An Incident is a logical entity for handling unplanned work. Each Incident includes a Title and Alerts or Context (sourced from incident management systems or manually input). Incidents are assigned to a team, owned by a user who is responsible for oversight, and tracked with Start Time and End Time, marked by users. During an Incident, the Agent collects Background Information and generates Root Cause Analysis to support resolution efforts.

While DuploCloud's built-in agents operate on a wide range of standard cloud functionalities you can build your agents that are very custom to your own use cases and stitch together your organization's tool set and workflows. For example you can build an agent that can triage your customer support tickets by connecting to your Zendesk and cloud infrastructure tools.

The DuploCloud AI DevOps Policy Model lays down the foundational building blocks of the system that orchestrates large and complex DevOps projects seamlessly—just as a human engineer would.

This diagram illustrates a hierarchical AI DevOps platform architecture. Administrators define permissions and integrations, Engineers are configured with capabilities and boundaries, Projects break down requirements into executable plans and tasks, and specialized Agents carry out the actual work through multi-agent orchestration in a ticket-based workflow.

Core Concepts

Below are brief introductions to the core concepts of the AI DevOps Policy Model, which will be explained in detail in subsequent sections.

1. Engineer

The Engineer is the primary entity representing an AI DevOps Engineer. Each Engineer has a unique name within your organization, is defined by a set of key attributes that govern its behavior and capabilities, and contains a container of Skills called a Persona. The Engineer operates within defined access boundaries called Scope, with specific exceptions managed through Guardrails. As it works, the Engineer builds a Knowledge Base of learned information about the environment. Resource usage is controlled through Quota settings, and the Engineer's performance is tracked through Health Metrics, which include analytics and cost data.

2. Skill

A Skill is an instruction or prompt that tells an agent how to behave or what capabilities it has. Skills represent the atomic unit of capability within the system. Examples include Kubernetes troubleshooting skills, Terraform provisioning skills, cost optimization skills, and custom skills tailored specifically to an organization's workflows or requirements.

3. Persona

A Persona serves as a logical container that organizes multiple Skills together. Personas help customers organize capabilities by role or function, making it easier to manage and deploy different sets of abilities. For instance, an SRE Persona might combine troubleshooting, monitoring, and incident response skills. Similarly, a Provisioning Persona could bundle Terraform skills with Kubernetes deployment skills, while a Security Persona might group compliance skills with security scanning skills.

4. Provider

A Provider is a system that an Engineer can access, including cloud platforms (AWS, Azure, GCP), repositories, MCP Servers, and more. Each Provider is associated with a specific account or namespace and requires a credential reference for authentication. Credentials can be stored in DuploCloud or referenced externally, enabling just-in-time, scoped access to resources without exposing sensitive authentication data.

5. Scope

Scope defines what an Engineer can access within each Provider. Each Scope entry specifies a Provider and associated Credential, and includes granular access controls through regions, resource types, tags, or custom resource maps (key-value pairs for filtering specific resources like namespaces). Scope can also include MCP Servers for extended system access.

6. Guardrails

Guardrails define exceptions within a Scope, specifying what an Engineer cannot access or perform. These restrictions can target specific resources to exclude—such as a production database instances—specific operations that should be restricted, or entire environments that should be avoided. Guardrails provide fine-grained control over the Engineer's permissions within its broader Scope.

7. Quota and Quality of Service

Quota and Quality of Service (QoS) settings control resource limits for the Engineer. These controls can include maximum concurrent projects, token limits, and cloud resource provisioning limits. The system is designed to accommodate additional options in future versions as requirements evolve.

8. Knowledge Base

The Knowledge Base represents the Engineer's learned understanding of the environment. It captures architecture and topology information, relationships between systems, codebase structure, and historical context from completed work. This knowledge is stored both as files in customer repositories in markdown format and in a vector database within DuploCloud, enabling efficient retrieval and reference during operations.

Workflow concepts

Below are some of the workflow concepts in the AI DevOps Policy Model:

1. Project

A Project is a logical entity representing planned work. Each Project contains a Title and Summary. The heart of a Project are its requirements, which can be defined in plain English.

2. Requirements

Requirements are a user-generated document that enumerates a Project’s goals and objectives in natural language. Every Project includes associated user requirements, which may also specify how a Project’s goals are to be accomplished.

3. Plan

A Plan represents an execution plan containing tasks. It is an Agent-generated breakdown of how to accomplish a Project's Requirements. An Agent derives the Plan from the Requirements and requires human approval before execution. Plans are versioned whenever the underlying requirements change, ensuring full traceability. If you reject a Plan, you can provide feedback for regeneration, allowing iterative refinement until the Plan meets your requirements.

4. Task

A Task represents a unit of work within a Plan. An Agent generates Tasks from an approved Plan, and each Task is assigned to an Agent based on the Skill needed to complete it. Tasks require human approval before proceeding and become Tickets once approved. You have the flexibility to add new Tasks by providing feedback to the Agent and can override Task routing decisions within the Plan if needed.

DuploCloud is an agentic DevOps automation platform that leverages AI to accomplish a wide range of DevOps tasks. At the core of this platform is DuploCloud's AI DevOps Engineer that organizations can leverage for complex DevOps projects. Unlike traditional AI coding assistants that merely enhance human capabilities, the AI DevOps Engineer is an autonomous worker, with human-in-the loop governance, that can be onboarded, trained, assigned tasks, and managed just like a human team member.

What Can an AI DevOps Engineer Do for You?

• Manage projects related to deployments, migrations, observability, security, and compliance.

• Troubleshoot incidents end-to-end from setting up monitoring or alerting to responding in real time to outages and service degradations.

• Help with everyday tasks like infrastructure health reviews, code deployment, IaC maintenance, rollbacks, and backups.

• Perform other functions like collecting evidence for compliance audits, reporting, discovering cloud resources to generate documentation, and more.

DuploCloud’s AI DevOps Engineer is highly customizable. You can start with DuploCloud’s out-of-the-box engineers, extend them with specific capabilities tailored to your organization, or build entirely new engineers with specialized skills. Think of this as a self-hosted Claude Code, purpose-built for DevOps, with significantly more autonomy and control. The possibilities are endless!

Main Platform Components

Engineer Hub

The Engineer Hub is the home of all your specialized AI engineers, each capable of autonomously handling complex projects with a human-in-the-loop. In the hub, you can create Platform Engineers, CI/CD Engineers, SRE Engineers, and more, and manage your AI engineers' permissions, projects, and performance. Simply define your high-level project requirements and your AI engineer will convert them to a detailed plan coordinating a team of AI agents to complete the tasks to achieve your goals.

Agentic AI Helpdesk

The Agentic AI Helpdesk is where you go to achieve task-level objectives with the help of specialized agents. These agents are designed to execute specific tasks and include SRE, K8s, AWS, GCP, Docs, and Architecture agents. Modeled on a traditional IT help desk and accessible through a web browser, Slack, or Teams chat, or directly within an IDE extension (offering a "Cursor-like" experience), it lets you create tickets and assign them to AI agents, which then execute tasks in real time.

