Cluster atlas

Every cluster category, and where we actually stand

Vendors answer "what do you do?" with a logo wall. We answer it with an index — 22 domains, 233 cluster categories, each one marked with the depth of our practice. The categories marked core are what we do every week. The ones marked not ours are where we will send you to someone better rather than learn on your budget.

233 cluster categories indexed
22 capability domains
194 delivered as standard practice
16 explicitly not ours alone
How to read this page

Five states, and no unmarked entries

Every category carries one of five marks. There is no "we do a bit of everything" entry, because that phrase carries no information a buyer can act on.

  • Core practice 137 We design, build, harden and operate this ourselves. It is what we do every week.
  • Regular delivery 57 Delivered repeatedly as part of standard engagements. Reference designs exist.
  • Advisory 23 We assess and design, hand over the runbook, and work alongside your team.
  • Partner-led 11 We integrate and coordinate; the vendor or a specialist partner owns the platform.
  • Not ours 5 Outside our lane. We will tell you who to call instead of learning on your budget.
01 · 12 categories

Container orchestration & platform

The layer that runs everything else as a workload. Distribution choice matters far less than whether you can upgrade and recover it.

  • Core practice

    Kubernetes — self-managed HA control plane

    kubeadm · etcd quorum · containerd · HAProxy/kube-vip

    our practice
  • Core practice

    Kubernetes — lightweight & edge distributions

    K3s · k0s · MicroK8s · Talos Linux

  • Core practice

    Kubernetes — enterprise platform distributions

    RKE2 · OpenShift / OKD · Rancher · D2iQ

  • Core practice

    Kubernetes — declarative cluster lifecycle

    Cluster API · Crossplane · Talos machine config

  • Core practice

    Kubernetes — bare-metal load balancing

    MetalLB (L2/BGP) · kube-vip · PureLB

  • Core practice

    Kubernetes — multi-tenancy & policy

    Kyverno · OPA Gatekeeper · vCluster · Capsule

  • Core practice

    Kubernetes — ingress & Gateway API

    Gateway API · ingress-nginx · Envoy Gateway · Traefik

  • Core practice

    Kubernetes — storage & CSI

    Rook-Ceph · Longhorn · local-path · CSI drivers

  • Regular delivery

    Kubernetes — autoscaling & scheduling

    HPA / VPA · KEDA · Karpenter · Cluster Autoscaler

  • Regular delivery

    Kubernetes — service mesh

    Istio · Linkerd · Cilium Service Mesh · Consul Connect

  • Advisory

    Nomad — workload orchestration

    HashiCorp Nomad · Consul · Vault

  • Advisory

    Docker Swarm — legacy estates

    Swarm mode · overlay networks

02 · 14 categories

Virtualisation, hyperconvergence & VDI

Where most refresh budgets currently sit. The migration question is no longer whether, but in how many waves.

  • Core practice

    VMware → open-source migration

    ESXi → Proxmox VE + Ceph · KubeVirt · virt-v2v

  • Core practice

    Proxmox VE cluster

    PVE 8 · Corosync · Ceph · live migration

  • Core practice

    Harvester hyperconverged

    Harvester · Longhorn · KubeVirt

  • Core practice

    KubeVirt — VMs on Kubernetes

    KubeVirt · CDI · KubeVirt operator

  • Core practice

    VDI — open source / self-hosted

    Proxmox VDI · Kasm Workspaces · Guacamole · X2Go

    our practice
  • Regular delivery

    VMware vSphere HA / DRS cluster

    vSphere 8 · vMotion · DRS · vSAN

    our practice
  • Regular delivery

    OpenStack private cloud

    Kolla-Ansible · Nova · Neutron · Cinder · Ceph

  • Regular delivery

    Application publishing / virtual apps

    Kasm · Citrix · RDS Session Host farm

  • Advisory

    XCP-ng / XenServer resource pool

    XCP-ng 8 · Xen Orchestra

  • Advisory

    oVirt / Red Hat Virtualization

    oVirt 4 · RHV

  • Advisory

    VDI — VMware Horizon

    Horizon 8 · UAG · instant clones · App Volumes

  • Advisory

    VDI — Citrix Virtual Apps & Desktops

    CVAD · NetScaler · MCS/PVS

  • Partner-led

    Nutanix AHV cluster

    AHV · Prism Central · AOS

  • Not ours

    Mainframe & POWER virtualisation

    z/VM · PowerVM · LPAR · HMC

03 · 9 categories

High availability & failover

The discipline underneath everything else. An HA cluster that has never failed over on purpose is an untested assertion.

