v1.57.0See a whole environment at a glance. The platform engineering layer
The platform engineering layer
your cloud doesn't ship with.
Landing zone. Deploy pipeline. Audit trail. Built once, runs on AWS, GCP, and Azure. Your team gets push-to-deploy speed without the six-month internal-platform project.
customer
McAfee
running platform engineering on zopday in production
AWS accounts
12
multi-cloud landing zones, BYOC
K8s clusters
48
across regions
throughput
1,000+
req/sec sustained on production
The console. Every cluster, every cloud, one workspace.
Provision, datastores, clusters, deployment spaces, projects, audit logs, all on the same surface.
PROBLEM
Building a platform is hard.
Renting one is worse.
Hosted PaaS rents you their stack. Internal platforms cost millions to build and a permanent team to keep alive. Raw cloud is five engineers, a YAML graveyard, and onboarding by tribal knowledge. None of the three works.
- Cluster spin-up time Days of Terraform + manual approvals.
- Cross-cloud parity Works on AWS. Breaks on GCP. Rewritten for Azure.
- Helm rollout debugging kubectl get pods… CrashLoopBackOff. Tail the logs. Pray.
- New engineer onboarding Weeks of tribal knowledge before first deploy.
- Platform-team headcount A growing tax on every product team's velocity.
SOLUTION
One platform. Three stages. Security baked in at every step.
Day 0 to landing zone. Every day to deploys. Every minute to live state.
Landing Zone
Production-ready clusters in minutes.
Production-grade compute, datastores, networks. 30 minutes, every cloud. GKE · EKS · AKS via wizard. MySQL · Postgres · Redis with HA, backups, deletion protection. RBAC and secrets from minute zero.
Deployment
Push code → production.
Push code → production via Helm. No Dockerfile required, zopday auto-builds from your repo. Deploy history for every service. One-click rollback. Sensitive env vars masked, stored in your cloud-native secret manager, never ours.
Live State
Cluster, live. Audited, every change.
K8s state, real-time, 21 resource pages with detail drawers across every connected cluster. Every live read checks the cluster is reachable; transient hiccups retry silently. If a cluster goes inactive, deleted, RBAC revoked, cert expired, Sync, Connect Datastore, and Install Component gate cleanly. Audit trail captures every change.
DEPTH
The depth behind
the three stages.
Fifteen features you’d otherwise build internally, each one shipped and documented in the changelog.
Configure once. Helm renders the rest.
Per-service inputs, not YAML.
Port, replicas, probes, CPU and memory limits, env vars with sensitive masking. Application → Environment → Service hierarchy: the Environment carries cluster, namespace, registry; services inherit. Clone an Environment (staging → production); every service copies forward with its config. Cascade teardown on delete.
INPUTS · NOT YAML
Ingress or LoadBalancer. Picked from a tab.
Two-mode network setup, no chart rewrite.
The Network tab on every service drawer offers two modes: Ingress (routed through your cluster's ingress controller, with optional cert-manager TLS) or LoadBalancer (a dedicated cloud load balancer). Saves a configs.expose patch and triggers a new Helm revision, no chart rewrite, no separate manifest.
INGRESS · LOADBALANCER · TLS
Bring the cluster you already run.
Imports stay identical to provisioned clusters.
Import an EKS, GKE (zonal or regional), or AKS cluster you already have. Components install consistently, datastore connections work, database provisioning runs the same way as on a zopday-provisioned cluster. The wizard rejects half-filled payloads up front, no clusters stuck in “waiting for credentials.”
EKS · GKE · AKS · END-TO-END
Change tier. Don't recreate.
Tier, storage, scaling, backups, all in-place.
Update tier, storage, scaling, or backup retention on RDS, ElastiCache, EKS node groups, Cloud SQL, Memorystore, GKE node pools, Azure SQL, Azure Database for MySQL/Postgres, Azure Redis, AKS, directly from zopday. Each change runs as its own provisioning job with a pre-flight check that confirms the resource is alive before touching it.
TIER · STORAGE · BACKUPS · SCALING
Same-region cross-VPC, auto-peered.
Peering + routes + scoped ingress, automatic.
When a datastore lives in a different VPC than the cluster (same region), zopday auto-creates the peering, the reciprocal routes, and a narrow ingress rule on the datastore's security group, scoped to your cluster's CIDR and the engine port only. Cross-region rejected upfront.
PEERING · ROUTES · SCOPED INGRESS
Provisioning fails, surface the cause.
Typed errors humanised end-to-end.
Typed-error wrapper flows the actual cause through to the UI: IamLimitExceeded, overlapping CIDR range, Ec2SubnetInvalidConfiguration, AsgInstanceLaunchFailures, InvalidStateTransition. No generic “operation failed” toast. Step labels humanised: “Setup VPC Peering,” “Wait for Peering,” “Inject Connection Secret” instead of raw snake_case.