Integrations

The AI DevOps Engineer comes with a suite of integrations that help you accomplish tasks across cloud infrastructure provisioning, observability, security, compliance, cost, CI/CD, etc. These integrations provide real-world connectivity through tools and APIs, including:

• Cloud Providers: AWS, GCP, Azure

• Kubernetes: EKS, AKS, GKE

• Git Repositories: GitHub, GitLab, Bitbucket

DuploCloud manages cloud infrastructure in over two hundred organizations ranging from startup, small businesses to publicly listed companies. We categorize our clients into two segments:

• Young companies with little to no in-house DevOps expertise and very limited automation. Typically, these organizations want to completely revamp their DevOps stack and move to modern technologies like Kubernetes. In this scenario, DuploCloud is installed in a fresh cloud account, and the organization’s existing deployment is migrated to the new account using state-of-the-art automation, pipelines, security, observability, and compliance—supporting Kubernetes and serverless deployment models. Data sources like databases, S3 buckets, etc., are migrated to the new account or remain in existing accounts. The onboarding process is described in detail in the next section.

A Project is a logical entity representing planned work. Each Project includes a Title and Summary. The heart of a Project is its requirements, which are organized into Infrastructure, CI/CD, Workloads, Observability, Compliance, Security, and Cost. Projects can optionally define their own Scope as a subset of the Engineer's Scope. If no custom Scope is specified, the Project defaults to using the Engineer’s full Scope.

DuploCloud AI Suite is an advanced platform that transforms DevOps operations through purpose-built AI Agents that augment your existing infrastructure management capabilities. Designed to address the complexity of cloud operations and the scarcity of specialized DevOps expertise, AI Suite intelligently automates routine and complex tasks while maintaining a human-in-the-loop approach for critical decisions. The solution seamlessly integrates with your existing infrastructure and tooling, creating a secure collaborative environment between AI Agents and human operators.

The AI Suite consists of two primary components: AI Studio and AI HelpDesk. AI Studio enables the building, training, and deployment of specialized Agents for various DevOps functions including deployments, observability, CI/CD, security, incident management and more. AI HelpDesk provides an intuitive interface where end users can open tickets, interact with Agents, visualize operations through a shared browser, and maintain oversight of AI-executed commands in production environments. Together, these components deliver a comprehensive solution that enhances productivity, reduces operational overhead, and maintains the security and compliance standards intrinsic to the DuploCloud platform.

DuploCloud is committed to the responsible development and deployment of AI systems. If you have experienced or observed an adverse impact from any DuploCloud AI product—including unexpected behavior, bias, privacy concerns, security issues, or other harmful outcomes—we encourage you to report it.

Email: [email protected]

Reports may be submitted by anyone, whether or not you are a DuploCloud customer. We will acknowledge receipt of your report within one (1) business hour and investigate promptly. Please include a description of the issue, when it occurred, and any relevant details that can help us understand and address the concern.

Agents are AI-powered tools your Engineer uses on actual Project tasks, such as Kubernetes deployments or monitoring.

Adding an Agent

1. Navigate to Agents and click Add Agent.

1. Provide a Name, Description, technical details like access endpoint and path, and any needed metadata.

2. Click Update to create your Agent.

The DuploCloud Platform already provides several pre-built Agents that you can leverage.

For more details on how to create custom Agents on DuploCloud, see the .

Adding an AI DevOps Engineer streamlines DevOps while keeping you in control. Assemble your AI DevOps Engineer by combining Providers, Skills/Personas, and Agents.

Creating an Engineer

1. Navigate to Engineers and click Add Engineer.

1. Give the Engineer a Name and Description.

2. Select the Persona(s) to equip the Engineer with the needed Skills, and click Next.

1. Select the Agent(s) that you want this Engineer to use, and click Next.

1. Select the Providers and their respective Scopes for the Engineer.

1. Click Create.

Congratulations! Your Engineer is now ready to receive assignments, interpret goals, break down work, and provide a transparent audit trail—all with human oversight and control.

Cartography

DuploCloud Cartography is a Dockerized build of Cartography extended with custom DuploCloud intelligence and Neo4j models that unifies DuploCloud, Kubernetes, AWS, GitHub, and external systems into a single, queryable graph. It injects a Duplo ingestion stage at runtime (via sitecustomize) to ingest Tenants, Plans, Infrastructures, Hosts, Pods, Agents, and container versions, standardizing on IN_TENANT relationships for clean scoping and authorization. The project supports an optional dependencies manifest (local file or Kubernetes ConfigMap) to link workloads to Kubernetes objects, AWS resources (e.g., S3, RDS), and external services, while helper scripts and JIT credential support make it straightforward to run against Neo4j for local development or production.

GenAI-ToolBox

Presidio

The Duplo Presidio Service is a wrapper built on top of Microsoft Presidio that enhances its ability to detect and protect sensitive data by allowing custom recognizers and anonymizers. This ensures secrets, tokens, and credentials are automatically identified and protected before data leaves your Duplo-managed Kubernetes cluster.

A Persona is a logical container that groups related Skills by role or function. For example, an SRE Persona combines troubleshooting, monitoring, and incident response skills, a Provisioning Persona bundles Terraform and Kubernetes deployment skills, and a Security Persona groups compliance and security scanning skills.

Creating a Persona

1. Select Personas and click Add Persona.

1. Select the relevant Skills to include the Persona.

1. Click Update to create the Persona.

• Route 53 Hosted Zone

• ACM Certificate

• Shell access for Docker or ECS

• For Kubernetes prerequisites, see the .

Providers store credentials for connecting to cloud accounts, Kubernetes namespaces, incident tools, and other services. After adding Providers, you create Scopes that define what resources can be accessed. Permissions are then granted by assigning these Scopes to Engineers when creating or editing them.

Adding Providers and Defining Access Scopes

1. Navigate to to Providers and select the tab for the Provider type you are trying to add, e.g.,

MCP Servers provide an AI Engineer with access to essential external systems and tools that aren't directly part of cloud infrastructure or code repositories. This includes observability platforms (Prometheus, Grafana, Datadog), SIEM tools, ticketing systems, communication platforms, and specialized DuploCloud integrations.

Adding MCP Servers to an Engineer’s Scope

1. Navigate to MCP Servers

A Service could be a Kubernetes Deployment, StatefulSet, or DaemonSet. It can also be a Lambda function or an ECS task or service, capturing a microservice. Each Service (except Lambda) is given a Load Balancer to expose itself and is assigned a DNS name.

These tutorials are specific to various public cloud environments and demonstrate some of DuploCloud's most common use cases:

Several DuploCloud components are used with AWS, GCP, Azure, and Hybrid/On-Premises Services. These include Infrastructures, Plans, Tenants, Hosts, and Load Balancers. This section provides a conceptual explanation of the following common DuploCloud components:

In AWS, cloud features such as AWS resource groups, AWS IAM, AWS security groups, KMS keys, as well as Kubernetes Namespaces, are exposed in Tenants which reference their configurations.

For more information about DuploCloud Tenants, see the topic in the DuploCloud Common Components documentation.

Creating a Tenant

This section of the tutorial shows you how to deploy a web application with .

For a full discussion of the benefits of using EKS vs. ECS, consult.

Following is the scope of cloud provider resources (accounts) that a single DuploCloud Portal can manage:

Azure: A single DuploCloud Portal can manage multiple Azure subscriptions. Azure has native identity services like Azure Active Directory (Azure AD) and Entra ID, which provide managed identities that can be granted access across multiple subscriptions. DuploCloud inherits the permissions of these managed identities, allowing it to seamlessly access and manage resources across the Azure subscriptions it is connected to.

GCP: Similar to Azure, a single instance of DuploCloud can manage multiple GCP Projects.

AWS: In AWS a single DuploCloud Portal manages one and only one AWS account. This is inline with the AWS IAM implementation i.e. even in native AWS IAM model the building blocks like IAM Role, Instance Profiles do not span multiple accounts. The cross account SCP Policies are quite light weight. In fact AWS Organizations was added almost 10 years after the launch of AWS. For example, when a user logs in using AWS Identity Center, they have to choose an account and the session is scoped to that. See the picture below of the IAM login console.