  • Core practice

    Pacemaker + Corosync cluster

    pcs / crmsh · SBD fencing · STONITH · qdevice

    our practice
  • Core practice

    Keepalived / VRRP failover

    keepalived · VRRP instance · track_script

  • Core practice

    Block replication HA

    DRBD 9 · LINSTOR · dual-primary

  • Core practice

    Floating-VIP application HA

    systemd units · notify · ipaddr2 resource

  • Core practice

    Load-balancer HA pair

    LVS + keepalived · HAProxy pair · VIP handoff

  • Core practice

    Sharded / active-active application tier

    consistent hashing · quorum · split-brain guards

  • Advisory

    Windows Server Failover Cluster

    WSFC · SQL AlwaysOn · Storage Spaces Direct

  • Partner-led

    Veritas InfoScale / VCS

    InfoScale · CFS · VCS agents

  • Partner-led

    SIOS LifeKeeper

    LifeKeeper for Linux

04 · 9 categories

HPC & batch scheduling

Where queue time, not hardware, is usually the bottleneck. Scheduler policy is a measurable deliverable.

  • Core practice

    Slurm cluster

    Slurm 24.x · Munge · cgroup v2 · accounting (slurmdbd)

    our practice
  • Core practice

    Slurm on Kubernetes

    Slinky · Slurm Operator · Kueue integration

  • Core practice

    Batch scheduling on Kubernetes

    Volcano · Kueue · JobSet · gang scheduling

  • Core practice

    Ray cluster

    Ray · Ray Serve · KubeRay · autoscaler

  • Regular delivery

    Apache Spark cluster

    Spark 4 · on K8s / YARN · dynamic allocation

  • Advisory

    PBS Pro / OpenPBS / Torque

    OpenPBS · PBS Professional

  • Advisory

    SGE / Grid Engine lineage

    SGE · Son of Grid Engine · Altair Grid Engine

  • Advisory

    Render & simulation farm

    Thinkbox Deadline · OpenCue · burst to cloud

  • Partner-led

    IBM Spectrum LSF

    LSF · Spectrum Cluster Foundation

05 · 9 categories

GPU & AI infrastructure

The fastest-moving category on this page, and the one where utilisation reporting separates engineers from resellers.

  • Core practice

    GPU training cluster

    NVIDIA GPU Operator · CUDA · MIG · DCGM

    our practice
  • Core practice

    GPU scheduling & sharing

    DRA · MPS · time-slicing · Kueue · gang scheduling

  • Core practice

    Accelerator fabric

    InfiniBand · RoCE v2 · NCCL · GPUDirect RDMA

  • Core practice

    Parallel storage for AI

    BeeGFS · Lustre · WekaFS · IBM Storage Scale

  • Core practice

    LLM inference cluster

    vLLM · Triton · KServe · llm-d · KV-cache routing

  • Core practice

    GPU cost & utilisation reporting

    DCGM exporter · OpenCost · per-team chargeback

  • Regular delivery

    Training orchestration

    Kubeflow · MLflow · Ray Train · PyTorchJob

  • Regular delivery

    Vector database cluster

    Milvus · Qdrant · pgvector · Weaviate

  • Regular delivery

    Model / inference gateway

    LiteLLM · Envoy AI Gateway · token accounting

06 · 17 categories

Relational & distributed SQL

Our deepest practice. Every design decision here is about one thing: can you fail over and restore, and do you know in advance how long it takes.

