# PASTA and sauce

> Protect AI's tenant automation. PASTA provisioned dedicated single-tenant AWS infrastructure; sauce added tenant provisioning on shared clusters for 100+ customers.

2024–2025 · Staff Platform Engineer, Protect AI · tags: platform, aws, argocd, opentofu, spacelift

Source: https://brandonbjelland.com/projects/pasta-and-sauce/

**PASTA** (Protect AI Single Tenant Automation) provisioned dedicated single-tenant infrastructure in
AWS. It was the precursor to [CELLARS](https://brandonbjelland.com/projects/cellars/) and [HERBS](https://brandonbjelland.com/projects/herbs/) at Palo Alto
Networks.

**sauce** built on PASTA for tenant-level provisioning on shared clusters, using ArgoCD and
Spacelift/OpenTofu. It supported 100+ customers across trials and production and let the
forward-deployed team provision tenants on their own.