Aether Identity
Team single sign-on (OIDC) for the portal and API with org-scoped roles and MFA; kubectl uses the cluster’s admin certificate. No third-party sign-in provider is offered today.
Platform
Kubernetes, with the dangerous parts removed.
Aether is built on three layers: what you see (standard Kubernetes and a clean portal), what runs your infrastructure (dedicated compute, Ceph storage, isolated networks), and a management layer you never operate — it runs your control plane and is not reachable from tenant networks. All of it runs in one EU region today: eu-fi, Helsinki, Finland.
tenant layer · yours
Portal · kubectl · kubeconfig · OIDC · dashboards · your load balancers · Talos nodes
infrastructure layer
Dedicated compute · Ceph storage · per-cluster VLANs · dedicated proxy VMs
Provisioning
From click to kubeconfig in about five minutes.
Cluster creation is a fully automated pipeline: the control plane is Ready in seconds, then every worker boots cold from an immutable image — no pre-pulled layers, no reused VMs, no stale state. Timings are typical rather than guaranteed; you can watch every step stream live in the portal while it runs.
- 01
Request
You create a cluster from the portal or the REST API — the two supported surfaces today. Aether validates quota and allocates the cluster its own VLAN and private subnet before anything boots.
- 02
Control plane
A dedicated kube-apiserver, controller-manager and scheduler start as pods in the management cluster, backed by an isolated, replicated datastore. Ready in 10–20 seconds.
- 03
Networking first
Cilium networking is deployed and a dedicated proxy fronts your API server before any worker exists — so nodes join a fully-formed network, not a half-built one.
- 04
Workers
Talos Linux worker VMs boot inside your private VLAN, verify themselves against the cluster CA, and join. No SSH keys were created at any point.
- 05
Platform services
Registry access, DNS records, TLS, storage classes and observability wiring are applied automatically. Your kubeconfig arrives with everything already working — pointing at the cluster’s own public API endpoint. Every cluster has one: a dedicated public IPv4 for its Kubernetes API, billed at the rate card’s public API endpoint rate. Private-network connectivity, which would make the public endpoint optional, is a future capability.
Included services
Eight services on every cluster, one planned. Zero setup.
These usually live on a platform team's backlog for a quarter. On Aether they are included with the €0 control plane and deployed before you first sign in. The services cost nothing; the resources they consume — registry storage, volumes, load balancers, the public endpoint IP — are billed at the rate card.
Aether Container Registry
Private container registry with vulnerability scanning on every push.
DNS + TLS
DNS records and publicly trusted TLS certificates, managed for you.
Aether Observability
Dashboards over metrics, logs and traces — plus panels right in the portal.
Cluster autoscaler
Node pools scale between your min and max, with warm capacity standing by — a pending pod typically has a Ready node in about 80 seconds. Unhealthy machines are replaced automatically.
Datastore backups
Continuous WAL archiving of your control-plane datastore. Data inside your PersistentVolumes is yours to back up.
Block + shared storage
Ceph-backed block volumes and shared CephFS filesystems many pods can mount at once.
Volume snapshots
Planned; not yet available to tenant clusters. Priced at €0.05/GB in the rate card, and not metered.
metrics-server
Resource metrics for kubectl top and horizontal pod autoscaling.
Exact sizes, not T-shirt tiers.
Pick the precise vCPU, memory and disk per node — no rounding up to the next instance type. Fixed pools bill the full calendar month with no proration; autoscaling pools bill per started node-hour. Every node has a 15-minute grace period, measured from the moment it first appears in the cluster’s node list, whether or not it becomes Ready: a node removed within that window carries no node charge, and because a fixed pool bills per pool the waiver is keyed on the pool — its month is not charged if the pool is removed within 15 minutes of its first node appearing in the cluster’s node list. Billing stops when you request the removal; the drain that follows is never billed.
An API built for Terraform from day one.
Full CRUD, idempotent operations, stable IDs, API tokens — and webhook events that notify your systems as clusters are created, become ready, upgrade or degrade. Everything the portal does, the REST API does. The API is designed to be Terraform-compatible, but the Terraform provider and the aether CLI are planned and not released: portal and REST API are the supported surfaces today.