FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
Secure Delivery · 02 of 3

Pipeline Controls

Security in every stage, governance by environment and supply-chain checks.

Self-Hosted MLOps on Amazon EKS
01

Security in Every Stage

Shift left on security and testing: every stage of delivery carries its own control.

Shift leftA control at every stage
Step 1 of 7

Plan

Security plan, architecture review, risk analysis.

Always onIdentity: SSO, MFA, RBAC and least privilegeAudit trail across teams and environments
02

Governance by Environment

The pattern NGT uses on golden-path developer platforms.

  1. 01ProductionChange ticket and platform-admin approval; access in time-boxed windows.Change ticketAdmin approvalTime-boxed access
  2. 02StagingDeployments need the project manager's approval.PM approval
  3. 03DevelopmentTeams deploy freely, inside the platform's guardrails.Free deployGuardrails
CMDB as the source of truth · immutable audit log · RBAC per role and environment
03

Software Supply-Chain Checks

Checks used on NGT-built platforms; the tools vary with your estate.

04

Six Rules No Operator Can Skip

Rules NGT writes into the core code of a self-hosted MLOps platform.

  • Clean, versioned dataEvery sample hashed, duplicates rejected; label versions replaced, never lost.
  • Closed test gateThe gate stays closed unless a fixed benchmark passes.
  • A person signsEvery release has a named approver; nothing auto-promotes.
  • Write-once log, scoped accessEvents appended, never edited; access per project and role.
Self-Hosted MLOps on Amazon EKS
label · run · approveimagesread in placepassedsigned releaseimage in · verdict outverdicts · scorescandidate runOn-premises siteAWS CloudVPCPrivate subnet · one EKS clusterGPU nodes · trainingRegional servicesDomain expertslabel · retrain · approveFile storageNAS · images stay hereImage sourcescameras, scannersWeb appReact · no-codeAPIFastAPI · OpenAPIPostgreSQLmetadataAmazon EC2 GPUinstancestraining onlyAmazon EKSone cluster · TerraformApprovala person signsIngest workerhash de-dupKafkaeventsAirflowpipeline runsPyTorchtraining runsMLflowtracking · registryEvaluation gatefail-closedGrafanadashboardsPrometheusmetricsDrift workerincoming vs trainingTritonverdict APIAmazon ECRcontainer imagesAmazon S3via VPC endpointAWS Lambdaclean-up only

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

Point at a component to see what it does; select it for the best practice.Open the architecture
SourcesFPT Software Hanoi executive outlook, secure AI delivery patterns (Oct 2026)NGT self-hosted MLOps practice notes (2026)AI-First DevOps Transformation Services & Solutions (Oct 2026)NGT Platform Engineering v1.2 (Sep 2026)NGT DevSecOps Service Offering (Jan 2025)NGT Cloud managed-service map (Mar 2026)FPT Full SDLC with GenAI and multi-agents v1.2.4 (Jun 2025)FleziLift runbook and connector notes (Oct 2026)