Managing Tenant Expiration

In the DuploCloud Portal, configure an expiration time for a Tenant. At the set expiration time, the Tenant and associated resources are deleted.

1. In the DuploCloud Portal, navigate to Administrator -> Tenants

DuploCloud Diagnostics Functions

The DuploCloud platform automatically orchestrates the following main diagnostic functions:

This section is in progress. In the meantime, please see the prerequisite section under the DuploCloud user guide for your cloud provider:

Agents in DuploCloud AI Studio are specialized AI components designed to perform specific DevOps and infrastructure management functions. Each Agent serves as a dedicated expert in areas such as Kubernetes troubleshooting, observability analysis, CI/CD operations, or security monitoring. Built on foundation models and enhanced with the knowledge graph the DuploCloud DevOps Automation Platform provides.

Agent Definitions

Agent definitions form the blueprint for creating AI Agents within DuploCloud AI Studio. These definitions specify the Agent's capabilities, LLM, and knowledge sources. Each definition includes parameters such as the base model to use, required tools, permission scopes, and response formats. Agent definitions are version-controlled, allowing for systematic improvement and rollback capabilities. This declarative approach to Agent creation ensures consistency, reusability, and transparent governance of AI capabilities across your organization.

Prebuilt Agents

Prebuilt Agents are ready-to-use solutions developed outside of AI Studio that conform to DuploCloud's agent standards and interfaces. These Agents are packaged as Docker images with pre-configured APIs that seamlessly integrate with the AI HelpDesk. Prebuilt agents offer immediate value for common DevOps scenarios without requiring custom development. They're ideal for organizations seeking to rapidly implement AI assistance for standardized workflows or those with existing Agent implementations they wish to incorporate into the DuploCloud ecosystem.

Dynamic Agents

Dynamic Agents are built using DuploCloud's LangChain-based framework, allowing for flexible, composable Agentic AI solutions tailored to specific operational needs. These Agents are constructed at build time by combining a base Agent configuration with selected Tools from the AI Studio repository. The LangChain architecture enables dynamic Agents to reason through complex problems, execute appropriate Tools based on context, and maintain coherent conversations with users. This approach facilitates rapid prototyping and iteration, as Tools can be developed independently and combined in various configurations to create specialized Agents without rewriting core functionality.

Tools

Tools are modular, reusable components that enable Agents to perform specific actions or access particular systems. Built on LangChain's Tool framework, each Tool encapsulates a discrete capability such as executing Kubernetes commands, querying observability platforms, or managing cloud resources. Tools can be shared across multiple Agents, promoting code reuse and consistency in functionality. AI Studio provides a library of pre-built Tools for common DevOps tasks while supporting custom Tool development for organization-specific needs.

Builds

The build process transforms Agent definitions and associated Tools into deployable Docker images. During a build, AI Studio pulls the specified base Agent configuration, incorporates selected Tools, and packages everything into a containerized application with standardized API endpoints. Each build generates logs for troubleshooting and validation, and the resulting artifact is versioned for traceability. The build system manages dependencies, ensures proper initialization of language models, and optimizes the final image for performance.

Images

Agent images are Docker Images that encapsulate the AI agent's code, dependencies, etc.

Deployments

Deploying an Agent makes it available for use within your infrastructure. AI Studio streamlines deployment, allowing users to configure resource limits, replica counts, and environment variables to customize behavior. Each deployment is exposed with a Load Balancer and DNS record.

Registration

Registering an Agent connects a deployed agent instance into AI HelpDesk, making it available for user interaction through Tickets. During registration, you provide essential information including the Agent's friendly name, endpoint URL, API path for message handling, and applicable Tenant scopes.

AI HelpDesk serves as the central interface through which users engage with AI Agents in the DuploCloud ecosystem. It provides a structured, collaborative environment where DevOps tasks and infrastructure management operations can be executed with AI assistance while maintaining human oversight. The HelpDesk is designed to replicate the collaborative experience between engineers, offering visualization tools, command execution capabilities, and intuitive communication channels. This component of the AI Suite bridges the expertise gap in cloud operations by making specialized AI assistance readily available to all users regardless of their technical background. You can also interact with the AI HelpDesk directly in Slack (learn more here).

Key HelpDesk Features

Tickets

Tickets form the foundation of interaction within the AI HelpDesk, establishing a dedicated communication channel between a human user and an assigned AI Agent. Each ticket represents a specific task, request, or troubleshooting session that requires attention. When creating a ticket, users can select the appropriate AI Agent based on the nature of the task (such as Kubernetes troubleshooting, observability analysis, or deployment assistance). This ticketing system maintains context throughout the conversation, allowing for continuous collaboration until resolution while preserving a complete audit trail of actions and decisions for future reference.

Canvas

The Canvas is a dynamic, shared workspace within the HelpDesk Ticket that facilitates real-time collaboration between users and AI Agents. This interactive environment serves as a virtual "whiteboard" where both parties can visualize operations, execute commands, and share information seamlessly. This shared visual interface significantly enhances the effectiveness of human-AI interaction by providing transparency into the AI's reasoning and actions while allowing users to contribute their expertise when needed.

AI Suggested Commands

Within the Canvas, AI agents can analyze the current context and proactively suggest relevant terminal commands to address the task at hand. These suggested commands appear as interactive elements that users can approve, reject, ignore, or execute. This feature combines the AI's extensive knowledge of best practices with human judgment, preventing potentially harmful operations while expediting routine tasks. Each suggestion includes a brief explanation of its purpose and expected outcome, enabling users to learn while accomplishing their objectives efficiently.

Terminal

The Terminal component embedded within the Canvas provides users with direct command-line access to their infrastructure. When a user interacts with the Terminal, the AI Agent can observe these interactions, providing context-aware assistance, explaining unexpected outputs, or suggesting follow-up commands. This bidirectional visibility creates a seamless experience where users can freely switch between AI-guided operations and manual intervention. The Terminal maintains appropriate permission boundaries based on the user's role while providing the familiar command-line interface that DevOps professionals expect.

Users are also able to establish an interactive terminal session directly within a running application container from the HelpDesk Canvas. This capability is invaluable for troubleshooting application-specific issues, verifying configurations, or performing targeted diagnostics. The AI agent remains engaged during these application container shell sessions, offering assistance with application-specific commands and interpreting outputs in the context of the application's architecture. This deep level of access, combined with AI guidance, dramatically reduces the time required to identify and resolve application-level issues while maintaining security boundaries.

DuploCloud offers hands-on 24/7 support for all customers via Slack or email. Automation and developer self-service are at the heart of the DuploCloud Platform. We are dedicated to helping you achieve hands-off automation as fast as possible via rapid deployment of managed services or customized Terraform scripts using our exclusive Terraform provider. Additionally, you can access various help options, including product documentation and customer support, directly from the DuploCloud Portal. For real-time answers tailored specifically to your organization's needs, ask customer support about Ask DuploCloud, our AI-powered assistant.

How to Contact DuploCloud for Support

• Use the customer Slack or Microsoft Teams channel created during onboarding.

• Email us at [email protected].

• Click the chat icon () in the DuploCloud Portal to post your question. If we are unable to respond immediately, we will automatically create a ticket for you and someone from the DuploCloud engineering team will reach out to you ASAP

DuploCloud Support Features

Some of the support features we offer include:

• Debugging Agent performance and hallucinations.