  • Core practice

    PostgreSQL high availability

    Patroni · etcd · pgBackRest · PgBouncer

    our practice
  • Core practice

    PostgreSQL synchronous replication cluster

    repmgr · sync standby · quorum commit

  • Core practice

    MySQL / MariaDB HA

    InnoDB Cluster · Group Replication · MySQL Router

  • Core practice

    Galera cluster

    MariaDB Galera 4 · Percona XtraDB Cluster · garbd

  • Core practice

    Distributed SQL — TiDB

    TiDB · TiKV · PD · TiFlash

  • Core practice

    Distributed SQL — CockroachDB

    CockroachDB · multi-region · geo-partitioning

  • Core practice

    Database proxy & pooling layer

    ProxySQL · PgBouncer · MaxScale · ShardingSphere

  • Core practice

    Database migration & replication pipelines

    pglogical · Debezium · Ora2Pg · mydumper

  • Core practice

    Zero-downtime major version upgrade

    logical replication cutover · blue/green

  • Regular delivery

    MySQL orchestration & failover

    orchestrator · MHA · ProxySQL

  • Regular delivery

    Distributed SQL — YugabyteDB

    YSQL · DocDB · RAFT groups

  • Regular delivery

    Distributed PostgreSQL — Citus

    Citus · shard rebalancing

  • Advisory

    Distributed SQL — OceanBase / PolarDB-X

    vendor distributions

  • Advisory

    MPP analytics database

    Greenplum · Cloudberry · Vertica

  • Advisory

    SQL Server AlwaysOn

    Availability Groups · FCI · DAG

  • Partner-led

    Oracle RAC / Data Guard

    RAC · Active Data Guard · Grid Infrastructure

  • Not ours

    Mainframe databases

    Db2 for z/OS · IMS · VSAM

07 · 11 categories

NoSQL, cache, search & coordination

The clusters that quietly become single points of failure because nobody calls them "the database".

  • Core practice

    MongoDB replica set

    MongoDB 8 · write concern · oplog · PSA

  • Core practice

    MongoDB sharded cluster

    mongos · config server replica set · balancer

  • Core practice

    Redis Cluster / Sentinel

    Redis 7 · Valkey · cluster mode · ACL

  • Core practice

    etcd cluster

    etcd 3.5 · raft · defrag · snapshot restore

  • Core practice

    Search cluster

    Elasticsearch 8/9 · OpenSearch · shard & ILM planning

  • Core practice

    Time-series store

    TimescaleDB · InfluxDB · VictoriaMetrics

  • Regular delivery

    Wide-column ring

    Apache Cassandra · ScyllaDB · nodetool repair

  • Regular delivery

    Memcached tier

    memcached · consistent hashing client-side

  • Regular delivery

    ZooKeeper ensemble

    Apache ZooKeeper · dynamic reconfig

  • Advisory

    Solr cluster

    Apache Solr · SolrCloud · ZooKeeper

  • Advisory

    Graph database cluster

    Neo4j causal cluster · routing drivers

08 · 10 categories

Messaging, streaming & events

Ordering, durability and consumer lag are the only three questions that matter. Everything else is configuration.

  • Core practice

    Kafka cluster (KRaft)

    Kafka 4 · KRaft · MirrorMaker 2 · tiered storage

    our practice
  • Core practice

    NATS JetStream

    NATS · JetStream · leaf nodes · super-clusters

  • Core practice

    RabbitMQ cluster

    quorum queues · streams · Shovel/Federation

  • Core practice

    Change data capture

    Debezium · Kafka Connect · outbox pattern

  • Regular delivery

    Kafka — legacy ZooKeeper mode

    Kafka 3.x · ZooKeeper ensemble

  • Regular delivery

    Apache Pulsar cluster

    Pulsar · BookKeeper · tiered storage

  • Regular delivery

    ActiveMQ Artemis

    Artemis · HA replication pair

  • Regular delivery

    MQTT broker cluster

    EMQX · HiveMQ · VerneMQ

  • Regular delivery

    Schema registry & governance

    Apicurio · Confluent Schema Registry

  • Advisory

    Apache RocketMQ

    RocketMQ · DLedger

09 · 10 categories

Analytics & lakehouse

The line between "data platform" and "cluster engineering" is storage layout and query planning. We work on the second.

  • Core practice

    ClickHouse cluster

    ClickHouse · Keeper · shards & replicas · distributed tables

    our practice
  • Core practice

    Trino / Presto cluster

    Trino · coordinator/worker · fault-tolerant execution

  • Core practice

    Apache Flink cluster

    Flink · Kubernetes Operator · HA · savepoints

  • Core practice

    Lakehouse table formats

    Apache Iceberg · Delta Lake · Hudi

  • Core practice

    Object-store lakehouse

    S3-compatible · MinIO · lakeFS · compaction jobs

  • Core practice

    Stream–batch unification

    Flink + Iceberg + Trino · CDC to lake

  • Regular delivery

    Real-time OLAP

    StarRocks · Apache Doris · Pinot · Druid

  • Regular delivery

    Hadoop HDFS / YARN HA

    NameNode HA · JournalNode · ResourceManager HA

  • Regular delivery

    Batch ETL orchestration

    Airflow · Dagster · dbt

  • Regular delivery

    Analytics query gateway

    Trino as federation layer · row/column policy

10 · 15 categories

Distributed & parallel storage

Performance problems are usually placement problems. CRUSH maps, failure domains and rebalancing windows explain more than any benchmark.

