v1.29.0Connect Snowflake and schedule warehouses to cut idle spend. The platform engineering layer
The platform engineering layer
your cloud doesn't ship with.
Landing zone. Deploy pipeline. Audit trail. Built once, runs on AWS, GCP, and Azure. Your team gets push-to-deploy speed without the six-month internal-platform project.
customer
McAfee
running platform engineering on zopday in production
AWS accounts
12
multi-cloud landing zones, BYOC
K8s clusters
48
across regions
throughput
1,000+
req/sec sustained on production
The console. Every cluster, every cloud, one workspace.
Provision, datastores, clusters, deployment spaces, projects, audit logs, all on the same surface.
PROBLEM
Building a platform is hard.
Renting one is worse.
Hosted PaaS rents you their stack. Internal platforms cost millions to build and a permanent team to keep alive. Raw cloud is five engineers, a YAML graveyard, and onboarding by tribal knowledge. None of the three are working.
- Cluster spin-up time Days of Terraform + manual approvals.
- Cross-cloud parity Works on AWS. Breaks on GCP. Rewritten for Azure.
- Helm rollout debugging kubectl get pods… CrashLoopBackOff. Tail the logs. Pray.
- New engineer onboarding Weeks of tribal knowledge before first deploy.
- Platform-team headcount A growing tax on every product team's velocity.
SOLUTION
One platform. Three stages. Security baked in at every step.
Day 0 to landing zone. Every day to deploys. Every minute to live state.
Landing Zone
Production-ready clusters in minutes.
Production-grade compute, datastores, networks. 30 minutes, every cloud. GKE · EKS · AKS via wizard. MySQL · Postgres · Redis with HA, backups, deletion protection. RBAC and secrets from minute zero. IRDAI controls applied by default.
Deployment
Push code → production.
Push code → production via Helm. No Dockerfile required, zopday auto-builds from your repo. Security scans on every build. DORA-grade visibility. One-click rollback. Sensitive env vars masked, stored in your cloud-native secret manager, never ours.
Live State
Cluster, live. Audited, every change.
K8s state, real-time, 21 resource pages with detail drawers across every connected cluster. Cluster reachability probed every 60 seconds; transient hiccups retry silently. If a cluster goes inactive, deleted, RBAC revoked, cert expired, Sync, Connect Datastore, and Install Component gate cleanly. Audit trail captures every change.
DEPTH
The depth behind
the three stages.
Seven more features you’d otherwise build internally, each one validated against the changelogs from v1.1.1 forward.
Configure once. Helm renders the rest.
Per-service inputs — not YAML.
Port, replicas, probes, CPU and memory limits, env vars with sensitive masking. Application → Environment → Service hierarchy: the Environment carries cluster, namespace, registry; services inherit. Clone an Environment (staging → production); every service copies forward with its config. Cascade teardown on delete.
INPUTS · NOT YAML
Ingress or LoadBalancer. Picked from a tab.
Two-mode network setup, no chart rewrite.
The Network tab on every service drawer offers two modes: Ingress (routed through your cluster's ingress controller, with optional cert-manager TLS) or LoadBalancer (a dedicated cloud load balancer). Saves a configs.expose patch and triggers a new Helm revision, no chart rewrite, no separate manifest.
INGRESS · LOADBALANCER · TLS
Bring the cluster you already run.
Imports stay identical to provisioned clusters.
Import an EKS, GKE (zonal or regional), or AKS cluster you already have. Components install consistently, datastore connections work, database provisioning runs the same way as on a zopday-provisioned cluster. The wizard rejects half-filled payloads up front, no clusters stuck in “waiting for credentials.”
EKS · GKE · AKS · END-TO-END
Change tier. Don't recreate.
Tier, storage, scaling, backups, all in-place.
Update tier, storage, scaling, or backup retention on RDS, ElastiCache, EKS node groups, Cloud SQL, Memorystore, GKE node pools, Azure SQL, Azure Database for MySQL/Postgres, Azure Redis, AKS, directly from zopday. Each change runs as its own provisioning job with a pre-flight check that confirms the resource is alive before touching it.
TIER · STORAGE · BACKUPS · SCALING
Same-region cross-VPC, auto-peered.
Peering + routes + scoped ingress, automatic.
When a datastore lives in a different VPC than the cluster (same region), zopday auto-creates the peering, the reciprocal routes, and a narrow ingress rule on the datastore's security group, scoped to your cluster's CIDR and the engine port only. Cross-region rejected upfront.
PEERING · ROUTES · SCOPED INGRESS
Provisioning fails, surface the cause.
Typed errors humanised end-to-end.
Typed-error wrapper flows the actual cause through to the UI: IamLimitExceeded, overlapping CIDR range, Ec2SubnetInvalidConfiguration, AsgInstanceLaunchFailures, InvalidStateTransition. No generic “operation failed” toast. Step labels humanised: “Setup VPC Peering,” “Wait for Peering,” “Inject Connection Secret” instead of raw snake_case.
TYPED · HUMANISED
Built on GoFr. Apache 2.0.
Same framework McAfee, FairPrice, Fortune 500 run.
zopday is built on GoFr, the open-source Go framework, Apache 2.0 licensed, created by our CTO. The same framework McAfee, FairPrice, and Fortune 500 retail teams run in production. Your services build cleanly on it. So do ours. ★ Star GoFr on GitHub · 21.2k →
GOFR · APACHE 2.0
From git push to live URL, without leaving the editor.
