| Kubernetes | EKS / AKS / GKE | Self-managed distro — kubeadm, k3s, RKE2, OpenShift, Rancher |
Shared lab volume (/lab) | EFS / Azure Files / Filestore | NFS server or CephFS via a CSI driver |
| Engine scratch (Spark spill/shuffle) | EBS / Managed Disk / PD | Local SSD or block CSI (Ceph RBD, Longhorn, vSphere) |
| Object / warehouse storage | S3 / ADLS / GCS | S3-compatible store — MinIO or Ceph RGW |
| Edge & ingress | Cloud load balancer | MetalLB or a hardware load balancer → ingress-nginx |
| Web application firewall | AWS WAF / App Gateway / Cloud Armor | ModSecurity / your edge WAF (optional) |
| TLS certificate | ACM / Key Vault / Google-managed | Your internal PKI / CA certificate |
| Keyless identity | IRSA / Workload Identity | Kubernetes ServiceAccounts (+ Vault or a K8s Secret) |
| Node autoscaling | Managed autoscaler | Fixed pools, or Cluster Autoscaler for your provider |
| Observability | CloudWatch / Azure Monitor / Cloud Ops | Your Prometheus / Grafana / Loki stack |
| Backup | AWS Backup / Azure Backup / Backup for GKE | Velero (+ your storage snapshots) |