We run our storage and query backend inside our customers' own VPCs. They own the infrastructure. We own the pager. I'm the person who helps installs it, so I've watched this architecture meet a few hundred different production Kubernetes environments and I've kept notes on what went wrong.

This talk is about the operational reality of running a data plane you can't log into. How you roll out a version when every deployment is a different node type, kernel version, CNI, and security policy. How you debug a storage issue using only the telemetry the customer's environment will let you export. What breaks when the customer's admission controller, air-gapped registry, or IPv6-only network meets your Helm chart. And the incidents where none of that worked and we had to get someone on a screen share at 2am.

I'll cover the cases where this model is genuinely better than shipping data to a SaaS backend, and the cases where I'd tell you not to try it.

If you're considering a split control plane / data plane design, or you're an operator being asked to host a vendor's software next to your workloads, you'll leave knowing what you're signing up for.