~/your-repo · main · zopday deploy ACTIVE
$ git push origin main
- 01 CONNECT OAuth verified for AWS · GCP · Azure · read-only first, write scoped on opt-in +30s
- 02 REPO GitHub webhook HMAC-verified · branch
main· auto-deploy on push +30s - 03 SCAN Railpack detected Go 1.21 · port
8080· no Dockerfile required +60s - 04 CONFIG 4 env vars masked → AWS Secrets Manager · never ours +60s
- 05 DEPLOY
helm upgrade --install· ingress + cert-manager TLS · rollout 1/1 ready +90s - 06 LIVE https://your-service.app · audit log written · Slack notified 4m 30s ✓
$
McAfee runs platform engineering on zopday.
Hosted PaaS rents you their stack. Internal platforms cost you a team.
| Hosted PaaS Render, Railway, Heroku, fly.io | Internal Platform Backstage, Spinnaker, DIY | Raw K8s + Terraform DIY | zopday | |
|---|---|---|---|---|
| BYOC (your cloud, your bill) | - | ✓ | ✓ | ✓ |
| Push-to-deploy UX | ✓ | depends | - | ✓ |
| Hardened K8s, multi-cloud wizard | n/a | weeks | weeks | ✓ |
| Live K8s state + reachability | - | DIY | - | ✓ |
| Multi-cloud (AWS + GCP + Azure) | partial | DIY | DIY | ✓ |
| DORA-lite + audit baked in | partial | DIY | DIY | ✓ |
| India residency · IRDAI · DPDP | - | DIY | DIY | ✓ |
| Engineer-time to maintain | - | high | very high | low |
Aligned pricing. Free where it matters.
| Free | Team | Growth | Enterprise | |
|---|---|---|---|---|
| Connect + 1 service | Up to 10 services · 1 cloud | Up to 50 services · all 3 clouds | Unlimited + SLA | |
| Playground access | ✓ | ✓ | ✓ | ✓ |
| BYOC (AWS / GCP / Azure) | 1 cloud | 1 cloud | all 3 | all 3 |
| Push-to-deploy + auto-detect | ✓ | ✓ | ✓ | ✓ |
| Helm rollouts + rollback | ✓ | ✓ | ✓ | ✓ |
| Auto-DNS + cert-manager | ✓ | ✓ | ✓ | ✓ |
| Live K8s view (21 resource pages) | ✓ | ✓ | ✓ | ✓ |
| DORA-lite metrics | - | ✓ | ✓ | ✓ |
| Audit log | - | ✓ | ✓ | ✓ |
| Add Existing clusters | - | ✓ | ✓ | ✓ |
| In-place updates + cross-VPC peering | - | - | ✓ | ✓ |
| SAML SSO, RBAC | - | - | ✓ | ✓ |
| India residency / VPC deploy | - | - | - | ✓ |
| Support | community | business hours | priority | dedicated + SLA |
| Price | $0 | $299 / mo* | $999 / mo* | Custom |
| Connect a cloud → | Start trial → | Start trial → | Talk to platform sales → |
Built for every seat in the room.
Predictable variance. Verified against your bill.
stops the Friday "why is the bill up" meeting.
One platform. Three clouds. Four lifecycle stages.
stops the six-tool stack that doesn't talk.
Ship product, not platform overhead.
stops the platform project "almost done" since Q1.
Cross-cloud inventory. CDCR auto-fix.
stops 3 AM pages from dashboard ↔ ticket gaps.
Read-only by default. Append-only audit.
stops "yet another vendor with broad write access."
Things teams ask before they sign.
How does zopday compare to our existing Terraform setup?
zopday generates Helm charts; you keep your Terraform. The deploy pipeline runs against whatever infrastructure you already have. zopday’s value is the build (Railpack, no Dockerfile required), the rollout (Helm with diagnostics), the rollback (one-click, build skipped), and the live K8s view on top, not in owning your IaC.
Do zopday templates replace our infrastructure code?
No. zopday configures services through structured inputs, port, replicas, probes, CPU/memory, env vars, networking. The platform discipline (audit, secrets in the cloud-native secret manager, RBAC) is what survives an eject; your existing modules slot into that discipline.
Can I bring my own Helm charts?
Yes. Point a service at an existing chart in your repo, or use zopday’s generated chart as a starting point and fork it. The deploy pipeline runs either way. Generated charts ship with structured config; manually-authored charts get a one-time validation that the resource limits are declared.
How does zopday see live K8s state?
Real-time across every connected cluster, 21 resource pages cover Pods, Deployments, StatefulSets, Services, Ingresses, Network Policies, and the rest. Cluster reachability is probed every 60 seconds; if a cluster goes inactive (deleted, RBAC revoked, cert expired), Sync, Connect Datastore, and Install Component gate cleanly. Transient network hiccups retry silently.
Do we need to give up our existing CI?
No. Trigger zopday deploys from any CI, GitHub Actions, GitLab CI, Jenkins, CircleCI. zopday handles the build (Railpack), the Helm rollout, the rollback. Your CI orchestrates whatever it already orchestrates; zopday slots in as the deploy surface.
What happens to our workloads if we leave zopday?
They keep running. zopday is BYOC and a control plane, no data-path dependency, no proprietary runtime. The services run as standard Helm releases on your clusters, backed by IaC you own. Eject the zopday control plane and the workloads stay where they are.
What’s the security model?
Read-only by default, no write IAM at credential connect. Write access is scoped, opt-in, and tag-conditioned: enabled per environment, narrowed to the resource types you allow, fenced to the resources tagged eligible. Every write goes through the audit middleware (actor, action, timestamp, body) and lands in the append-only log. SAML SSO, RBAC, SOC 2 controls all on the Growth and Enterprise tiers.