• Configuring changes in your public cloud infrastructures and associated Kubernetes (K8s) Constructs managed by DuploCloud.

• Setting up CI/CD Pipelines.

Unsupported or Partially Supported Features

We cover most of your DevOps needs, but there are some limitations. Examples of needs we do not or only partially support include:

• Patching an application inside a Docker image.

• Monitoring alerts in a Network Operations Center (NOC).

• Troubleshooting application code.

How to Get Help From Within the DuploCloud Portal

From any page in the DuploCloud Portal, click the Help menu icon () in the upper right (next to your name and person icon) to access a variety of tools and links for your self-service DevOps needs.

• What's New: Stay informed about the latest features and updates in the DuploCloud Platform.

• FAQs: Access frequently asked questions to quickly find answers to common inquiries.

• Documentation: Browse through our comprehensive product documentation to help you navigate the Platform and optimize your usage.

DuploCloud is an agentic DevSecOps Automation platform that leverages AI for a wide range of Cloud Infrastructure automation needs. It encompasses DevOps, Security, Compliance, Observability and CI/CD. The software can:

• Configure and update resources safely and securely

• Write IAC (Cursor-like experience in an IDE)

• Troubleshoot incidents

• Perform several other functions like collect evidence for compliance audits, reporting, discover cloud resources to generate documentation, and so on.

The platform is composed of two main components:

Agentic Orchestration (AI Suite)

This module coordinates a collection of AI Agents specialized in DevOps operations. Together, these Agents function as an AI DevOps Engineer, capable of handling complex, high-level tasks delegated by users.

The primary user experience mirrors an IT Help Desk. Users can create tickets and assign them to AI Agents, which execute tasks in real time. The help desk interface is accessible through a web browser, Slack or Teams chat thread, or directly within an IDE extension (offering a “Cursor-like” experience).

Automation Platform

To effectively manage cloud infrastructure, AI Agents rely on a suite of automation tools. For example, enabling AI-driven observability requires an underlying observability framework such as Datadog or OpenTelemetry. DuploCloud’s automation platform delivers a comprehensive set of such capabilities, including:

• Provisioning Toolkit: Automates the creation and management of hundreds of cloud services such as EKS, AKS, GKE, S3, SQS, RDS, Azure SQL, and Google Cloud SQL. The toolkit is accessible to AI agents through MCP, Terraform provider, CLI, and APIs.

• Observability: Built on the OpenTelemetry stack, offering full-spectrum monitoring — including tracing, logging, alerting, profiling, infrastructure metrics, RUM, and SLO/SLA tracking.

• Security Tooling: Provides integrated SIEM, vulnerability assessment, antivirus, just-in-time access control, and other security mechanisms.

Teams can also bring their own automation tools whether built in-house or from a third party.

AI Orchestration Demo

Check out a quick video of the AI functionality.

Automation Platform Demo

Check out a 6-minute video overview of DuploCloud's comprehensive Automation Platform.

Hosts (VMs) are a cornerstone of cloud infrastructure, essential for providing isolated, scalable, and flexible environments for running applications and services. Hosts can exist in various forms and configurations, depending on the environment and the technology stack.

For instructions to create a Host in DuploCloud, see the documentation for your specific cloud provider:

• AWS Host

• Azure Host

In DuploCloud, Hosts are virtualized computing resources provided by your cloud service provider (e.g., AWS EC2, Google Compute Engine, Azure VMs) or your organization's data center and managed by the DuploCloud Platform. They are used to provision scalable, on-demand infrastructure. DuploCloud abstracts the complexities of provisioning, configuring, and managing these Hosts. DuploCloud supports the following Host contexts:

• Public Cloud: VMs provided by cloud providers and managed through the DuploCloud Platform.

• Private Cloud: Virtualized environments managed within an organization's data center.

• Combination of On-Premises and Cloud: A mix of physical hosts, VMs, and cloud-hosted instances.

DuploCloud integrates natively with OpenVPN by provisioning VPN users in the Duplocloud Portal. As a DuploCloud user, you can access resources in the private network by connecting to the VPN with the OpenVPN client.

Obtaining VPN Credentials

VPN credentials are listed on your user profile page in the DuploCloud Portal. It can be accessed by clicking the user icon () and selecting Profile.

Setting up the OpenVPN User Profile and Client App

1. Click on the VPN URL link in the VPN Details section of your user profile. Modern browsers will call the link unsafe since it uses a self-signed certificate. Make the necessary selections to proceed.

2. Log into the OpenVPN Access Server user portal using the username and password from the VPN Details section of your DuploCloud user profile page.

1. Click on the OpenVPN Connect Recommended for your device icon to install the OpenVPN Connect app for your local machine.

1. Navigate to your downloads folder, open the OpenVPN Connect file you downloaded in the previous step, and follow the prompts to finish the installation.

2. In the OpenVPN access server dialog box, click on the blue Yourself (user-locked profile) link to download your OpenVPN user profile.

3. Navigate to your Downloads folder and click on the .ovpn file downloaded in the previous step. The Onboarding Tour dialog box displays.

1. Click OK, and select Connect after import. Click Add in the upper right. If prompted to enter a password, use the password in the VPN Profile area of your user profile page in the DuploCloud Portal. You are now connected to the VPN.

This section of the tutorial shows you how to deploy a web application with a DuploCloud Docker Service, by leveraging DuploCloud platform in-built container management capability.

Deploying a DuploCloud Docker Service

Instead of creating a DuploCloud Service using EKS or ECS, you can deploy your application with native Docker containers and services.

To deploy your app with a DuploCloud Docker Service in this tutorial, you:

1. Create an EC2 host instance in DuploCloud.

2. Create a native Docker application and Service.

3. Expose the app to the web with an Application Load Balancer in DuploCloud.

Estimated time to complete remaining tutorial steps: 30-40 minutes

Network Architecture and Configurations

Behind the scenes, the topology that DuploCloud creates resembles this low-level configuration in AWS.

Enabling EKS logging while creating an Infrastructure

Follow the steps in the section Creating an Infrastructure. In the EKS Logging list box, select one or more ControlPlane Log types.

Enabling EKS logging for an existing Infrastructure

Enable EKS logging for an Infrastructure that you have already created.

1. In the DuploCloud Portal, navigate to Administrator -> Infrastructure.

2. From the NAME column, select the Infrastructure for which you want to enable EKS logging.

3. Click the Settings tab.

In the DuploCloud platform, a Kubernetes Cluster maps to a DuploCloud Infrastructure.

Start by creating a new Infrastructure in DuploCloud. When prompted to provide details for the new Infrastructure, select Enable EKS. In the EKS Version field, select the desired release.

Optionally, enable logging and custom EKS endpoints.

When the Infrastructure is in the ready state, as indicated by a Complete status, navigate to Kubernetes -> Services and select the Infrastructure from the NAME column to view the Kubernetes configuration details, including the token and configuration for kubectl.

When you create Tenants in an Infrastructure, a namespace is created in the Kubernetes cluster with the name duploservices-TENANT_NAME

The DuploCloud platform installs in an EC2 instance within your AWS account. It can be accessed using a web interface, API, or Terraform provider.

You can log in to the DuploCloud portal, using single sign-on (SSO), with your GSuite or O365 login.

Before You Begin

Before getting started, complete the following steps:

• Read the and learn about DuploCloud terms like , , and

• Set up the DuploCloud Portal

• Read the section and ensure at least one person has administrator access

• Connect to the DuploCloud Slack channel for support from the DuploCloud team

Configuring Cluster Autoscaler for your Infrastructure

The Cluster AutoScaler automatically adjusts the number of nodes in your cluster when Pods fail or are rescheduled onto other nodes.

