Fleet overview

Git repository

GitHub / GitLab — source of truth

commit → webhook

ArgoCD hub

Management cluster, ApplicationSets

→

EKS

AWS prod

AKS

Azure prod

GKE

GCP prod

kubeadm

DC primary

RKE2

DC secondary

OpenShift

Regulated DC

Cluster labels (ArgoCD cluster secret annotations)

eks-us-east-prod

flavor:eks

env:prod

gpu:true

compliance:hipaa

aks-eastus-prod

flavor:aks

env:prod

gpu:true

compliance:hipaa

gke-us-central-prod

flavor:gke

env:prod

gpu:true

compliance:hipaa

dc1-kubeadm-prod

flavor:kubeadm

env:prod

gpu:true

compliance:hipaa

dc2-rke2-prod

flavor:rke2

env:prod

gpu:true

compliance:hipaa

dc3-ocp-regulated

flavor:openshift

env:prod

gpu:true

compliance:hipaa,hitrust

ApplicationSet pattern (platform addons fleet)

apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: platform-addons namespace: argocd spec: generators: - clusters: selector: matchLabels: platform: healthcare-ai # targets all 6 clusters template: metadata: name: 'platform-{{name}}' spec: project: platform source: repoURL: https://github.com/org/platform-iac path: addons/{{metadata.labels.flavor}} # per-flavor path targetRevision: HEAD destination: server: '{{server}}' syncPolicy: automated: prune: true selfHeal: true retry: limit: 3

Addon deployment matrix — flavor-specific overrides

Addon	Cloud (EKS/AKS/GKE)	On-prem (kubeadm/RKE2)	OpenShift
Cilium CNI	deployed	deployed	— OVN-Kubernetes (built-in)
Istio service mesh
MetalLB	— cloud LB used
Cloud CSI driver	EBS/Disk/PD	— Longhorn / Rook-Ceph	— ODF (Ceph)
Longhorn storage	— cloud CSI used		— ODF used
Kyverno			— SCC + OPA only
OPA Gatekeeper
Nvidia GPU Operator			via OperatorHub
cert-manager
NemoClaw / NIM

Step through a complete NemoClaw agent reasoning cycle for a clinical drug interaction check. The agent uses a Reason → Act → Observe loop until it has enough information to synthesize a safe clinical output.

PHI data journey — from EHR to clinical AI output

EHR / source systems

Epic, Cerner, or Meditech emits clinical events. SMART on FHIR app launches in EHR context with scoped access token (patient/*.read).

Epic SMART on FHIRCerner MillenniumHL7 v2 ADT feedsDICOM modalities

FHIR R4 ingestion — namespace: clinical-data

Incoming FHIR resources validated (schema + terminology), persisted to Hapi FHIR server. HL7 v2 converted via FHIR Converter. DICOM metadata indexed. All writes trigger an audit event.

Hapi FHIR R4 serverHL7 v2 → FHIR ConverterDICOM → DICOMweb adapterAudit: write logged

De-identification pipeline

Before any data reaches AI agents, the de-ID pipeline strips all 18 HIPAA Safe Harbor identifiers using NLP + rule-based detectors. A secure token maps the de-identified payload back to the original patient record.

18 HIPAA identifier removalNLP NER (dates, names, MRN)Secure re-link token issuedReversible only by clinical-data ns

NemoClaw agents — namespace: nemo-agents

Agent Supervisor receives the de-identified payload and routes to the appropriate clinical agent. Agents operate entirely on de-identified data. Tool calls back to clinical-data namespace are authenticated via mTLS service identity and audit-logged.

De-identified payload onlymTLS service identity (SPIFFE)Tool calls audit-loggedReAct reasoning loop

NIM LLM inference — namespace: ai-platform

NemoClaw calls NIM or Triton for LLM reasoning. De-identified clinical context is included in the prompt. NeMo GuardRails validates the model output for clinical safety before returning to the agent.

NIM API (no PHI in prompt)Triton Inference ServerNeMo GuardRails validationGPU-resident, no egress

Re-identification & output delivery

Clinical AI output is re-linked to the patient record using the secure token held by the clinical-data namespace. The output is written as a FHIR Communication or ClinicalImpression resource and delivered to the clinician's EHR session.

Secure token re-links to MRNOutput → FHIR CommunicationDelivered to EHR SMART contextClinician review + sign-off

Immutable audit trail

Every PHI access, de-ID operation, agent tool call, LLM inference, and clinical output delivery is appended to an immutable log store (WORM). Logs are shipped to the SIEM for HIPAA audit readiness and stored for 7 years minimum.

