Summary
Two customers want the same invoice workflow, one on AWS with strict private-subnet and reachability requirements and one on Azure with an existing Kubernetes practice and a wish to self-operate. The workflow does not care — the executor, agent loop, authorization model and marketplace are identical — but the infrastructure beneath them is not, and pretending otherwise is how deployments go wrong.
The article starts from logical responsibilities rather than products: entry interfaces, identity, execution services, worker pools, event transport, persistent state, files, retrieval, inference and observability, with everything in a concrete deployment an implementation of one of those roles. Boundaries are then treated carefully: public and private describe network reachability and not permission, entry points require the authorization controls from Part 7 either way, the model gateway is internal, permitted inference and integration traffic use controlled egress that the deployment’s network controls must actually constrain, and asynchronous returns get a dedicated authenticated callback path.
Workloads are separated by capacity profile — application services on general-purpose CPU nodes, worker groups on their own nodes so an agent spike does not starve the collaboration service, and GPU nodes where in-cluster inference or Smart Aliasing’s local processing requires them — with autoscaling at both node and replica level. A role-to-product table maps each responsibility onto AWS and Azure samples, making the point that the right-hand columns differ while the left-hand column does not.
On tenancy the article is precise: in a multi-tenant deployment logical separation depends on the authorization and scoping models being enforced, while infrastructure isolation is a separate choice available through dedicated accounts, clusters and resources. The honest cost of the portable Kubernetes structure is that provider-specific networking, identity federation, capacity planning and operations remain, that managed-service behaviour and quotas differ, and that encryption, backup, recovery objectives and residency must be specified per deployment rather than assumed from this description.