1. In the DuploCloud Portal, navigate to Administrator -> Infrastructure. The Infrastructure page displays.

2. From the NAME column, select the Infrastructure with which you want to use Cluster AutoScaler.

3. Click the Settings tab.

4. Click Add. The Add Infra - Set Custom Data pane displays.

5. From the Setting Name list box, select Cluster Autoscaler.

6. Select Enable to enable EKS.

7. Click Set. Your configuration is displayed in the Settings tab.

Configuring Tenant Config settings

You can configure settings to apply to all new Tenants under a Plan using the Config tab. Tenant Config settings will not apply to Tenants created under the Plan before the settings were configured.

1. From the DuploCloud portal, navigate to Administrator -> Plan.

2. Click on the Plan you want to configure settings under in the NAME column.

3. Select the Config tab.

4. Click Add. The Add Config pane displays.

5. From the Config Type field, select TenantConfig.

6. In the Name field, enter the setting that you would like to apply to new Tenants under this Plan. (In the example, the enable_alerting setting is entered.)

7. In the Value field, enter True.
8. Click Submit. The setting entered in the Name field (enable alerting in the example) will apply to all new Tenants added under the Plan.

Viewing Tenant Config settings

You can check that the Tenant Config settings are enabled for new Tenants on the Tenants details page, under the Settings tab.

1. From the DuploCloud portal, navigate to Administrator -> Tenants.

2. From the NAME column, select a Tenant that was added after the Tenant Config setting was enabled.

3. Click on the Settings tab.

An AWS VPC endpoint creates a private connection to supported AWS services and VPC endpoint services powered by AWS PrivateLink. Amazon VPC instances do not require public IP addresses to communicate with the resources of the service. Traffic between an Amazon VPC and a service does not leave the Amazon network.

VPC endpoints are virtual devices. They are horizontally scaled, redundant, and highly available Amazon VPC components that allow communication between instances in an Amazon VPC and services without imposing availability risks or bandwidth constraints on network traffic. There are two types of VPC endpoints, Interface Endpoints, and Gateway Endpoints.

DuploCloud allows you to specify predefined AWS endpoints for your Infrastructure in the DuploCloud Portal.

Adding VPC endpoints to a Duplocloud Infrastructure

1. In the DuploCloud Portal, navigate to Administrator -> Infrastructure. The Infrastructure page displays.

2. Select the Infrastructure to which you want to add VPC endpoints.

3. Click the Endpoints tab.

Once you have the Infrastructure (Networking, Kubernetes cluster, and other standard configurations) and an environment (Tenant) set up, the next step is to launch EC2 virtual machines (VMs). You create VMs to be:

• EKS Worker Nodes

• Worker Nodes (Docker Host), if the built-in container orchestration is used.

You also create VMs if Regular nodes are not part of any container orchestration. For example, a user manually connects and installs apps, as when using Microsoft SQL Server in a VM, Running an IIS application, or such custom use cases.

While all the lower-level details like IAM roles, Security groups, and others are abstracted away from the user (as they are derived from the Tenant), standard application-centric inputs must be provided. This includes a Name, Instance size, Availability Zone choice, Disk size, Image ID, etc. Most of these are optional, and some are published as a list of user-friendly choices by the admin in the plan (Image or AMI ID is one such example). Other than these AWS-centric parameters, there are two DuploCloud platform-specific values to be provided:

Agent Platform: This is applicable if the VM is going to be used as a host for by the platform. The choices are:

• EKS Linux: If this is to be added to the EKS cluster. For example, EKS is the chosen approach for container orchestration

• Linux Docker: If this is to be used for hosting Linux containers using the

• Docker Windows: If this is to be used for hosting Windows containers using the

Allocation Tags (Optional): If the VM is being used for containers, you can set a label on it. This label can then be specified during docker app deployment to ensure the application containers are pinned to a specific set of nodes. Thus, you can further split a tenant into separate server pools and deploy applications.

The DuploCloud Platform needs a wild character AWS Certificate Manager (ACM) certificate corresponding to the domain for the Route 53 Hosted Zone.

For example, if the Route 53 Hosted Zone created is apps.acme.com, the ACM certificate specifies *.apps.acme.com. You can add additional domains to this certificate (for example, *.acme.com).

The ACM certificate is used with AWS Elastic Load Balancers (ELBs) created during DuploCloud application deployment. Follow this AWS guide to issue an ACM certificate.

Once the certificate is issued, add the Amazon Resource Name (ARN) of the certificate to the DuploCloud Plan (starting with the DEFAULT Plan) so that it is available to subsequent configurations

Adding an ACM Certificate with ARN to a DuploCloud Plan

1. In the DuploCloud Platform, navigate to Administrator -> Plans. The Plans page displays.

2. Select the default Plan from the NAME column.

3. Click the Certificates tab.

Enabling Automatic AWS ACM Certificate Creation

Configure DuploCloud to automatically generate Amazon Certificate Manager (ACM) certificates for your Plan's DNS.

1. From the DuploCloud portal, navigate to Administrator -> Systems Settings.

2. Select the System Config tab, and click Add. The Add Config pane displays.

3. From the Config Type list box, select Flags.

The DuploCloud Policy Model is an application-infrastructure-centric abstraction created atop the user's cloud provider account. The following diagram shows the abstractions within which applications are deployed and users operate. The below bullet points are a brief introduction to the concepts and subsequent sub-pages explain this in details

• DuploCloud Platform installs in customer's cloud account. In case of Azure and GCP, a single instance can manage multiple subscriptions and GCP projects respectively. In case of AWS we need one Agent per AWS account, but they come together in a federated fashion to expose a single interface. This is described more in detail under the Management Portal Scope Section below

• Infrastructure: An infrastructure maps to a VPC in a region with optionally a Kubernetes Cluster. One cloud account (AWS account, GCP project or Azure subscription) can have multiple infrastructures (1:N). For more details of infrastructure see .

• Plan: When you create an in DuploCloud, a Plan is automatically generated. A Plan is a placeholder or a template for configurations. These configurations are consistently applied to all Tenants within the Plan (or Infrastructure). For more details of Plan

• Tenant: A Tenant is like an environment and is a child of the Infrastructure. It is the most fundamental construct in DuploCloud. While Infrastructure is a VPC-level isolation, Tenant is the next level of isolation implemented by segregating Tenants using concepts like Security Groups, IAM roles, Instance Profiles, K8S Namespaces, KMS Keys, etc. For more details of Tenant see the

Skills define the tasks your AI Engineer can perform, like Kubernetes operations, CI/CD workflows, or security tasks. Multiple Skills can be grouped into Personas which represent specific roles (for example, DevOps Engineer or Full Stack Engineer).

At its core, a Skill is a folder containing a SKILL.md file. This file includes required metadata (at minimum, name and description), and instructions that tell the Agent how to perform a specific task. A Skill can also include supporting assets such as scripts, templates, and reference materials. .

There are three ways to assign Skills to an Engineer:

Pre-Built Skills: The DuploCloud platform provides pre-built Skills that you can use to quickly create and configure your first Engineer.

External Skills: You can use Skills from third-party vendors directly within the platform. Examples include:

Phase 1. Kickoff and Delivery

During Kickoff and Delivery, your Team learns about the DuploCloud onboarding flow and what to expect in each phase. Our Team works closely with yours to review your project scope and objectives, technical specifications and information, and important dates and deadlines.

