Hybrid
Put each workload where its rules say, and keep one control plane over all of it.
What it is #
Hybrid is what you choose when the honest answer to where something should run is different for different parts of the same system. The sensitive corpus stays on your premises; the burst inference and the general-purpose apps run in a managed region; the two are one platform to the people using them.
What makes that workable is that placement is declared rather than improvised. Every function, data class and authority is assigned to an environment, and the link between environments is an authenticated wide-area path with defined behaviour when it degrades — not a local assumption stretched across a WAN and hoped for.
Who it is for
- Different data classes in the same organisation carry different obligations.
- You have on-premises capacity you intend to keep using, and peaks it cannot absorb.
- You want one identity, one catalogue and one console over both environments.
- You need to be able to say exactly which environment holds the authoritative copy of what.
Placement is declared, not improvised. Every data class has one environment and one named owner.
What you get #
The whole platform runs here. These are the parts this pattern changes the shape of.
Declared placement #
Control planes, applications, data, models, storage, identity and administration are each assigned to an environment, with one named owner for every authoritative copy.
One identity and one catalogue #
Users sign in once through your provider, and the model and app catalogue resolves the same in both environments.
Policy that travels #
Tenant policy decides per request whether data may leave a cluster, and that decision is enforced before any work is dispatched rather than audited afterwards.
A link built for the WAN #
Cross-environment traffic uses authenticated, signed wide-area transport with defined impairment and partition behaviour.
The operating model #
Nobody should discover who owns a failure while it is happening. This split is explicit before anything is signed, and it is the part of a deployment decision that outlives the architecture.
- Each environment has an operator
- Named for its own infrastructure and platform duties, so no incident falls between the two.
- One incident path
- End-to-end observability spans both sides, and cross-boundary incident command is agreed before you need it.
- The operator handles
- Reconciliation on both sides, and compatibility across the version skew a two-environment rollout inevitably creates.
- You keep
- Placement decisions, key custody in each environment, and the policy that governs every crossing.