Features
Everything in FusioNative, in one list.
One suite for the whole estate: clusters, virtual machines, storage, networking, AI, security, compliance, tenancy and billing. Every item below ships in the product.
Last updated · Fusionative
Kubernetes clusters and fleet
Build, grow, upgrade and run Kubernetes clusters on your own servers, one or hundreds.
Built on
kubeadm · MicroK8s · Charmed Kubernetes · MAAS · Karmada · Helm · OLM
More about kubernetes clusters and fleet →- Provision Kubernetes on bare metal or VMs over SSH: kubeadm (including highly available control planes), MicroK8s or Charmed Kubernetes
- Pick target machines straight from a MAAS bare-metal inventory
- Add control-plane and worker nodes; rolling and in-place cluster upgrades
- Register existing clusters and see the whole fleet with groups and health
- Federate workloads across clusters with Karmada: propagation, overrides and failover between regions
- Web terminal per cluster; tune kubelet, runtime, kube-proxy and sysctl settings
- Helm and OperatorHub (OLM) package management from the portal
Virtual machines (VMware-class virtualization)
Run Linux and Windows VMs next to containers, with the operations teams expect from vSphere.
Built on
KubeVirt · CDI · virtio-win · Multus
More about virtual machines →- Create, start, stop, pause and delete VMs from templates, instance types and SSH keys
- Live-migrate running VMs between nodes, with a capacity check first; migrate every VM off a node for maintenance
- High availability with watchdogs and disruption budgets; placement, storage and network policies
- Import disks from an upload (ISO or disk image), a URL, a container registry or a clone
- Unattended Windows installs with VirtIO drivers and guest tools added automatically
- Keep a VM's existing MAC address and IP when it moves from VMware: static IPs, MAC pinning, DHCP reservations, bridges
- Snapshots, restore, clone, and download of a snapshot's disks; scheduled volume backups
- Hot-plug disks and NICs, resize disks; virtual TPM and UEFI Secure Boot
- VM pools with autoscaling, and load balancers for VMs
- GPU for VMs: PCI passthrough, or time-sliced, vGPU and MIG devices the cluster provides
- Serial and VNC consoles in the browser; one-click install of the KubeVirt stack
Storage (Fusion Ceph)
Software-defined block, file and object storage managed from the same console.
Built on
Rook · Ceph RBD · CephFS · RGW · NVMe-oF · iSCSI
More about storage →- Deploy Ceph with a wizard; add nodes and devices; manage OSDs, disks, CRUSH and pools
- Block storage (RBD) with mirroring between sites, plus iSCSI and NVMe over Fabrics (NVMe-oF) gateways
- File storage (CephFS) and NFS exports
- S3-compatible object storage (RGW): gateways, users, buckets and multisite replication
- Guarded pool deletion that refuses pools with bound volumes or pools Ceph itself needs
- StorageClasses, volumes and claims; Ceph health, logs, diagnostics and alerts
Backup and disaster recovery (FusionVault)
Protect clusters, VMs, databases and AI models, including against ransomware.
Built on
Velero · Kopia · CloudNativePG · S3 object lock
- Scheduled backup and restore of namespaces and applications (Velero with Kopia)
- KubeVirt VM snapshots and restores
- etcd control-plane snapshots for cluster disaster recovery
- Replication of backups to secondary vaults
- Ransomware protection with immutable (WORM / object-lock) copies on S3, Azure Blob and Google Cloud Storage, integrity checks and incident tracking
- Air-gapped export and import of backups
- Database backups (CloudNativePG, with a pg_dump fallback) and AI model volume backups
- Protection policies, restore plans, SLA monitoring and compliance views
Networking (FusioNetwork, Cilium)
eBPF networking, security and visibility across clusters.
Built on
Cilium · Hubble · Tetragon · Gateway API · WireGuard · Multus
More about networking →- Install and upgrade Cilium; network policies with a dry run, including policies for VMs
- Hubble flow logs and service map in the portal
- Cluster Mesh across clusters, Gateway API and BGP
- Transparent encryption (WireGuard or IPsec)
- Tetragon runtime visibility
- Exposure Gateway: publish apps with DNS (PowerDNS or Cloudflare) and certificates from a wizard
- Network Planner: CIDR analysis, subnet allocation, Cluster Mesh validation and MTU advice
Remote clusters, Zero Trust and edge
Reach clusters and applications anywhere without opening them to the internet.
Built on
WireGuard · OIDC · SAML 2.0
- Connect remote and edge clusters through an agent with a WireGuard gateway
- Zero Trust tunnel to applications with OIDC, SAML 2.0 or one-time-password identity providers, routes and audit
- Edge engine for DNS, WAF and caching (Enterprise)
AI Factory: models, inference and LLM gateway
Serve open models on your GPUs and give teams governed, OpenAI-compatible access.
