Sovereign deployment
At a glance
The challenge
Health data, banking secrecy, classified information or industrial secrets: some data cannot be sent to an external AI service. For that data, AI has to come to the data.
Air-gapped delivery
Signed artifacts
Images, charts and SBOMs signed with Cosign
Harbor mirror
Internal registry, Trivy scanning
Internal Git
Versioned configuration per environment
Argo CD
GitOps deployment
Kyverno admission
Only signed artifacts are admitted
Isolated cluster
Local models served by vLLM
Topologies
| Topology | Description and use |
|---|---|
| 01 - Single brick | The Control Plane, PostgreSQL and one component, for example the model gateway, with API key authentication. To start fast on a precise need. |
| 02 - Shared SaaS | One cluster, several tenants isolated by RLS, OpenFGA and Cilium namespaces. To offer AI to several entities. |
| 03 - Dedicated tenant | A namespace or a cluster per key account, with its own OpenBao mount and GPU pool. For entities with stronger requirements. |
| 04 - Sovereign on premises | A cluster isolated from the network, only local vLLM models, a Harbor mirror and Argo CD from an internal Git. For data that never leaves. |
| 05 - Hybrid | Local vLLM for restricted data, remote providers allowed by policy for the other classifications. To balance cost, quality and confidentiality. |
Installation
| Method | What the agent does | Services where it is the default method |
|---|---|---|
| binary (25) | Downloads the official archive, checks its sha256 digest, extracts it into a versioned folder of the service, points a current link at it, then starts the binary through a systemd unit. | Prometheus, Keycloak, OpenSearch, Qdrant, NATS, Temporal, OPA, OpenFGA, OpenBao, SeaweedFS, OpenTelemetry Collector, Falco... |
| podman (16) | Fetches the image pinned by digest (podman pull from the internal registry, or podman load from an archive), then runs it through systemd with podman run --rm --pull never --log-driver journald, on an isolated network by default; NVIDIA GPUs go through CDI. | PostgreSQL, Redis, ClickHouse, vLLM, Ollama, ClamAV, MySQL, Opik, Marquez, Label Studio, LLaMA-Factory, Navin Enterprise |
| python (8) | Creates a virtual environment on the machine and installs with pip install --no-index --find-links from the prebuilt package repository of the mirror, without Internet access. | LiteLLM, Docling, Presidio, MCP hosting, YARA-X |
| package (6) | Installs the distribution packages with dnf (RHEL family) or apt (Debian family), then uses the systemd unit shipped with the package. | APISIX, HAProxy, keepalived, Kamailio, Asterisk, RTPengine |
Several services offer several methods (Podman is accepted by 38 services, the binary by 26): the operator chooses at installation time. The 7 other services install no permanent server: 3 only run when a test is requested (garak, promptfoo, Ragas), 3 are libraries provided to developers (Haystack, OpenLineage SDK, Tink) and Navin SM is distributed to workstations. Finally, 25 services can also simply be connected when they already exist at the customer, without installing anything.
Before installing a service, the agent adds what is missing, for example Podman, Python 3.11 and its venv module, or tar. It does not do so on a machine without root rights.
Everything comes from the local mirror of the Manager, never from the Internet at installation time.
The Manager server prepares the list of tasks: fetch, create the folders, write the configuration and the unit, start, check health. The agent runs them on the machine.
Each component becomes a navin-<service>-<component>.service unit, and the agent only drives navin-* units. Logs go to journald.
Podman has no permanent daemon and integrates directly with systemd. Docker is only used in the project for the local development stack and to build the images.
Autonomous operations
vLLM serves your models on your GPUs; LiteLLM exposes them behind the same gateway as remote providers.
Harbor mirror, internal Git and Argo CD: the platform installs and updates without Internet access.
SBOMs generated by Syft, images scanned by Trivy, signed with Cosign and admitted by Kyverno.
DEB, RPM and pacman packages for Debian, Ubuntu, RHEL, Rocky, Alma and Arch Linux, with offline installation archives.
OpenTofu or Terraform for clusters, GitOps for applications, one cluster per environment.
Velero backs up data and configuration; high availability is declared service by service.
SeaweedFS, Ceph or the S3 storage of your choice, with Object Lock for audit evidence.
The operations console installs, configures and runs services, hosts and clusters, without manual input.
The proof
Policies, audit, quotas and gateways are identical in the cloud, on premises or air-gapped: your teams validate a single security model.
Go further
From a single brick to a fully air-gapped cluster: the five deployment topologies of Navin Enterprise AI, the GitOps supply chain with signed images, and OS packages with offline archives for Debian, Ubuntu, the RHEL family and Arch Linux.
Our architects study your hosting, network and compliance constraints.