By the end of this phase, DuploCloud engineers will configure a DuploCloud Platform in your company's cloud account. We will ask your Team for any feedback about the onboarding approach to improve the process in the future.

Getting Started and Infrastructure

What is the infrastructure cost of running the DuploCloud AI Suite?

Infrastructure costs (EC2 instances, load balancers, S3 buckets, Bedrock LLM cost) are typically estimated at $80-150 per month. LLM/Bedrock costs will only apply when you actively use the features and will be a few dollars per month. Additional costs may apply depending on your specific use case.

When you create an in DuploCloud, a Plan is automatically generated. A Plan is a placeholder or a template for configurations. These configurations are consistently applied to all Tenants within the Plan (or Infrastructure). Examples of such configurations include:

• Certificates available to be attached to Load Balancers in the Plan's Tenants

• Machine images

Duplo Presidio

The Duplo Presidio Service is a wrapper built on top of that enhances its ability to detect and protect sensitive data by supporting custom recognizers and anonymizers.

This ensures that secrets, tokens, passwords, and credentials are automatically identified and anonymized before data leaves your Duplo-managed Kubernetes cluster. By disabling irrelevant recognizers and introducing project-specific patterns, we reduce noise and improve accuracy.

To generate logs for AWS ECS clusters, you must first create an Elasticsearch logging container. Once auditing is enabled, your container logging data can be captured for analysis.

Prerequisites

Infrastructures are abstractions that allow you to create a Virtual Private Cloud (VPC) instance in the DuploCloud Portal. When you create an Infrastructure, a (with the same Infrastructure name) is automatically created and populated with the Infrastructure configuration.

For instructions to create an Infrastructure in the DuploCloud Portal, see:

Managing Tenant session duration

In the DuploCloud Portal, configure the session duration time for all Tenants or a single Tenant. At the end of a session, the Tenants or Tenant ceases to be active for a particular user, application, or Service.

For more information about IAM roles and session times in relation to a user, application, or Service, see the .

You enabled ECS cluster creation when you created the . In order to create a Service using ECS, you first need to create a that serves as a blueprint for your application.

Once you create a Task Definition, you can run it as a Task or as a Service. In this tutorial, we run the Task Definition as a Service.

Estimated time to complete Step 4: 10 minutes.

You can use the DuploCloud Portal to create a native Docker service without leaving the DuploCloud interface.

Estimated time to complete Step 5: 10 minutes.

Prerequisites

Before creating a Service, verify that you completed the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

Setting up an Infrastructure that uses ECS is similar to creating an , except that during creation, instead of selecting Enable EKS, you select Enable ECS Cluster.

For more information about ECS Services, see the documentation.

DuploCloud integrates with OpenVPN by provisioning VPN users that you add to the DuploCloud Portal. OpenVPN setup is a comprehensive process that includes accepting OpenVPN, provisioning the VPN, adding users, and managing connection limits to accommodate a growing team.

Accepting OpenVPN

Accept OpenVPN Free Tier (Bring Your Own License) in the AWS Marketplace:

So far in this DuploCloud AWS tutorial, you created a VPC network with configuration templates (), an isolated workspace (), and an (optionally).

Now you need to create a DuploCloud Service on top of your Infrastructure and configure it to run and deploy your application. In this tutorial path, we'll deploy an application using Docker containers and leveraging .

Alternatively, you can finish this tutorial by:

• running Docker containers

Once an EC2 Instance is created, you connect it with SSH either by using Session ID or by downloading a key.

Connecting to an EC2 Linux instance using SSH

In the DuploCloud Portal, navigate to Cloud Services -> Hosts and select the host to which you want to connect.

The AI HelpDesk provides a conversational interface for managing infrastructure tasks through AI-powered Tickets. Each Ticket connects you to an intelligent AI Agent who can reason through problems, suggest commands, and collaborate with you in real time via the Canvas workspace.

Creating a Ticket

To begin a new interaction, users create a Ticket within the context of a specific Tenant, ensuring that all Agent actions and suggestions occur within the correct infrastructure scope. When creating a Ticket, the system requires selecting an AI Agent with the appropriate domain expertise, such as Kubernetes operations, observability, or deployment troubleshooting. A ticket can include input from multiple Agents. This allows for collaboration across different domains (for example, Kubernetes and Observability) within the same troubleshooting session.

To create a Ticket, complete the following steps:

1. Navigate to AI Suite -> HelpDesk.

2. Select the appropriate Agent and Instance. Other Agents can be assigned to the Ticket later if new capabilities are needed, see below.

3. In the Message to Agent field, describe your task or problem, or choose one of the provided prompts (for details on customizing prompt suggestions, see the ).

Collaborating in the Canvas

Each Ticket provides a Canvas, a dynamic, interactive workspace. The Canvas preserves the state of the interaction, ensuring continuity across multiple exchanges and allowing users to collaborate with the AI Agent as a knowledgeable partner.

In the Canvas you can:

• Send messages to the AI Agent

• View the agent’s reasoning and suggestions

• Track task progress over time

Reviewing Suggested Commands

As the conversation evolves, the AI Agent may propose command-line instructions based on the context of the Ticket. These suggestions appear within the Canvas and are fully interactive. You can:

• Approve the command, queuing it for execution the next time a message is sent to the Agent.

• Reject the command, optionally providing feedback such as preferences or restrictions (e.g., “Avoid using describe commands”).

• Ignore the suggestion, leaving it unacknowledged.

Taking Action in the Terminal

Embedded in the Canvas is a shared Terminal that gives you secure, real-time command-line access to your environment, directly from the workspace. You can respond to AI Agent suggestions or run your own diagnostics and scripts, while the Agent, if granted access, can view the commands you’ve executed and suggest its own. This creates a collaborative space for you and the AI Agent to can work together.

To access the Terminal:

1. Click Terminal in the Canvas and select the desired scope:

   • Admin Terminal: select for full environment-level access.

   • Tenant Terminal: select to limit commands to a specific Tenant.

All Terminal input and output are automatically saved to the Ticket history. Shared context allows the Agent to provide more accurate suggestions in future interactions while you maintain control over what is shared.

Using Agent-Suggested Resources

As part of a Ticket interaction, the AI Agent may provide helpful supporting resources in the form of clickable links, URLs and files. These assets are tailored to the specific context of your request and are intended to accelerate troubleshooting or task completion.

• Clickable links: follow Agent-provided links to web resources like access guides, external articles, or other resources relevant to your request.

• URLs: Open URLs in a new tab to access dashboards, CI/CD pipeline, logs, and more without leaving the Canvas, enabling monitoring or review of deployment activity.

• Temporary files: Access scripts, manifests, configuration templates, or log snapshots stored in a secure Canvas directory. View and edit them directly in the embedded Terminal, with changes visible to the Agent; the directory is automatically deleted when the Ticket is resolved or closed.

Managing Tickets

DuploCloud HelpDesk allows you to manage your Tickets efficiently. You can access past Tickets for reference, assign a different AI Agent to a Ticket for additional expertise, switch between open Tickets, update Ticket status, or delete Tickets.

1. From the HelpDesk, select one of the following options:

DuploCloud AI Suite Release - 09/05/2025

Overview

We're excited to introduce DuploCloud AI Suite, a comprehensive artificial intelligence platform that transforms how you manage cloud infrastructure. This inaugural release brings intelligent automation to DevOps workflows through specialized AI Agents that work alongside your team to solve complex infrastructure challenges.