  • Core practice

    Ceph cluster

    Ceph Reef/Squid · MON/MGR/OSD · CRUSH · BlueStore

    our practice
  • Core practice

    CephFS & RBD

    MDS active/standby · RBD mirroring · snapshots

  • Core practice

    Rook-Ceph on Kubernetes

    Rook operator · OSD on PVC/LV · CSI

  • Core practice

    S3-compatible object storage

    MinIO · erasure coding · site replication

  • Core practice

    Longhorn

    Longhorn · replica rebuild · snapshots

  • Core practice

    Parallel filesystem (HPC)

    BeeGFS · Lustre · WekaFS · IBM Storage Scale

  • Core practice

    Scale-out NAS

    NFS-Ganesha · clustered Samba · pNFS

  • Core practice

    Storage QoS & tiering

    Ceph QoS · NVMe cache tier · placement rules

  • Core practice

    Stretch cluster & replication

    RBD mirroring · SnapMirror · async/sync policy

  • Core practice

    Capacity & growth modelling

    CRUSH redistribution forecast · rebalance windowing

  • Core practice

    Storage migration between platforms

    rsync-over-cluster · rclone · block copy with cutover

  • Regular delivery

    SeaweedFS / JuiceFS / MooseFS

    S3 gateway · metadata engines

  • Regular delivery

    OpenStack Swift

    Swift · proxy/account/container rings

  • Regular delivery

    HDFS as storage tier

    DataNode placement · rack awareness

  • Advisory

    GlusterFS — legacy estates

    Gluster 11 · arbiter volumes

11 · 9 categories

File, block & object services

The services users actually touch. Nobody notices them until permissions, locking or path failover breaks.

  • Core practice

    SMB / Samba scale-out cluster

    clustered Samba · CTDB · ctdb public addresses

    our practice
  • Core practice

    NFS server HA

    NFS-Ganesha · DRBD-backed export · VIP failover

  • Core practice

    S3 front door / gateway

    Ceph RGW · MinIO gateway · bucket policies

  • Core practice

    Block storage over network

    iSCSI (LIO/targetcli) · NVMe-oF TCP/RDMA

  • Core practice

    Quota, audit & access governance

    POSIX ACLs · Windows ACL mapping · auditd

  • Core practice

    Home directory at scale

    NFS/SMB + AD integration · profile roaming

  • Regular delivery

    Immutable / WORM archive tier

    S3 Object Lock · retention policies

  • Advisory

    Windows file services & DFS

    DFS-R · DFS-N · Scale-Out File Server

  • Partner-led

    SAN array integration

    Dell PowerStore/PowerMax · Pure · NetApp · HPE

12 · 10 categories

Backup, DR & data protection

The only category on this page where the deliverable is a number someone measured. "We have backups" is not a recovery plan.

  • Core practice

    Self-hosted backup cluster

    Bacula · Bareos · Amanda · Restic/Borg + repo

    our practice
  • Core practice

    Proxmox Backup Server

    PBS · deduplication · sync & verify jobs

  • Core practice

    Kubernetes backup & restore

    Velero · Kasten K10 · CSI snapshots

  • Core practice

    Database backup at scale

    pgBackRest · XtraBackup · mongodump/mongorestore

  • Core practice

    Off-site & air-gapped vault

    3-2-1-1-0 · immutable repo · Object Lock

  • Core practice

    Dual-site active/active & arbitration

    stretched cluster · witness arbiter · quorum device

  • Core practice

    DR orchestration & runbooks

    Velero · scripted failover · DNS cutover

  • Core practice

    Restore drills & verification

    timed restore · checksum verification · report

  • Regular delivery

    Ransomware-resilient backup design

    hardened repo · offline copy · immutability

  • Partner-led

    Backup appliance integration

    Veeam · Rubrik · Cohesity · Data Domain

13 · 12 categories

Network devices & fabric

Devices are not clusters until someone makes them redundant on purpose. A pair sharing one PDU is one device with extra plastic.

