Skip to content
TAIP

Products / For AI builders

ConsoleX

Available

Log in, get a governed Kubernetes workspace. No kubectl, no tickets.

ConsoleX gives every user on a shared Kubernetes cluster a curated, web-based workspace: a private namespace, a ResourceQuota, a default-deny NetworkPolicy, and full self-service over their own workloads, storage, configuration, and networking. Quota templates propagate live, and a dual reconciliation loop — event-driven watches plus periodic full sync — repairs any drift within seconds. It has also become the platform's shared front door: it mints the taip_ tokens every other TAIP app introspects, runs the one SSH gateway that reaches ConsoleX terminals, DevSpace environments, and TrainX job pods alike, ships the taip CLI straight out of the cluster so an air-gapped site carries its own tooling, and draws pod, workload, and namespace dashboards from Prometheus without sending anyone to Grafana. Power users graduate to kubectl with a generated per-user OIDC kubeconfig.

All products

Specification

Version
v1.7.8 — generally available
Surface
Pods · Deployments · Jobs · CronJobs · PVCs · Services · HTTPRoutes · ConfigMaps · NetworkPolicies · YAML
Identity
OIDC SSO · MFA status · back-channel logout · per-user kubeconfig
Tokens
Platform token authority — taip_ tokens, <app>:<action> scopes, introspection for sibling apps
SSH
Platform gateway — terminals, DevSpace environments, TrainX job pods · scp / sftp · port forwarding
CLI
taip core + taip-<name> plugins · served from the cluster · macOS · Linux · Windows
Metrics
Native Prometheus dashboards — pod, workload, namespace. Grafana optional
Reconcile
Event-driven watches + periodic full sync — drift repaired in seconds
Scheduling
Kueue queues · hold / resume / cancel · GPU-hours & cost per namespace
Languages
English · 简体中文 (UI and docs)

Proof, not promises

See it in one block.

No proprietary SDKs, no rewrites — ConsoleX meets your tools where they already are.

first login, fully provisioned 
# alice signs in with SSO — ConsoleX provisions her workspace
namespace      cx-alice                          created
resourcequota  gpu-small (8 CPU · 32Gi · 1 GPU)  applied
networkpolicy  default-deny                      enforced
rolebinding    alice → admin of cx-alice         granted
# drift is repaired within seconds — watches + periodic sync▌

No manual provisioning, no custom RBAC. Admins define a quota template once; ConsoleX enforces it forever.

Capabilities

What ConsoleX gives you

01

Per-user workspace, automatically

On first OIDC login, ConsoleX creates a namespace, applies a quota template, and grants the user admin of their own namespace — no manual provisioning, no tickets, no custom RBAC.

02

Run workloads from the browser

List, create, scale, restart, and debug Pods, Deployments, StatefulSets, Jobs, and CronJobs. Stream logs. Open an in-browser shell. Drag whole folders into a PVC and drag files back out. Read CPU, memory, GPU, network, and disk dashboards rendered from Prometheus in the page you are already on. Reach in-pod web UIs through a transparent HTTP proxy — no Service, no port-forward.

03

Quotas that hold

Quota templates propagate live to every linked workspace. Event-driven watches plus a periodic full sync repair drift in ResourceQuotas and NetworkPolicies within seconds — even after accidental deletion.

04

One token, every app

ConsoleX is the platform's token authority. It issues taip_ tokens with coarse <app>:<action> scopes, and sibling apps — DevSpace, TrainX, GrokX — resolve them by introspection instead of keeping their own user tables. Revoke a token once and it stops working everywhere within the cache window. An outage answers 503, never 401: nobody fails open.

05

One SSH gateway, one CLI

ssh user+env=notebook@gateway reaches a DevSpace environment, +term= a ConsoleX terminal, +job= a TrainX job pod — one bastion, one key list, authorized exactly like the web session. Plain scp and sftp work, ssh -L forwards ports, and VS Code Remote-SSH rides the same path. The taip CLI (login, pvc, cp, and taip-<name> plugins) is served by the cluster itself, so a disconnected site ships its own tooling for macOS, Linux, and Windows.

06

Built to integrate

OIDC SSO with back-channel logout. Namespace sharing for collaboration. A Profile page showing your groups, sessions, enrolled MFA factors, SSH keys, and your own audit trail. Add or remove an SSH key and it syncs to the directory, so Slurm login nodes see it too. An append-only audit log records every mutating action, and an internal API gives DevSpace, TrainX, and InferX tenant context — there is no second way to be a tenant.

How it works

From login to workload in three steps.

  1. Step 01

    Sign in with SSO

    Users authenticate against your OIDC provider. Group membership decides what they can do.

  2. Step 02

    Workspace appears

    ConsoleX provisions a namespace, applies the quota template, and grants the user admin of their own space.

  3. Step 03

    Self-serve everything

    Run pods, mount PVCs, expose services, edit YAML — within quota, within policy, no kubectl required.

Who it's for

Built for these teams

  • Researchers and engineers on shared GPU clusters
  • Platform teams replacing kubectl-everywhere with safe self-service
  • Admins who want quotas and policy without writing custom RBAC

Pairs well with

Other builder products

DevSpace

 Available

Jupyter or VS Code on a GPU in seconds. Idle environments shut themselves down.

Single-click Jupyter, Marimo, Streamlit, Gradio, and VS Code environments — GPU-ready, isolated per user behind a per-pod auth proxy, shareable with a colleague, and idle-shutdown by default.

Learn more

TrainX

 Available

A template is a shape. Your project fills it. Kubernetes runs the job.

Self-describing templates render straight into UI forms — or your project declares itself in a trainx.yaml and runs on a platform shape. Live quota checks, streaming logs, parsed progress, MLflow-tracked parameters and metrics, resumable runs, and declared outputs you can hand to the next step.

Learn more

ModelSphere

 Available

Your own Hugging Face Hub. Change one env var — every client just works.

A self-hosted, HF-compatible model and dataset registry: transformers, datasets, huggingface-cli, git-lfs, and the Xet protocol all work unchanged — plus a browsable Hub UI with model cards, a paging dataset viewer, file history, OIDC, audit, quotas, and pull-through caching of the public Hub.

Learn more