Built on
vLLM · SGLang · NVIDIA NIM · llm-d · Ollama · Harbor
More about ai factory: models, inference and llm gateway →- Deploy models with vLLM, SGLang, NVIDIA NIM, llm-d (distributed inference with KV-cache-aware routing) or Ollama
- GPU preflight checks, model download into the private Harbor registry, deploy progress and replica scaling
- OpenAI-compatible LLM gateway with personal API keys scoped to the owner's projects
- Per-model traffic, latency percentiles, token counts, KV-cache and GPU telemetry
- No cloud egress by default: prompts and outputs stay inside your boundary
- Tenant-level connections to external providers (OpenAI, Anthropic Claude, Groq and others) where policy allows
- AI approval queue for model and agent actions
AI agents and AIOps
Agents that diagnose and operate the platform, with a human approving every change.
Built on
LLM agents · pgvector
- Twelve built-in operations agents: AIOps, workloads, clusters and nodes, network, storage and backup, GPU and models, security, virtualization, DevOps and registry, capacity, product guide and operator
- Build your own agents with skills, tools, policies and approval gates; about 105 operations tools available
- Evidence-first troubleshooting across 20+ areas (Kubernetes, Ceph, Cilium, KubeVirt, GPU stack, Harbor, Postgres and more) with root-cause analysis and runbooks
- Predictive maintenance: risk forecasts and planned actions
- Agent runs with traces and approve or deny decisions; an evaluation harness for agents
Security (FusioNative Shield, SOC, Remediation)
Cloud-native application protection from build to runtime, with a SOC on top.
Built on
Trivy · Falco · Tetragon · Kyverno · Gatekeeper · Kubewarden · Kubescape · Prowler · Sigstore
More about security →- Vulnerability scanning with Trivy and remediation profiles
- Admission control with Kyverno, Gatekeeper or Kubewarden policies
- Runtime threat detection with Falco and Tetragon
- Compliance scans with kube-bench and Kubescape
- Cloud security posture for AWS, Azure and Google Cloud (Prowler), with cloud identity (CIEM) graphs
- Supply-chain provenance with Sigstore / cosign and CI security scans
- SOC: data sources, natural-language threat hunting, correlation, attack graph, cases, playbooks and SIEM export
- Remediation queue with approvals, execution history and evidence; CISO dashboard with PDF and CSV export
Compliance, audit and reporting
Evidence your auditors and regulators can use, generated from the platform itself.
Built on
HMAC hash chain · Loki · SIEM export
More about compliance, audit and reporting →- Compliance framework packs with scoring and drift detection: CIS, ISO 27001, NIST CSF, PCI DSS 4.0, NSA Kubernetes Hardening, NCA ECC, NCA CCC and SAMA Cyber Security Framework
- SOC 2 Center with evidence collection, executive reports and an attestation pack
- Unified audit trail (API calls, Kubernetes audit, GitOps, storage, model registry) protected by a tamper-evident HMAC hash chain, shipped to SIEM or Loki
- Audit evidence mapped to ISO 27001, ISO 42001 (AI management), GDPR and Saudi PDPL
- Data governance views for NDMO, PDPL, data residency and data classification
- Scheduled CEO, CTO, compliance, SOC, risk and incident reports in PDF, HTML, CSV or JSON, by email or webhook
Multi-tenancy, identity and access
Many organizations on one platform, each with its own projects, quotas and access.
Built on
Keycloak · OIDC · Kubernetes RBAC · OPA
- Tenants, projects and a tenant portal; tenant administrators
- Quotas for CPU, memory, pods, storage, VMs and GPUs by type, including GPU slices and fractions, enforced as Kubernetes quotas
- Quota change requests with approval
- Permission Engine: namespace grants reconciled into Kubernetes RBAC, permission packs, effective-access views and RBAC audit
- Single sign-on with OIDC (Keycloak) and MFA; just-in-time user creation
- Recorded break-glass support sessions instead of silent impersonation
- Transfer clusters or projects between tenants with two-person approval
FinOps, metering and billing
Know what every tenant uses and bill it, including GPUs by model.
Built on
OpenCost
More about finops, metering and billing →- Usage metering for CPU core-hours, memory, storage, GPU-hours by GPU model, VMs and network egress
- Rate cards per resource with GPU model pricing, pricing tiers and commitment plans
- Monthly invoice generation per billing account
- Budgets with alerts, cost-allocation tags, anomaly detection and recommendations
- Provider console: customers, Customer 360, revenue, subscriptions, cloud and AI economics, customer health and forecasting
- OpenCost as an optional cost source
Developer platform, GitOps and registry
From git push to running app, VM or inference endpoint, on your own cloud.