  • Core practice

    Firewall HA cluster

    Fortinet FGCP · PAN-OS HA3 · Check Point ClusterXL · CARP/pfsync

    our practice
  • Core practice

    Switch stack / MLAG

    MLAG · MC-LAG · vPC · VSS · stack cabling

  • Core practice

    EVPN-VXLAN spine-leaf

    Arista EOS · Cumulus · SONiC · FRR

  • Core practice

    Routing overlay & fast convergence

    FRR · BGP · OSPF · IS-IS · BFD · VRF

  • Core practice

    Network automation & source of truth

    NetBox · Jinja2 templating · Oxidized · NAPALM

  • Core practice

    Network validation & simulation

    containerlab · Batfish · pre-change analysis

  • Core practice

    Network telemetry

    sFlow · gNMI · SNMP · LibreNMS · LibreQoS

  • Core practice

    Out-of-band management plane

    serial console servers · segregated OOB · jump host

  • Regular delivery

    Firewall platform migration

    policy conversion · rule clean-up · shadowed-rule analysis

  • Regular delivery

    Routing security

    RPKI · prefix filters · uRPF · max-prefix guards

  • Regular delivery

    Network access control

    802.1X · FreeRADIUS · NAC policy

  • Partner-led

    Structured cabling & optical layer

    MPO/LC · DWDM · patch documentation

14 · 10 categories

Load balancing, ingress & mesh

Traffic entry is where availability is either delivered or quietly given away. Health checks that always pass are worse than none.

  • Core practice

    L4 load balancing

    LVS/IPVS · DSR mode · Maglev · ECMP

    our practice
  • Core practice

    L7 load balancing

    HAProxy · nginx · Envoy · active/passive pair

  • Core practice

    API gateway

    Kong · APISIX · Envoy Gateway · rate limiting

  • Core practice

    TLS termination & certificate lifecycle

    ACME/Let's Encrypt · cert-manager · internal CA · mTLS

  • Core practice

    Container ingress

    Envoy Gateway · Traefik · MetalLB BGP

  • Regular delivery

    Global server load balancing

    GSLB · DNS steering · health-based failover

  • Regular delivery

    Service mesh

    Istio · Linkerd · Cilium Service Mesh

  • Regular delivery

    WAF cluster

    ModSecurity/CRS · reverse-proxy WAF · tuning

  • Advisory

    DDoS mitigation & abuse controls

    scrubbing · rate limiting · SYN cookies

  • Partner-led

    Hardware ADC

    F5 BIG-IP · Citrix ADC · A10 Thunder

15 · 8 categories

Foundation network services

DNS, DHCP and time. Nobody plans capacity for them, and when they fail the whole company files a ticket in the same minute.

  • Core practice

    Anycast DNS cluster

    BIND 9 · Knot DNS · PowerDNS · Unbound

    our practice
  • Core practice

    DNS HA & hidden primary

    secondary zones · catalog zones · TSIG · DNSSEC

  • Core practice

    DHCP HA

    Kea HA hook · ISC DHCP failover · subnet delegation

  • Core practice

    Time & frequency services

    chrony · ntpd · GPS/GNSS refclock · PTP grandmaster

  • Core practice

    Internal service discovery

    CoreDNS · Consul DNS · external-dns

  • Core practice

    Certificate authority cluster

    step-ca · EJBCA · HSM-backed root · ACME

  • Regular delivery

    AAA services

    FreeRADIUS (HA) · tac_plus · AD integration

  • Regular delivery

    Mail transfer & relay cluster

    Postfix · Dovecot · relay pair · DKIM/SPF/DMARC

16 · 10 categories

Identity, directory & secrets

The cluster nobody lists and everybody depends on. Multi-master directory replication failure shows up as "users cannot log in" — usually on a Monday.

  • Core practice

    FreeIPA / Red Hat IdM cluster

    FreeIPA · 389 Directory Server · replicas · CA renewal

    our practice
  • Core practice

    OpenLDAP with syncrepl

    OpenLDAP · syncrepl · delta replication

  • Core practice

    Single sign-on cluster

    Keycloak · OIDC/SAML · HA across sites

  • Core practice

    Secrets management

    HashiCorp Vault · Raft storage · auto-unseal · HSM

  • Core practice

    Service registry & mesh PKI

    Consul · gossip encryption · ACL · Connect CA

  • Core practice

    Kubernetes secrets delivery

    External Secrets Operator · Sealed Secrets · SOPS

  • Regular delivery

    Workload identity & SPIFFE

    SPIRE · cert-manager · short-lived certs

  • Regular delivery

    Privileged access management

    Teleport · bastion cluster · session recording

  • Regular delivery

    Zero-trust overlay access

    WireGuard mesh · Tailscale · NetBird · policy

  • Advisory

    Active Directory domain controllers

    AD DS · multi-site replication · FSMO · Azure AD Connect

17 · 11 categories

Application & web clusters

The layer the business actually sees. Session handling and upgrade windows are where the downtime comes from.

