explanation
60 pagesAlerting
Alerting is a crucial part of observability, and it's the first step in knowing when something is wrong with your application.
Anti-Virus Scanning
Antivirus scanning of files and urls using ClamAV.
Application
A Nais application lets you run one or more instances of a container image. An application is defined by its application manifest, which is a YAML file that describes how the application should be…
Applying a manifest
nais apply sends a workload manifest to the Nais API. The platform reconciles the desired state — whether you're shipping new code, changing configuration, or updating resources, it's the same…
Auth concepts
This page describes basic concepts and glossary commonly referred to when working with authentication and authorization.
Authentication and authorization
Services and addons to support authentication and authorization in your applications.
Buckets
A bucket is a storage container for objects. Objects are files that contain data, such as documents, images, videos, and application code.
Build and deploy
To make your application available to others, you need to build and deploy it. Nais attempts to make this as simple as possible by providing a set of GitHub Actions and the Nais CLI.
Cloud SQL credentials
Cloud SQL uses ConfigConnector/CNRM to create and manage all relevant resources (sqldatabase, sqlinstance, sqluser, credentials) for postgreSQL. When creating an application via your nais.yaml the…
Cloud SQL Instance
A Cloud SQL instance is a managed database server provided by Google Cloud Platform. In nais, these are used to provide PostgreSQL databases for your applications.
Cloud SQL Proxy
The application will connect to the database using Cloud SQL Proxy, ensuring that the database communication happens in secure tunnel, authenticated with automatically rotated credentials.
Cloud SQL System Users and Roles
Every Cloud SQL PostgreSQL instance comes with a fixed set of system users and roles managed by Google. On top of these, Nais creates application-specific users via ConfigConnector. Understanding…
Config
A config is a set of non-sensitive configuration values that can be used in a workload. This can be feature flags, connection strings, or any other configuration that does not need to be kept secret.
Content Delivery Network (CDN)
A content delivery network (CDN) serves static content and single-page applications (SPA) in a fast and reliable manner.
Distributed Tracing
Application Performance Monitoring or tracing using Grafana Tempo on Nais.
Entra ID
Entra ID (formerly known as Azure Active Directory, Azure AD or AAD) is a cloud-based identity and access management service provided by Microsoft.
Environment mixins
An environment mixin is a partial manifest that Nais merges over a base manifest for a specific environment. It lets one set of manifests serve several environments, so you can run different…
Exposing your application
What good is an application if no one can reach it? Nais tries to make it easy to expose your application to the correct audience. An audience is the set of users or applications that your…
Feature Toggling
Feature toggling is a software development technique that allows you to turn features on and off in your application without deploying new code. This can be useful for testing new features, rolling…
Frontend observability
Frontend observability with Grafana Faro gives you real user monitoring, performance metrics, error tracking, and tracing for browser applications.
Good practices
This document describes the different properties a Nais application should have. In general, Nais applications should be inspired by the Twelve Factor App manifesto.
Google Cloud BigQuery Dataset
Google Cloud BigQuery is a service that provides a relational database that is optimized for analytical workloads. It is a good choice for storing data that is relational in nature.
Google Cloud SQL / PostgreSQL
PostgreSQL is a relational database which is a good choice for storing data that is relational in nature. In the nais platform, we use CloudSQL from the Google Cloud Platform to provide managed…
Grants and privileges
nais cloudsql prepare grants PostgreSQL privileges, not login access. By default, it grants USAGE on the schema and SELECT on existing tables and sequences to cloudsqliamuser. It also sets default…
How Nais APM works
How Nais APM works — where your telemetry comes from and where it lives, why issue grouping is computed statelessly at query time, and what Nais APM deliberately does not do.
HTTP client connection management
HTTP clients reuse connections from a pool to avoid repeating the TCP and TLS handshake on every request. This is almost always what you want, but connection reuse assumes a pooled connection is…
ID-porten
ID-porten is the standard authentication service used by Norwegian citizens to access public services.
Just In Time Access (JITA)
When you start naisdevice you will not be automatically connected to all the available gateways. In order to reach some of the services you will need to request "just in time access". The purpose of…
Kafka
Kafka is a distributed streaming platform that can be used to publish and subscribe to streams of records. It is a good alternative to synchronous communication between services if you need to decouple services.
