Skip to content
TAIP

Products / Cluster foundation

TAIP Base

Available

Bare hosts to a working AI platform — even with the internet unplugged.

TAIP Base brings up the foundation TAIP runs on: a curated Kubernetes cluster with Cilium, Longhorn, MetalLB, cert-manager, Envoy Gateway, Kueue, JobSet, KServe model serving, and a self-hosted OIDC identity provider — every artifact pre-staged into a content-addressed bundle, every step idempotent and re-runnable. The same playbooks deploy to a connected lab and a fully air-gapped facility with no code changes; the 'online' path is the air-gapped path with a shorter staging step. GPU operators for NVIDIA, Huawei Ascend, and AMD dispatch per node label, so one cluster can mix vendors — and mix amd64 with arm64. Multi-factor authentication is live and enforceable cluster-wide, invitations enroll new people through a real flow, and the verifier now audits your Kueue quota for queues that are unusable or over-committed rather than waiting for a job to discover it. It runs real clusters today, connected and fully air-gapped.

All products

Specification

Version
v1.6.3 — generally available
Stack
Kubernetes (K3s) · Cilium · Longhorn · MetalLB · cert-manager · Envoy Gateway · self-hosted OIDC · KServe · Kueue · JobSet
Networks
On-prem · restricted · fully air-gapped (USB transfer supported)
Accelerators
NVIDIA GPU Operator (validated) · Ascend NPU and AMD ROCm (early) — mixed per node
Architectures
amd64 + arm64, mixed in one cluster
Identity
Self-hosted OIDC · TOTP, passkeys and backup codes · optional or cluster-wide MFA enforcement · invitation enrollment
Batch
Kueue queues with JobSet gang admission — a multi-node run is admitted whole or not at all
Proven on
Real clusters — connected and fully air-gapped

Proof, not promises

See it in one block.

No proprietary SDKs, no rewrites — TAIP Base meets your tools where they already are.

idempotent from bare metal 
$ ./install/00-preflight.sh                      # read-only validation
$ ./install/03-install-cluster.sh --cluster site-a
ok  k8s · cilium · longhorn · cert-manager · envoy-gateway · authentik
# Ctrl-C and re-run is the documented recovery path
# same bundle, same registry, same result — across sites and months▌

Content-addressed bundles: re-packing a version bump moves only changed layers. One registry serves many clusters.

Capabilities

What TAIP Base gives you

01

Air-gap first, not retrofitted

Charts vendored, images packed as OCI layouts, versions pinned, K3s system images resolved from the K3s binary itself so nothing can drift. Distribute by bucket, USB, or registry — the 'online' install is the air-gapped install with a shorter staging step.

02

One opinionated stack

Kubernetes + Cilium (eBPF CNI) + Longhorn (replicated block storage) + MetalLB (L2 load balancing on bare metal) + cert-manager + Envoy Gateway (Gateway API) + a self-hosted OIDC identity provider + KServe for model serving (default on, opt-out). Kueue queueing with JobSet for gang-admitted multi-node training, and Ceph CSI when your storage already exists. Optional GPU operators for NVIDIA, Ascend, and AMD — dispatched per node label, mixable in one cluster.

03

Idempotent and tagged

Every role is re-runnable; Ctrl-C and re-run is the documented recovery path. `--tags k8s,longhorn` re-applies a single layer. Preflight validates DNS, SSH, disks, and TLS before anything destructive; post-install verification checks every workload — and audits the Kueue quota, so a queue with zero nominal quota or more committed than the cluster can allocate is a finding at install time, not a mystery a user hits at 2am.

04

Self-hosted identity, by design

A self-hosted OIDC identity provider runs inside the cluster. kubectl authenticates via OIDC against it. Multi-factor authentication — TOTP, WebAuthn passkeys, backup codes — is validated end to end and can be left optional or required cluster-wide with an exempt group; new people are onboarded through an invitation enrollment flow that applies the password policy and creates them as internal accounts. Per-app OIDC registration is one idempotent script: TAIP apps get client secrets and tokens generated automatically. No SaaS dependency, ever.

How it works

From bare hosts to a working platform.

  1. Step 01

    Stage the bundle

    Helm charts, image layouts, binaries, certs — packed once on a connected build host. Content-addressed: version bumps move only changed layers.

  2. Step 02

    Run the playbooks

    Preflight validates first. Install is idempotent, tagged, re-runnable. The same flow online, restricted, or fully air-gapped.

  3. Step 03

    Cluster is ready

    Kubernetes + Cilium + Longhorn + MetalLB + Envoy Gateway + Kueue + self-hosted OIDC — wired up, verified, SSO and MFA from day one.

Who it's for

Built for these teams

  • Regulated industries (healthcare, finance, government, defense)
  • Edge and field deployments on customer hardware
  • Teams standing up a new on-prem AI platform