How it works

Ultraviolet has three parts: a core that you run in your own environment, the data sources that feed it, and a deliberately tiny hosted service that only issues your license and hosts the software you install.

The core

The core is the whole platform — ingest, storage, the query layer, and the web portal. It installs into your Kubernetes cluster from a single Helm chart and runs entirely inside your environment. Data comes in, gets stored where you deploy it, and is served back to you through the portal. Nothing leaves.

 data sources                the core (your environment)
┌───────────────┐            ┌───────────────────────────┐
│ sensors       │  ───────▶  │  ingest  →  storage        │
│ collectors    │            │              ↑             │
│ OpenTelemetry │            │        query layer  ←→ portal
└───────────────┘            └───────────────────────────┘

Two extras install alongside it, both optional:

• A lifecycle manager that tracks signed releases and can perform hands-off upgrades for you. See Verifying signed artifacts.
• Scheduled backups of your data to a disk you control.

What feeds it

On a fresh install the pages are empty until data arrives. You choose what to turn on:

• The sensor — captures your services’ network traffic (HTTP, DNS, database calls, and more) with no application changes. It needs a reasonably modern Linux kernel; see Deploy to EKS for how to check.
• Log collection — gathers your pods’ logs and lines them up with the traces they belong to.
• Infrastructure health — reads the state of your Kubernetes nodes and workloads for the Infrastructure pages.

Already using OpenTelemetry? Point your existing SDKs or collector — or a Datadog agent — at the core and that data flows in alongside everything else.

One view across many sites

A remote site is a cluster or host that reports to a core running somewhere else. It connects back over a secure, outbound-only link, tags its data so you can tell sites apart, and buffers to disk during network blips so nothing is lost. Sites join with a simple token, and the core rolls all their data up into a single cross-site view.

The hosted boundary

Everything above runs in your environment. Our hosted service never receives your observability data. It does exactly two things:

1. Issues your license — a signed file your core verifies on its own.
2. Hosts the software — signed, tamper-evident images and charts you can verify before you install them.

Runs offline

The core has no hard dependency on the internet. Most installs let it check in to renew the license automatically (connected mode), but it can also run completely air-gapped: it installs, runs, and can be cryptographically verified with no outbound network at all — mirror the signed software to a private registry and nothing ever reaches the public internet.