User ID + timestamp + actionPHI resource accessedWORM log store (7-year retain)Splunk / Elastic SIEM

IaC monorepo structure

platform-iac/

├── clusters/ Cluster API + Crossplane manifests

│ ├── cloud/

│ │ ├── eks/ AWS CAPA ClusterClass + MachinePool

│ │ ├── aks/ Azure CAPZ ClusterClass + MachinePool

│ │ └── gke/ GCP CAPG ClusterClass + NodePool

│ └── onprem/

│ ├── kubeadm/ CAPD/CAPH machine + kubeadmControlPlane

│ ├── rke2/ CAPRKE2 cluster + machine config

│ └── openshift/ IPI install-config + MachineConfig

│

├── addons/ Helm + Kustomize add-on configs per flavor

│ ├── networking/ Cilium, Istio, Gateway API, MetalLB

│ ├── storage/ CSI drivers, Longhorn, Rook-Ceph, Velero

│ ├── monitoring/ Prometheus stack, Grafana, Loki, OTel

│ ├── security/ OPA, Kyverno, Falco, Trivy, cert-manager

│ └── gpu/ GPU Operator, Network Operator, DCGM

│

├── ai-platform/ Nvidia NIM, Triton, vLLM, KServe

│ ├── nim/ NIM deployment manifests + model config

│ ├── triton/ Triton server + model repository config

│ ├── vllm/ vLLM deployment + quantisation config

│ └── kserve/ InferenceService + ServingRuntime CRDs

│

├── nemo/ NemoClaw agent framework workloads

│ ├── agents/ Agent Supervisor, tool registry, ReAct config

│ ├── guardrails/ NeMo GuardRails config + clinical policies

│ ├── milvus/ Milvus vector DB + embedding pipeline

│ └── redis/ Redis cluster for short-term agent memory

│

├── clinical/ PHI-scoped healthcare workloads

│ ├── fhir/ Hapi FHIR R4 server + PostgreSQL

│ ├── hl7/ HL7 v2 broker + FHIR Converter

│ └── deid/ De-identification pipeline + token store

│

├── gitops/ ArgoCD App of Apps bootstrap

│ ├── bootstrap/ ArgoCD self-install + root app

│ ├── platform-appset.yaml Deploys addons to all clusters

│ ├── ai-appset.yaml Deploys AI platform (gpu=true selector)

│ └── clinical-appset.yaml PHI workloads (compliance=hipaa selector)

│

└── terraform/ Cloud prerequisites only (VPC, IAM, KMS)

├── modules/ eks-prereqs, aks-prereqs, gke-prereqs

└── environments/ dev / staging / prod tfvars

Key convention — each addons/<flavor>/ directory holds a Kustomize base shared with addons/common/ and applies flavor-specific patches. The ArgoCD ApplicationSet resolves {{metadata.labels.flavor}} at sync time so a single ApplicationSet serves all 6 cluster flavors from one template.

--- ## Safety & Guardrails for Clinical AI Workloads deployed inside the `clinical-apps` and `clinical-data` namespaces must implement strict boundary parameters using K8s native admission policies and service meshes: ### 1. Cilium Network Policy — Clinical Data Namespace Isolation Enforces strict zero-trust isolation on the `clinical-data` namespace, preventing arbitrary traffic ingress and egress. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: clinical-data-isolation namespace: clinical-data spec: endpointSelector: {} ingress: - fromEndpoints: - matchLabels: io.kubernetes.pod.namespace: nemo-agents toPorts: - ports: - port: "8080" protocol: TCP rules: http: - method: GET path: /fhir/r4/.* - fromEndpoints: - matchLabels: io.kubernetes.pod.namespace: clinical-apps - fromEndpoints: - matchLabels: io.kubernetes.pod.namespace: monitoring toPorts: - ports: - port: "9090" egress: - toEndpoints: - matchLabels: io.kubernetes.pod.namespace: kube-system k8s-app: kube-dns toPorts: - ports: - port: "53" protocol: UDP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all namespace: clinical-data spec: podSelector: {} policyTypes: - Ingress - Egress ``` ### 2. Istio PeerAuthentication & AuthorizationPolicy Enforces strict mTLS in-transit encryption and explicitly validates SPIFFE identities. ```yaml apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: clinical-data-mtls-strict namespace: clinical-data spec: mtls: mode: STRICT --- apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: fhir-server-allow namespace: clinical-data spec: selector: matchLabels: app: hapi-fhir action: ALLOW rules: - from: - source: principals: - "cluster.local/ns/nemo-agents/sa/drug-interaction-agent" - "cluster.local/ns/nemo-agents/sa/diagnostic-agent" - "cluster.local/ns/nemo-agents/sa/radiology-agent" - "cluster.local/ns/clinical-apps/sa/clinician-app" to: - operation: methods: ["GET"] paths: ["/fhir/r4/*"] when: - key: request.auth.claims[aud] values: ["fhir-server"] ``` ### 3. Istio Egress Gateway for External Tool APIs Forces all external agent requests through a centralized, audited egress gateway. ```yaml apiVersion: networking.istio.io/v1alpha3 kind: ServiceEntry metadata: name: drugbank-external namespace: nemo-agents spec: hosts: - api.drugbank.com ports: - number: 443 name: https protocol: HTTPS location: MESH_EXTERNAL resolution: DNS --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: nemo-agents-egress namespace: nemo-agents spec: hosts: - api.drugbank.com - api.fda.gov tls: - match: - port: 443 route: - destination: host: istio-egressgateway.istio-system.svc.cluster.local ```