities as your blueprint grows. Governance is built in — approvals, audit trails, rollback.
start with a cluster you already run
$ astroctl infra k8s register --cluster-name my-clusterv1.35.0 · 1 node group · 1 node · 4 apps
Total over last 24 hours
22 / 24 measured hours
CPU 9% · Memory 65.1%
by vulnerability scanning
Figures reported by the platform for this cluster.
how it works
Both end up in the same control plane. The only difference is which side opens the connection — and for a cluster you already run, it is yours.
Start with a cluster the platform provisions into your own cloud account.
Start with a cluster the platform provisions into your own cloud account.
You connect the account once. The platform reaches in on dynamic credentials, not a stored key.
Or start with a cluster you already run — in a datacentre, or on a laptop.
There an agent opens an outbound tunnel instead, and the cluster reaches out. Its API server is never exposed.
Either way one control plane holds the desired state, and runs both pipelines over all of them.
production kubernetes
Three availability zones for zonal fault tolerance, workers in private subnets, and a network you already own or one generated inside your account.
Three public subnets carry the gateways and NATs; three private subnets hold the workers. Node groups default to three, one per zone.
The cluster is created inside your own cloud account. There is no AstroPulse account in the path, and revoking access leaves the cluster where it is.
Point a cluster at a network you already run, or have the CLI generate the CloudFormation for one — created in your account either way.
Cloud access is dynamic rather than a stored key, and a kubeconfig is issued with an expiry attached.
add-ons
Reachable, trusted, elastic, measurable. Each one is an add-on the platform installs, upgrades and keeps healthy.
reachable
without it
Nothing resolves its hostname or routes a request inward.
NGINX Ingress Controller
Routes external HTTP and HTTPS traffic to your applications.
ExternalDNS
Publishes DNS records using the cluster's own cloud access.
trusted
without it
Nothing terminates TLS, and nobody is looking at what the images contain.
Certificate Manager
Issues and renews TLS certificates automatically.
Vulnerability Scanning
Continuously scans the images of running workloads for known CVEs.
elastic
without it
Capacity is whatever you guessed at, in both directions.
KarpenterAWS
Just-in-time node autoscaling.
Workload Autoscaling
KEDA. Scales replicas on real demand — queue depth, request rate, a schedule — and to zero when idle.
measurable
without it
Spend is a monthly surprise with no owner.
Cost Visibility
Usage and cost for every namespace and application on the cluster.
operable
The same verbs reach a cluster, an add-on and an application. An add-on has its own history, its own rollback and its own cost line.
| you can | Cluster | Add-on | Application |
|---|---|---|---|
| apply | yes | yes | yes |
One declarative verb, whatever you are creating. | |||
| status | progress | yes | yes |
| logs | — | yes | yes |
| events | progress stream | yes | yes |
| history | progress history | yes | yes |
| upgrade | yes | versions + apply | apply |
| rollback | yes | yes | yes |
| metrics | yes | yes | yes |
| cost | yes | yes | yes |
| vulnerabilities | yes | filtered by default | yes |
| scale | yes | — | via tier |
cost & security
Two add-ons, installed once per cluster. Both report against what is actually running.
Spend per cluster and per application, next to the capacity paid for and requested by nothing. Missing hours are shown as missing — never as $0.
Findings grouped by image, because the image is the thing you upgrade. A workload nobody scanned is shown as unscanned — never as clean.
Reserved capacity is the whole track. What workloads actually used is a third of it.
Reserved capacity is the whole track. What workloads actually used is a third of it.
The rest was paid for and requested by nothing. Idle is drawn as a segment, not as empty track.
Coverage travels with the figure, so a partial day cannot read as a cheap one. Missing hours stay missing, never $0.
Findings group by image, because the image is the thing you upgrade.
And a workload nobody scanned is listed as unscanned. Never as clean.
compose
Choose the capabilities you need. What sits underneath them is not a choice.
choose your bricks
0 of 14
Clusters
Applications
Where it runs
what you have built
A cluster you already run joins by deploying an agent — on-prem, or a laptop. Nothing is recreated.
AI infrastructure is one of the things these parts build today. Node groups can be GPU, model servers deploy as ordinary applications, ingress and TLS sit in front of them, and GPU hours are priced as GPU hours. You assemble it; the platform runs and governs it.
your domain
Verify a domain once, then any image application in your organization can be served on it. The hostname is reserved and its ingress configured; your DNS zone stays yours.
Claim a domain your organization controls. One command, the console, or ask Nova.
Claim a domain your organization controls. One command, the console, or ask Nova.
The platform returns a TXT record to publish. One time, per domain.
You publish it at your own DNS provider. Verifying proves ownership; it does not grant access to your zone.
Deploy an image application on it. The hostname is reserved to your organization and its ingress is configured to answer for it.
where it runs
Clusters connect out, never in. The agent opens the connection; nothing opens one toward you.
Every customer creates a different blueprint
Teams compose the blueprint. Nova works across its entire lifecycle through Astro Platform's governed runtime.
A short path from code to production
Private infrastructure with governed change
Inference or training with workload-specific automation
All Nova actions pass through this trust layer.
A standard runtime and trust layer under the platform you compose. Nova operates through it for deeper context and safer execution.
Read: Kubernetes standardized the primitives. Nobody standardized the platform.