Labels
Labels are user-defined key-value pairs that you can attach to your resources to organize and categorize them however you make sense of them.
Leader Election
With leader election it is possible to have one responsible pod. This can be used to control that only one pod runs a batch-job or similar tasks. This is done by asking the elector container which…
Logging
Understand how application logging works in Nais, its purpose, good practices, and the available log destinations.
Manage your workloads and services
This section covers how to manage your workloads and services on the Nais platform. It describes the different options available, and how to use them.
Maskinporten
Enabling service-to-service authorization between organizations and businesses using Maskinporten.
Metrics
Metrics are a way to measure the state of your application and can be used to create alerts and dashboards in Grafana.
Nais APM
Nais APM is the curated application performance monitoring app in Grafana. It turns the telemetry your app already ships into service health, issues, and traces — no manual queries.
Nais Console
Nais Console is a web-based interface for managing your workloads and services on the Nais platform. It aims to provide a user-friendly way to interact with the platform, without needing to use the…
Nais job
A Nais job is used for tasks meant to complete and then exit. This can either run as a one-off task or on a schedule, like a cron job.
Nais manifests
A Nais manifest is a declarative configuration file that defines a resource you want the platform to run or provision. Rather than issuing imperative commands to create, scale, or configure…
naisdevice
naisdevice is a mechanism that lets you connect to services not available on the public internet from your machine.
Non-personal database users
This page documents the non-personal users in Google Cloud SQL for PostgreSQL on Nais. It covers the default setup (golden path). Manual deviations — such as setting a password on the postgres user…
Observability
Nais offers several methods for monitoring and observing your applications. This page describes the different options and how to use them.
OpenSearch
Nais provides managed search index services through OpenSearch as a drop-in replacement for Elasticsearch.
Persistent Data Overview
Nais offers several storage solutions for storing data. This page describes the different options and how to use them.
Postgres cluster
Postgres is a managed database cluster provided by nais utilizing the Zalando postgres-operator. You manage your cluster by defining a Postgres manifest.
PostgreSQL
PostgreSQL is a relational database which is a good choice for storing data that is relational in nature. In the nais platform, PostgreSQL databases are currently managed by the Zalando…
Responsibilities
This page aims to clarify the responsibilities as relates to data storage using Nais and GCP. Depending on which infrastructure the data is stored on, the responsibilities look slightly different.
Secrets
A secret is a piece of sensitive information that is used in a workload. This can be a password, an API key, or any other information that should not be exposed to the public.
The runtime environment
Nais provides you with multiple environments for you to run your workloads in. Environments are sometimes also called clusters.
Tiered storage
Tiered storage is a way to offload rarely used messages to a cheaper, remote storage. Using tiered storage allow storing more data in a more cost-effective way. New messages can be stored locally on…
TokenX
TokenX is Nais' own implementation of OAuth 2.0 Token Exchange. This allows internal applications to act on behalf of a citizen that originally authenticated with ID-porten, while maintaining the…
Under the hood
In this explanation, we will go through some of the underlying technologies we use to provide Nais. Each environment is its own Kubernetes cluster using Google Kubernetes Engine (GKE).
Valkey
Valkey is a key value database that is used for storing and querying data. It is a good choice for storing data that is not relational in nature and often used for caching.
Vulnerability insights and management
Nais provides what you need to secure your software supply chain and manage vulnerabilities in your workloads.
What is a team?
Everything in Nais is organized around the concept of a team. A Nais team should consist of technical personnel involved with developing and operating the team's workloads and resources.
What is Nais?
Nais is a platform aiming to provide you with the technical capabilities you need to develop and run software in a safe and enjoyable way.
Working with Kafka Offsets
The Kafka offset is the index of the last read message for a consumer. On Aiven Kafka, we retain consumer offsets for a period of 7 days. This is the period recommended by Aiven and the default for…
Workload Identity
All workloads on Nais have their own identities. In practice, this is a Kubernetes Service Account. Workloads on Nais are automatically injected with a short-lived OpenID Connect (OIDC) identity…
Workloads
A core functionality of Nais is enabling you to run the code you write. We support two types of workloads, applications and jobs.
Zero Trust
Nais embraces the zero trust security model, where the core principle is to "never trust, always verify".