TYPED · HUMANISED
Built on GoFr. Apache 2.0.
Same framework McAfee, FairPrice, Fortune 500 run.
zopday is built on GoFr, the open-source Go framework, Apache 2.0 licensed, created by our CTO. The same framework McAfee, FairPrice, and Fortune 500 retail teams run in production. Your services build cleanly on it. So do ours. ★ Star GoFr on GitHub · 20.8k →
GOFR · APACHE 2.0
No cluster required.
Deploy to a plain Linux VM, same pipeline.
Point a service at a plain Linux VM instead of Kubernetes: same push-to-deploy, same audit trail. Docker and Caddy arrive automatically, TLS from Let’s Encrypt, several services per VM without stepping on each other. No SSH keys anywhere; access rides your cloud’s IAM-gated exec channel.
VMS · AUTO TLS · NO SSH
Bring the releases you already run.
Read-only imports, live URLs from the ingress.
Import existing Helm releases as read-only services on the canvas, with the live URL read straight from the cluster’s ingress. See the whole estate in one place before you migrate anything.
IMPORT · READ-ONLY · LIVE URLS
Adopt the database you already have.
Wire it in; never own its lifecycle.
Bring an existing RDS, Cloud SQL, or Azure database into zopday: connection wiring, secret references in your cloud’s secret manager, and a live Connected / Drift / Unverified status. zopday never owns its lifecycle and never touches its data.
ADOPT · WIRE · NEVER MUTATE
Your domain, wired end to end.
DNS record and ingress host, always in sync.
Attach a domain to a space and bind it to a service: the DNS record and the ingress host always agree. Route 53, Cloud DNS, Azure DNS written automatically; certificates via cert-manager, wildcards included.
DNS · TLS · WILDCARDS
The platform baseline, upgraded in one click.
Curated catalog, audited pipeline, no races.
Cluster components install from a curated catalog and upgrade through the same audited pipeline as every deploy. Malformed and duplicate requests are rejected before anything queues, so two operations never race the same release.
CATALOG · ONE-CLICK · AUDITED
Wire services together, once.
The URL your code expects, kept fresh.
Connect one service to another and zopday injects the target’s connection URL as the env var your code expects, and keeps it fresh when the target moves. Your naming convention, not ours.
CONNECT · INJECT · STAYS FRESH
The YAML, when you want it.
View, diff, dry-run, with guardrails.
View any live K8s object as YAML. Edit with a side-by-side diff and a server-side dry-run before anything applies. Secret values masked for non-admins; dangerous kinds blocked outright; every edit RBAC-gated and logged.
VIEW · DIFF · DRY-RUN
Tail the pods, from the same screen.
Multi-pod streaming, even the container that died.
Live log streaming across pods with per-pod colours. Flip to the previous container’s logs and debug a crash loop without waiting for the next restart.
LIVE · MULTI-POD · CRASH LOOPS
From git push to live URL, without leaving the editor.
~/your-repo · main · zopday deploy ACTIVE
$ git push origin main
- 01 CONNECT OAuth verified for AWS · GCP · Azure · read-only first, write scoped on opt-in +30s
- 02 REPO GitHub webhook HMAC-verified · branch
main· auto-deploy on push +30s - 03 SCAN Railpack detected Go 1.25 · port
8080· no Dockerfile required +60s - 04 CONFIG 4 env vars masked → AWS Secrets Manager · never ours +60s
- 05 DEPLOY
helm upgrade --install· ingress + cert-manager TLS · rollout 1/1 ready +90s - 06 LIVE https://your-service.app · audit log written · Slack notified 4m 30s ✓
$
McAfee runs platform engineering on zopday.
Hosted PaaS rents you their stack. Internal platforms cost you a team.
| Hosted PaaS Render, Railway, Heroku, fly.io | Internal Platform Backstage, Spinnaker, DIY | Raw K8s + Terraform DIY | zopday | |
|---|---|---|---|---|
| BYOC (your cloud, your bill) | - | ✓ | ✓ | ✓ |
| Push-to-deploy UX | ✓ | depends | - | ✓ |
| Hardened K8s, multi-cloud wizard | n/a | weeks | weeks | ✓ |
| VM deployments (no K8s) | - | DIY | DIY | ✓ |
| Live K8s state + reachability | - | DIY | - | ✓ |
| Multi-cloud (AWS + GCP + Azure) | partial | DIY | DIY | ✓ |
| Deploy history + audit baked in | partial | DIY | DIY | ✓ |
| Engineer-time to maintain | - | high | very high | low |
Aligned pricing. Free where it matters.