What's New

AI Studio

Build and Deploy Custom AI Agents

AI Studio provides everything you need to create, customize, and deploy AI Agents tailored to your organization's needs:

• Agent Specification Builder - Define your Agent's capabilities and behavior

• Vector Database Support - Enable Agents to access and search your documentation and knowledge base

• One-Click Deployment - Automatically deploy Agents to Kubernetes

HelpDesk

Intelligent Support with Human Oversight

HelpDesk transforms traditional IT support through AI-powered assistance while maintaining complete human control:

Smart Ticketing System

• Create tickets and get matched with the most appropriate AI Agent

• View, search, and filter tickets

• Track Agent assignments and ticket status in real time

Collaborative AI Assistance

• Human-in-the-Loop Approval - All Agent actions require your explicit approval before execution

• Shared Canvas - Work side-by-side with AI Agents in a collaborative workspace

• Interactive Terminal - Share a live terminal where both you and the Agent can run commands

Advanced Security Controls

• Double Approval - Sensitive commands require additional confirmation for extra security

• Credential Proxying - Agents use your permissions, never their own

• Smart Prompt Suggestions - Get started quickly with Agent-specific conversation starters

Flexible Access

• Standalone Interface - Full-featured HelpDesk application

• Chat Bubble Integration - Quick access from anywhere in the DuploCloud platform

Available AI Agents

Kubernetes Agent

Your intelligent Kubernetes troubleshooting companion that can:

• Diagnose deployment issues and container problems

• Create new deployments and services

• Perform cluster maintenance and optimization tasks

Observability Agent

Powered by DuploCloud's Advanced Observability Suite, this Agent helps you:

• Retrieve and analyze metrics and logs for any microservice

• Identify performance bottlenecks and anomalies

• Get intelligent insights from your OpenTelemetry data

CI/CD Agent

Intelligent pipeline support that automatically:

• Monitors your Jenkins and GitHub Actions pipelines

• Creates support tickets when builds fail

• Attaches relevant logs, configuration, and error details

Architecture Diagram Agent

Transform complex infrastructure into clear visuals:

• Generate architecture diagrams using natural language descriptions

• Automatically map relationships between services, databases, and infrastructure

• Create shareable Mermaid diagrams of your entire technology stack

Private GPT Agent

Secure AI assistance for security-conscious organizations:

• Private ChatGPT-like experience using AWS Bedrock

• Complete data privacy with enterprise-grade security

• Perfect for teams who need AI assistance without third-party data sharing

Supporting Infrastructure

DuploCloud Cartography

• Automatic Discovery - Continuously maps your AWS, Kubernetes, and DuploCloud resources

• Relationship Mapping - Understands dependencies between microservices and infrastructure

• Custom Dependencies - Define application-specific relationships for complete visibility

DuploCloud Presidio

• Data Protection - Automatically redacts sensitive information in AI conversations

• Customizable Rules - Configures what data should be protected based on your security policies

• Privacy-First - Ensures sensitive data never leaves your environment

Key Benefits

🤖 Intelligent Automation - AI Agents that understand your infrastructure and can take action with your approval

🛡️ Security First - Human oversight for all actions with your credentials, never autonomous access

🚀 Faster Resolution - Collaborative workspace where you and AI work together to solve problems

📊 Better Insights - Automatic diagram generation and intelligent analysis of your systems

🔒 Enterprise Ready - Private AI models with complete data privacy and security controls

Enable and access shells for your DuploCloud Docker, EKS, and ECS containers directly through the DuploCloud Portal. This provides quick and easy access for managing and troubleshooting your containerized environments.

Native Docker Shell Access

Enabling the Shell for Docker

1. In the DuploCloud Portal, navigate to Docker -> Services.

2. From the Docker list box, select Enable Docker Shell. The Start Shell Service pane displays.

1. In the Platform list box, select Docker Native.

2. From the Certificate list box, select your certificate.

3. From the Visibility list box, select Public or Internal.

Accessing the Shell for Docker

1. From the DuploCloud portal, navigate to Docker -> Containers.

2. In the row of the container you want to access, click the options menu icon ( ).

3. Select Container Shell. A shell session launches directly into the running container.

EKS Shell Access

Enabling the Shell for Kubernetes

1. In the Tenant list box, select the Default Tenant.

2. In the DuploCloud Portal, navigate to Docker -> Services.

3. Click the Docker button, and select Enable Docker Shell. The Start Shell Service pane displays.

1. In the Platform list box, select Kubernetes.

2. In the Certificate list box, select your certificate.

3. In the Visibility list box, select Public or Internal.

Accessing the Shell for Kubernetes

1. From the DuploCloud Portal, navigate to Kubernetes -> Services.

2. Click the KubeCtl Shell button. The Kubernetes shell launches in your browser.

ECS Shell Access

Accessing the Shell for ECS

1. From the DuploCloud Portal, navigate to Cloud Services -> ECS. The ECS Task Definition page displays.

2. Select the name from the TASK DEFINITION FAMILY NAME column.

3. Select the Tasks tab.

Now that you've created a Task Definition, create a Service, which creates a Task (from the definition) to run your application. A Task is the instantiation of a Task Definition within a cluster. After you create a task definition for your application within Amazon ECS, you can specify multiple tasks to run on your cluster, based on your performance and availability requirements.

Once a Service is created, you must create a Load Balancer to expose the Service on the network. An Amazon ECS service runs and maintains the desired number of tasks simultaneously in an Amazon ECS cluster. If any of your tasks fail or stop, the Amazon ECS service scheduler launches another instance based on parameters specified in your Task Definition. It does so in order to maintain the desired number of tasks created.

Estimated time to complete Step 5: 10 minutes.

Prerequisites

Before creating the ECS Service and Load Balancer, verify that you accomplished the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• The NONPROD infrastructure has .

• A Tenant named .

Creating an ECS Service and Load Balancer

1. In the DuploCloud Portal's Tenant list box, select dev01.

2. Navigate to Cloud Services -> ECS.

1. In the Name field, enter sample-httpd-app as the Service name.

2. In the LB Listeners area, click Add. The Add Load Balancer Listener pane displays.

Checking Your Work

In the Service Details tab, information about the Service and Load Balancer you created is displayed. Verify that the Service and Load Balancer configuration details in the Service Details tab are correct.

Creating an AWS EKS Service uses technologies from AWS and the Kubernetes open-source container orchestration system.

Kubernetes uses worker nodes to distribute workloads within a cluster. The cluster automatically distributes the workload among its nodes, enabling seamless scaling as required system resources expand to support your applications.

Estimated time to complete Step 4: 5 minutes.

Prerequisites

Before creating a Host (essentially a ), verify that you completed the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• The NONPROD infrastructure has .

• A named dev01 has been created.

Select the Tenant You Created

In the Tenant list box, select the dev01 Tenant that you created.

Creating a Host

1. In the DuploCloud Portal, navigate to Cloud Services -> Hosts. The Hosts page displays.

2. In the EC2 tab, click Add. The Add Host page displays.

3. In the Friendly Name field, enter

Checking Your Work

1. In the DuploCloud Portal, navigate to Cloud Services -> Hosts.

2. Select the EC2 tab.

3. Verify that the Host status is Running.

DuploCloud automatically creates and manages DNS records for many resources you deploy, such as Kubernetes Services or VM hosts with public IPs, by integrating with your cloud provider’s DNS service. These DNS records are essential for routing traffic to your workloads and Services.

In most cases, DNS names are created automatically and can be customized within the DuploCloud Platform. However, you may sometimes need to manually configure or troubleshoot DNS entries, such as when using custom domain names, ensuring DuploCloud doesn’t overwrite DNS records you manage outside of the platform, or resolving DNS failures.

