SECURITY
Orion runs inside
your network
and stays there.
CUSTOMER-HOSTED
Orion installs into your cluster. Your data never leaves it.
BUILT TO RUN AIR-GAPPED
Nothing phones home.
Orion was built to run air-gapped, and it runs the same way on a connected cluster. The signed, node-locked license is checked locally, and no logs are exported to us.
Install from inside the gap
Mirror the images into your own registry and the Helm charts into your Git host, then run the installer on an offline host.
One version for every site
There is no separate air-gapped version. Connected and disconnected clusters run the same Orion.
IDENTITY AND ACCESS
Your identity provider decides who gets in.
Orion signs people in through OIDC or LDAP and maps their groups to roles. Roles decide who can launch, share, or administer.
Single sign-on
Connect OIDC or LDAP, including LDAPS with your own certificate authority. Users and groups sync to Orion roles.
Workloads run as the user
Every workload runs as the user’s own UID and GID, so identity reaches the file.
Checked on the server
Orion checks roles on the backend, including calls between its own services.
ISOLATION AND QUOTAS
Workspaces keep teams apart, and quotas keep one team from starving the rest.
ADMIN OVERSIGHT
Admins set the rules and can step in.
Admins decide who can launch what. People only see the workspaces and templates assigned to their groups.
Take control to help
An admin can take control of a user’s workload to debug a problem or train someone.
Events and logs per workload
Open any workload to see its resources, events, and container logs.
Sharing is a workspace setting
Admins choose, per workspace, whether people can share workloads with each other.
COMPLIANCE
Built for your environment.
Orion runs inside your boundary, so your team assesses it like any other software you install. We send our security documentation on request.