Prices in
| Free | Starter | Pro | Enterprise | |
|---|---|---|---|---|
| 1 developer | 2 to 10 developers | 3 or more developers | Unlimited developers | |
| Build minutes a month | 100 | 1,000 | 5,000 | Custom |
| Read-only viewers | Not included | 3 | Unlimited | Custom |
| Cloud accounts | 1 | 1 | 3 | Custom |
| Projects | 1 | 5 | Unlimited | Custom |
| Environments per project | 1 | 2 | Unlimited | Custom |
| Managed databases | 1 | 3 | Unlimited | Custom |
| Custom domains | 1 | Unlimited | Unlimited | Custom |
| Revisions kept | 5 | Unlimited | Unlimited | Custom |
| Revision history (days) | Unlimited | 30 | 365 | Custom |
| Audit log retention (days) | Not included | 30 | 365 | Custom |
| Integrations | 1 | Unlimited | Unlimited | Custom |
| Create clusters | - | ✓ | ✓ | ✓ |
| GitLab and Bitbucket | - | ✓ | ✓ | ✓ |
| Chat alerts | - | ✓ | ✓ | ✓ |
| Always-on services | - | ✓ | ✓ | ✓ |
| Add-on datastores | - | ✓ | ✓ | ✓ |
| Autoscaling | - | ✓ | ✓ | ✓ |
| Webhooks and Jira | - | ✓ | ✓ | ✓ |
| Database migrations | - | - | ✓ | ✓ |
| Bring your own metrics | - | - | ✓ | ✓ |
| Custom roles | - | - | ✓ | ✓ |
| SSO (SAML) | - | - | - | ✓ |
| Custom integrations | - | - | - | ✓ |
| An SLA and a named contact | - | - | - | ✓ |
| Price | Free Free Free Free | $39 per developer per month $396 per developer per year ₹1,999 per developer per month + GST at checkout ₹19,990 per developer per year + GST at checkout | $79 per developer per month $780 per developer per year ₹3,999 per developer per month + GST at checkout ₹39,990 per developer per year + GST at checkout | Custom Custom Custom Custom |
| Start Free → | Start Free → | Start Free → | Talk to Sales → |
Priced per developer. Deployments and read-only viewers are never charged. Your cloud provider bills your cloud usage separately. INR prices exclude GST, which is added at checkout.
Built for every seat in the room.
01
CFO / FinOps
Predictable variance. Verified against your bill.
stops the Friday "why is the bill up" meeting.
02
CTO / CPO
One platform. Three clouds. Four lifecycle stages.
stops the six-tool stack that doesn't talk.
03
VP Engineering
Ship product, not platform overhead.
stops the platform project "almost done" since Q1.
04
Platform / SRE
Cross-cloud inventory. CDCR auto-fix.
stops 3 AM pages from dashboard ↔ ticket gaps.
05
InfoSec / Audit
Roles you grant and can revoke. Every change logged.
stops "what exactly can this vendor change?"
Things teams ask before they sign.
How does zopday compare to our existing Terraform setup?
zopday generates Helm charts; you keep your Terraform. The deploy pipeline runs against whatever infrastructure you already have. zopday’s value is the build (Railpack, no Dockerfile required), the rollout (Helm with diagnostics), the rollback (one-click, build skipped), and the live K8s view on top, not in owning your IaC.
Do zopday templates replace our infrastructure code?
No. zopday configures services through structured inputs, port, replicas, probes, CPU/memory, env vars, networking. The platform discipline (audit, secrets in the cloud-native secret manager, RBAC) is what survives an eject; your existing modules slot into that discipline.
Can I bring my own Helm charts?
Yes. Point a service at an existing chart in your repo, or use zopday’s generated chart as a starting point and fork it. The deploy pipeline runs either way. Generated charts ship with structured config; manually-authored charts get a one-time validation that the resource limits are declared. You can also import releases you already run; they appear read-only on the canvas with their live URLs.
How does zopday see live K8s state?
Real-time across every connected cluster, 21 resource pages cover Pods, Deployments, StatefulSets, Services, Ingresses, Network Policies, and the rest. Every live read checks that the cluster is reachable; if a cluster goes inactive (deleted, RBAC revoked, cert expired), Sync, Connect Datastore, and Install Component gate cleanly. Transient network hiccups retry silently.
Do we need to give up our existing CI?
No. Trigger zopday deploys from any CI, GitHub Actions, GitLab CI, Jenkins, CircleCI. zopday handles the build (Railpack), the Helm rollout, the rollback. Your CI orchestrates whatever it already orchestrates; zopday slots in as the deploy surface.
What happens to our workloads if we leave zopday?
They keep running. zopday is BYOC and a control plane, no data-path dependency, no proprietary runtime. The services run as standard Helm releases on clusters in your account. Eject the zopday control plane and the workloads stay where they are.
What’s the security model?
You choose the access level when you connect a cloud account, and the IAM policy for each level is published in the docs. Provisioning needs write access; everything else reads. Every write goes through the audit middleware (actor, action, timestamp, body) and lands in the audit log. Custom roles come with Pro and Custom; SAML SSO is part of the Custom plan.