SEAGIT DOCS
MLOps Platform

MLOps Platform on Seagit

Six stacks give your data scientists, ML engineers and MLOps engineers a complete, connected platform in your own AWS account: notebooks, experiment tracking, a RAG app, a model gateway and evaluation behind single sign-on. Each one is a form with sensible defaults, and the stacks connect to each other by picking one from a list.

Minutes instead of weeks

Building this yourself means Helm charts, IAM roles, databases, buckets, TLS certificates, single sign-on and the wiring between every tool. With Seagit, you answer a few questions per stack. The wizard estimates 4 to 10 minutes per stack; in our own end-to-end run on a production cluster, each stack was running in one to three minutes.

What you would build and connect yourselfWith Seagit
MLflow with Postgres, S3 artifacts, IAM roles, TLS and single sign-onMLflow stack, with the Auth Proxy stack in front
JupyterHub with sign-in, per-user storage, idle shutdown and bucket accessNotebooks stack
An LLM proxy with a database, keys, budgets, a guardrail and a usage dashboardLLM Gateway stack
A RAG pipeline: vector database, ingestion, an API and a chat UIRAG stack
An evaluation harness, a review process and a CI quality gateEvals stack
Wiring the tools to each other: addresses, credentials, network rules, tracingPick the other stack from a list; Seagit fills in the rest

How it fits together

How the Seagit AI and data stacks work togetherThe Seagit portal deploys six stacks into your own cluster. The Auth Proxy signs people in with your identity provider and guards MLflow. The RAG and LLM Gateway stacks call Amazon Bedrock or self-hosted models and send traces to MLflow. Notebooks log experiments and models to MLflow. The Evals stack sends questions to the RAG or LLM Gateway stack, writes scores to MLflow, and gives the portal the verdict for the promotion gate.Your identity providerGitHub, Okta, Entra ID, GoogleSeagit portaldeploys and connects the stacksYour people and appsdata scientists, ML engineers, appsYour EKS cluster, in your AWS accountAuth Proxysingle sign-on for everybrowser-facing toolMLflowexperiments, model registry,traces and evaluation resultsPostgres + S3 artifactsNotebooksJupyterHub, one server per userMLflow client readyRAG Stackanswers from your documentsAPI + web UI, qdrantLLM Gatewayone OpenAI-compatible APIkeys, budgets, guardrailEvalsscores answers, review queue,promotion gateModelsAmazon Bedrock andself-hosted models in the clusterYour data stays herePostgres, qdrant and S3 bucketsin your AWS account112223364445
The numbers match the flows described below. Swipe the diagram sideways to see all of it.
  1. Sign-in. People open MLflow (or any tool you put behind the Auth Proxy) and sign in with your own identity provider. The Auth Proxy checks the organization, team, group or email domain you chose, then lets them through.
  2. Using models. Apps ask the RAG stack questions about your documents, or call any model through the LLM Gateway with their own key. Both use Amazon Bedrock, and the gateway can also serve OpenAI-compatible models you run in the cluster.
  3. Tracing. Every RAG answer and every gateway call becomes an MLflow trace: the question, the answer, tokens, timing and user feedback. Emails, phone numbers, card numbers and AWS keys are redacted before a trace is stored, unless you turn that off.
  4. Evaluation. The Evals stack sends your test questions to the RAG or LLM Gateway stack, scores the answers with Ragas, a rubric judge or code checks, and records every run in MLflow. It can also score live traffic and queue weak answers for review.
  5. Promotion gate. When someone promotes a deployment to main, Seagit asks the Evals stack to score it against the current one and shows the verdict, also as a GitHub check. You choose whether a worse score warns or blocks the promotion.
  6. Experiments. Data scientists train in Notebooks and log runs, metrics and models to the same MLflow, which every server is already connected to.

What each team gets on day one

📓

Data scientists

  • A JupyterHub with one server per person, the size they pick, and a home folder that survives restarts.
  • Python data science or PyTorch images, or your team’s own image.
  • MLflow already connected: log runs and register models with no setup.
  • An S3 bucket for data, reached without access keys. Idle servers stop on their own.
🧠

ML engineers

  • A RAG API and web UI over your documents, kept in sync with an S3 bucket.
  • One OpenAI-compatible API for every model, with a key, budget and model list per team.
  • An input guardrail that blocks prompt attacks and masks personal data before it reaches a model.
  • A trace of every call in MLflow to debug answers, cost and latency.
🛡️

MLOps engineers

  • A private MLflow behind single sign-on, with per-experiment permissions if you need them.
  • Evaluation suites that run on demand, on live traffic, or before every promotion.
  • A promotion gate that warns or blocks, with a GitHub check on the commit.
  • Everything in your AWS account, on the node pool your environment pins, with backups to your S3 bucket.

Set it up in this order

Create the stacks in one environment. Each step picks the stacks from the steps before it.

  1. Auth Proxy: register an OAuth app in your identity provider and enter its client ID and secret.
  2. MLflow: choose the Auth Proxy for sign-in.
  3. Notebooks: turn on Connect to MLflow and pick the MLflow stack.
  4. RAG stack and LLM Gateway: turn on tracing and pick the MLflow stack.
  5. Evals: pick the MLflow stack and the RAG or LLM Gateway stack to score. Add your test questions to the stack’s datasets folder, then turn on the promotion gate when the scores look right.

Security and your data

  • Everything runs in your AWS account: your cluster, your Postgres and qdrant volumes, your S3 buckets.
  • Sign-in uses your own OAuth app in your own identity provider. Seagit never shares one across customers.
  • Secrets such as the OAuth client secret and API keys are stored encrypted and only placed into Kubernetes Secrets in your cluster when a stack deploys.
  • RAG and LLM Gateway traces have personal data redacted by default.
  • Browsers reach MLflow only after signing in. Inside the cluster, the other stacks use MLflow’s internal address without signing in, so the cluster network is the trust boundary: run only workloads you trust on that cluster.
  • The Notebooks sign-in page is reachable from the internet unless you set Allowed IPs. Restrict it to your office or VPN, or use GitHub or OIDC sign-in.
  • To keep the platform off your production nodes, pin the environment to a node pool; every stack component, including databases and notebook servers, runs there.

Requirements

  • A paid plan.
  • An EKS cluster in an environment with a domain. AWS only.
  • Stacks that connect to each other run on the same cluster; the wizard only lists the ones that do.
  • Amazon Bedrock model access for the models you want, approved for your organization in Seagit.