ModulesSAI-270
SAI-270 table of contents
Kubernetes and OpenShift Operations
Operate restricted AI workloads with controlled networking, storage, GPU access, security contexts, updates, backup, and recovery.
Learning outcomes
What you should be able to do
- Deploy AI workloads with restricted security controls
- Operate storage, networking, and GPU dependencies
- Plan controlled updates, backup, and recovery
Curriculum
Work through 5 sections in order.
The chapters are individually addressable documentation pages. You can link directly to a concept from another program, architecture decision, or implementation guide.
Restricted-platform foundations
Define the deployment boundary, platform dependencies, and controlled artifact path.
Introduction to restricted cluster operations
Operate AI workloads on Kubernetes or OpenShift within explicit security, dependency, and connectivity boundaries.
Deployment boundaries and patterns
Compare public cloud, private cloud, on-premises, hybrid, edge, restricted-network, and air-gapped patterns without treating one as automatically sovereign.
AI assets and attack surfaces
Inventory the data, models, prompts, artifacts, identities, tools, interfaces, infrastructure, and evidence that require protection.
Artifact identity and provenance
Identify software, models, data, prompts, policy, and configuration with verifiable origin and lineage.
Platform and workload controls
Control workload placement, communication, storage, identity, secrets, administration, and accelerators.
Workload security, network, storage, and identity
Design namespace, admission, network, storage, secret, identity, and administrative controls.
GPU, model, and runtime operations
Control accelerator dependencies, scheduling, isolation, health, model storage, and serving runtime changes.
Reliability and disconnected lifecycle
Operate capacity, updates, backup, rollback, and recovery using internal dependencies.
Disconnected updates, backup, and recovery
Promote platform updates through internal channels and test workload, configuration, data, and evidence recovery.
Capacity, reliability, and recovery
Define capacity envelopes, degradation behavior, service objectives, recovery targets, and tested restoration evidence.
Observability and operational evidence
Design signals that explain service health, AI behavior, policy outcomes, change, and incidents without leaking sensitive content.
Controlled change and versioning
Version complete AI behavior, assess change impact, approve promotion, support rollback, and retire superseded assets.
Decisions and evidence
Record design choices and retain evidence of controlled operation.
Architecture decision records
Record context, options, control consequences, evidence, dependencies, limitations, and reversal triggers for material decisions.
Evidence by design
Design evidence alongside controls so important decisions, releases, configurations, and operating events can be verified.
Apply and assess
Complete a restricted operations exercise and validate the runbook.
Restricted cluster operations workshop
Design, deploy, update, and recover a restricted AI workload using an approved lab profile.
SAI-270 knowledge check
Verify cluster boundaries, workload security, GPU operations, disconnected updates, backup, recovery, and evidence.
Practical completion package
- Restricted cluster boundary and dependency map
- Workload security and identity baseline
- GPU and model-runtime operations plan
- Disconnected update and rollback runbook
- Backup, restore, and recovery evidence
Current release boundary
This curriculum is platform-neutral at the conceptual layer. Labs require a declared Kubernetes or OpenShift profile with tested cluster, operator, accelerator, storage, and runtime versions; no production cluster changes are authorized by this material.