Built on
Argo CD · Argo Workflows · Tekton · Harbor · Knative · KEDA · BuildKit · Syft · cosign
- Developer Studio: launch apps from git (buildpacks or BuildKit), containers, VM instances and inference endpoints
- Sites: preview deployments, promote, roll back and sleep; signed Android APK builds
- Build service that builds, scans (Trivy), generates SBOMs (Syft) and signs (cosign) images
- GitOps with Argo CD and workflows with Argo Workflows and Tekton
- Harbor container registry: projects, replication, scanners, robot accounts, quotas and garbage collection
- Serverless functions with Knative, and event-driven autoscaling with KEDA
- Marketplace of one-click apps: models (Llama, Qwen, DeepSeek, Mistral, Gemma), Jupyter, MLflow, Kubeflow, Open WebUI, Dify, Langflow, Flowise and more
- Managed Postgres backends with FusionBase (Supabase-compatible)
Observability and capacity
Metrics, logs, traces and capacity forecasts for the whole estate.
Built on
Prometheus · Thanos · Grafana · Loki · VictoriaMetrics · OpenTelemetry · DCGM
More about observability and capacity →- Metrics with Prometheus and long-term storage with Thanos; Grafana dashboards
- Logs Engine on Loki or VictoriaLogs
- FN APM with OpenTelemetry: traces, service map, SLOs, real-user monitoring, errors and database views
- Dashboard Builder over Prometheus, Loki, OpenSearch and Kubernetes data
- GPU fleet monitoring with NVIDIA DCGM; views for VMs, Ceph and Cilium
- Cluster and platform alerts with Alertmanager and email
- FusionCapacity AI: capacity snapshots, forecasts, risks and what-if simulations
Installation, upgrades and air-gapped operation
From bare servers to a running platform, connected or fully offline.
Built on
Harbor · Cilium · Keygen licensing
- Deployment Engine: a guided install (cluster, checks, images, settings, review, deploy, verify) from registry images or source
- Build a new Kubernetes and Cilium cluster from bare Ubuntu or RHEL servers
- Upgrades with an automatic database backup first, and rollback to the previous version
- Air-gapped bundles loaded into a local Harbor; offline license files
- Failure matching against known runbooks, and read-only prevention checks before changes
- Four AI install agents (planner, deployer, watcher, fixer) that act only after a human approves
- Portal in English and Arabic
Editions
Four editions, one product
Start with Community and grow to Enterprise without changing platforms. Limits as defined by the product's licensing.
| Community | Lite | Pro | Enterprise | |
|---|---|---|---|---|
| Intended for | Single-cluster lab with basic observability | Small production teams | Mid-market AI factory | Full platform |
| Clusters | 1 | 2 | 10 | Unlimited |
| GPU nodes / GPUs | 1 / 2 | 4 / 8 | 32 / 64 | Unlimited |
| Tenants / users / projects | 1 / 5 / 5 | 3 / 25 / 25 | 25 / 150 / 200 | Unlimited |
| AI runtimes | Ollama | Ollama, vLLM | Ollama, vLLM, NIM | Ollama, vLLM, NIM |
| Metrics retention | 7 days | 15 days | 90 days | Unlimited |
| Edge | — | Agent | Agent, Zero Trust tunnel | Agent, tunnel, edge engine |
| Adds | Core and observability | LLM, Harbor registry, Permission Engine | Networking (CAMP), GitOps, multi-cluster, virtualization, serverless, Shield, capacity, cost, AI governance, FusionVault, reporting | All modules, incl. audit compliance, network fabric, predictive maintenance and SOC 2 |
FAQ
Frequently asked questions
Can FusioNative replace VMware for virtual machines?
For most Linux and Windows workloads, yes. FusioNative runs VMs on KubeVirt with live migration, high availability, snapshots, vTPM and Secure Boot, unattended Windows installs, and keeps a VM's existing MAC address and IP. Disks are brought in by upload, URL or registry import.
Which AI inference engines does FusioNative support?
vLLM, SGLang, NVIDIA NIM, llm-d and Ollama, behind an OpenAI-compatible gateway with per-user API keys, quotas and per-model telemetry.
Does FusioNative generate invoices for tenants?
Yes. It meters CPU, memory, storage, GPU-hours by GPU model, VMs and egress, applies rate cards and commitments, and generates monthly invoices per billing account. Payment collection is handled by your existing billing or payment system.
Which compliance frameworks are built in?
Packs for CIS, ISO 27001, NIST CSF, PCI DSS 4.0, NSA Kubernetes Hardening, NCA ECC, NCA CCC and SAMA CSF, a SOC 2 Center, and audit evidence mapped to ISO 42001, GDPR and PDPL. These support your compliance work; they are not certifications of your environment.
Can FusioNative run without internet access?
Yes. The Deployment Engine installs from air-gapped bundles into a local Harbor registry with offline license files, and the LLM gateway has no cloud egress by default.