Prerequisites

• Configure your DNS zones: Make sure your DNS zones are properly configured in both DuploCloud and your cloud provider. This often involves setting up subdomain zones (like apps.mycompany.com) and connecting them to DuploCloud. See DNS setup instructions for your cloud provider:

  • AWS:

  • GCP:

Adding Custom DNS Names

You can configure a custom DNS name for resource directly in the DuploCloud Platform, or manually in your cloud provider’s platform.

Creating Custom DNS Names in DuploCloud

For resources that DuploCloud manages (like services behind Load Balancers), you can customize the automatically generated DNS name:

1. In the Tenant list box, select the Tenant.

2. Navigate to the Services page (Kubernetes -> Services, or Docker -> Services). The Services page displays.

3. Select your Service from the NAME

Creating Custom DNS Names in Your Cloud Provider

For resources that don’t have DNS configuration in DuploCloud (e.g., non-Kubernetes services), you will need to manually add DNS entries in your cloud provider’s DNS service.

• For AWS:

• For GCP:

• For Azure:

Configuring DuploCloud to Ignore DNS Entries

If you create a DNS entry directly in your cloud provider’s platform (AWS, Google Cloud, or Azure), DuploCloud may delete it during updates, as it automatically deletes any DNS entries it did not create. To prevent this from happening, configure Systems Settings to ignore specific DNS entries.

1. From the DuploCloud Portal, navigate to Administrator -> System Settings -> System Config.

2. Click Add. The Add Config pane displays.
3. Fill the fields:

1. Click Submit. DuploCloud will ignore the specified DNS prefixes.

Resolving DNS Failures

Occasionally, DNS resolution can fail on local machines, especially for private resources behind VPNs. This is often caused by incorrect DNS server settings or local DNS caching.

To fix this:

• Use public DNS servers like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare).

• Flush your DNS cache.

• Verify VPN connection if accessing private resources.

Now that your DuploCloud Service is running, you have a mechanism to expose the containers and images in which your application resides. However, since your containers are inside a private network, you need a Load Balancer listening on the correct ports to access the application.

In this step, we add a Load Balancer Listener to complete the network configuration.

Estimated time to complete Step 6: 10 minutes.

Prerequisites

Before creating a Load Balancer, verify that you completed the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• The NONPROD infrastructure has .

• A Tenant named .

Creating a Load Balancer

1. In the Tenant list box, select the dev01 Tenant.

2. In the DuploCloud Portal, navigate to Kubernetes -> Services.

3. From the NAME column, select demo-service.

1. From the Type list box, select Application LB.

2. In the Container Port field, enter 3000. This is the configured port on which the application inside the Docker Container Image duplocloud/nodejs-hello:latest is running.

3. In the

Checking your work

1. In the Tenant list box, select the dev01 Tenant.

2. In the DuploCloud Portal, navigate to Kubernetes -> Services.

3. From the NAME column, select demo-service.

Now that your DuploCloud Service is running, you have a mechanism to expose the containers and images in which your application resides. Since your containers are in a private network, you need a Load Balancer to make the application accessible.

In this step, we add a Load Balancer Listener to complete this network configuration.

Estimated time to complete Step 6: 15 minutes.

Prerequisites

Before creating a Load Balancer, verify that you completed the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• A Tenant named .

• An EC2 Host named .

Creating a Load Balancer using Native Docker

1. In the Tenant list box, select dev01.

2. Navigate to Docker -> Services.

3. Select the Service demo-service-d01 .

When the LB Status card displays Ready, your Load Balancer is running and ready for use.

Securing the Load Balancer

If you want to secure the load balancer created, you can follow the steps specified

Creating a Custom DNS Name

You can modify the DNS name by clicking Edit in the DNS Name card in the Load Balancers tab. For more info about DNS setup and custom DNS names, see the .

In this tutorial step, for the Application Load Balancer (ALB) you created in Step 6, you will:

• Enable access logging to monitor details and record incoming traffic data. Access logs are crucial for analyzing traffic patterns and identifying potential threats, but they are not enabled by default. You must manually activate them in the Load Balancer settings.

• Protect against requests that contain .

Estimated time to complete Step 7: 5 minutes.

Prerequisites

Before securing a Load Balancer, verify that you accomplished the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• The NONPROD infrastructure has EKS.

• A Tenant named .

Securing the Load Balancer

1. In the Tenant list box, select the dev01 Tenant.

2. In the DuploCloud Portal, navigate to Kubernetes -> Services.

3. From the NAME column, select the Service (demo-service).

Checking Your Work

1. In the Tenant list box, select the dev01 Tenant.

2. In the DuploCloud Portal, navigate to Kubernetes -> Services.

3. From the NAME column, select the Service (demo-service).

• Web ACL - None

• HTTP to HTTPS Redirect - False

• Enable Access Logs - True

Enabling access logs enhances the security and monitoring capabilities of your Load Balancer and provides insights into the traffic accessing your application, for a more robust security posture.

To enable automatic DNS record creation in AWS, the DuploCloud Platform requires a unique Route 53 hosted zone. This hosted zone must be created outside of DuploCloud and configured as a DNS suffix in your infrastructure Plans. The domain should be a dedicated subdomain, such as apps.[MY-COMPANY].com.

For more details on how DNS works in DuploCloud and how to set up custom DNS names, see the DNS Configuration documentation.

Creating a Route 53 Hosted Zone Using AWS Console

To enable DuploCloud to manage DNS records automatically, you need to create a dedicated Route 53 Hosted Zone in your AWS account.

1. Log in to .

2. Navigate to Route 53 and Hosted Zones.

3. Create a new Route53 Hosted Zone with the desired domain name, for example, apps.acme.com.

Once delegation is complete, provision the Route 53 Hosted Zone in each DuploCloud Plan—starting with the DEFAULT Plan, as described in the following section.

Configuring DNS for a Plan

Configure a DuploCloud Plan to support automatic DNS record creation using AWS Route 53. Start by updating the DEFAULT Plan, then repeat the configuration for any additional Plans where DNS-managed Services or Ingresses will be deployed. DNS settings are not shared across Plans.

1. In the DuploCloud Portal, navigate to Administrator → Plans.

2. Click the name of the Plan from the NAME column (e.g., DEFAULT).

3. Select the DNS tab.

1. Click Save to apply your changes.

Once the Load Balancer is created, DuploCloud programs an autogenerated DNS Name registered to demo-service in the Route 53 domain. Before you create production deployments, you must create the Route 53 Hosted Zone domain (if DuploCloud has not already created one for you). For this tutorial, it is not necessary to create a domain.

Estimated time to complete Step 8: 5 minutes.

Prerequisites

Before securing a Load Balancer, verify that you completed the tasks in the previous tutorial steps. Using the DuploCloud Portal, confirm that:

• An exist, both named NONPROD.

• The NONPROD infrastructure has .

• A Tenant named .

Creating a Custom DNS Name

1. In the Tenant list box, select the dev01 Tenant.

2. Navigate to Kubernetes -> Services. The Services page displays.

3. From the Name column, select demo-service.

An entry for your new DNS name is now registered with demo-service.

Checking Your Work

1. Navigate to Kubernetes -> Services.

2. From the Name column, select demo-service.

3. Select the Load Balancers tab and verify that the DNS Name card displays your modified DNS Name.

Creating an Infrastructure

1. Click Add. The Add Infrastructure pane displays.

2. Define the Infrastructure by completing the fields: