blynkAWS-hosted
Dedicated VPC, our install
- VPC, EKS, KMS, RDS, S3 warehouse
- Secrets Manager → External Secrets Operator → the cluster
- IRSA for Polaris (S3 STS) and ESO — no long-lived keys in pods
Trust
Your perimeter. AWS-hosted or on-premise. SQL stays on console.<slug>.blynk.ae.
On-premise
Your cluster, same release
- Your Kubernetes, your DNS, your CA
- MinIO Tenant with STS instead of S3
- CNPG / Patroni instead of RDS
- Vault (or equivalent) → ESO → the cluster
- Security perimeter. Bytes, catalog metadata, and the local model stay inside the stack. my.blynk.ae sees org and billing metadata — never query results.
- ESO is the only secret path. AWS Secrets Manager or Vault. Prefix
blynk/<slug>/…. Nothing committed. - Identity stays in the stack. Tenant Keycloak on
id.<slug>.blynk.ae. Trino asks OPA on every statement. - TLS matches the host. AWS uses ACM only. On-prem uses your CA or cert-manager.
- Legal: privacy · DPA