  • Core practice

    LAMP / LEMP cluster

    nginx + PHP-FPM + Galera · shared session store

    our practice
  • Core practice

    Java application cluster

    Tomcat · WildFly/JBoss EAP · JGroups · mod_cluster

  • Core practice

    CMS at scale

    WordPress · Drupal · object-cache · read replicas

  • Core practice

    Session & state clustering

    Redis-backed sessions · sticky routing · JWT

  • Core practice

    API backend cluster

    FastAPI · Node · gRPC behind L7 LB · autoscaling

  • Regular delivery

    Shared / managed hosting platform

    cPanel/WHM HA · Plesk · DirectAdmin · CageFS

  • Regular delivery

    Realtime media cluster

    SRS · nginx-rtmp · LiveKit · Janus · TURN servers

  • Regular delivery

    Edge caching & CDN origin

    Varnish · Cloudflare · Fastly · origin shielding

  • Advisory

    Jakarta EE application servers

    WebLogic · WebSphere · cluster agents

  • Advisory

    IIS / .NET farm

    IIS · ARR · shared config · session state

  • Not ours

    ERP platform administration

    SAP Basis · NetWeaver · Solution Manager

18 · 8 categories

CI/CD & artifact platforms

The pipeline is now production infrastructure. When runners are queued, every team stops at once.

  • Core practice

    CI runner fleet

    GitLab Runner (autoscaling) · Jenkins agents · Buildkite

    our practice
  • Core practice

    GitOps control plane

    Argo CD · Flux · ApplicationSets · environment promotion

  • Core practice

    Artifact registry cluster

    Harbor · Nexus · Artifactory · replication

  • Core practice

    Container registry HA

    Harbor HA · distribution + object storage · GC policy

  • Core practice

    Build cache & shared storage

    S3-backed cache · NFS cache · Bazel remote cache

  • Regular delivery

    Jenkins HA controller

    Jenkins + Kubernetes agents · config as code

  • Regular delivery

    Progressive delivery

    Argo Rollouts · Flagger · canary analysis

  • Regular delivery

    Supply chain security

    cosign · SBOM · SLSA · Trivy in pipeline

19 · 10 categories

Observability & monitoring

Long-term metric storage and alert routing are clustering problems, not dashboard problems.

  • Core practice

    Metrics cluster

    Prometheus HA pairs · Thanos · Mimir · VictoriaMetrics

    our practice
  • Core practice

    Logging cluster

    Loki · Elasticsearch/OpenSearch · Fluent Bit · retention tiers

  • Core practice

    Dashboard & alerting HA

    Grafana HA · Alertmanager cluster · silences

  • Core practice

    Kubernetes-native observability

    Hubble · Cilium · kube-state-metrics · metrics-server

  • Core practice

    Synthetic & endpoint monitoring

    Blackbox exporter · Uptime Kuma · probe nodes

  • Core practice

    Network & SNMP monitoring

    LibreNMS · SNMP polling · flow analytics

  • Regular delivery

    Tracing cluster

    Tempo · Jaeger · OpenTelemetry Collector

  • Regular delivery

    Legacy monitoring HA

    Zabbix HA (server + proxies) · Icinga pair · Nagios

  • Regular delivery

    Cost observability

    OpenCost · Kubecost · chargeback reports

  • Regular delivery

    On-call & escalation plumbing

    Alertmanager routing · PagerDuty · escalation policy

20 · 9 categories

Security operations clusters

Security tooling you cannot query under load is security tooling you will not use. Indexing and retention are capacity problems first.

  • Core practice

    Bastion & jump host cluster

    Teleport · Apache Guacamole · session recording

  • Core practice

    Hardening baseline & compliance scan

    OpenSCAP · CIS benchmark · Lynis · AIDE · auditd

  • Regular delivery

    SIEM cluster

    Wazuh · Elastic Security · Splunk indexer cluster

    our practice
  • Regular delivery

    IDS / IPS cluster

    Suricata · Zeek · Snort · tap / mirror ports

  • Regular delivery

    Vulnerability scanning infrastructure

    Nessus · OpenVAS · Trivy · scan scheduling

  • Regular delivery

    Network segmentation

    Cilium network policy · microsegmentation · DMZ design

  • Regular delivery

    Endpoint & fleet inventory

    osquery · Fleet · Ansible-driven compliance

  • Advisory

    Deception & honeypots

    T-Pot · canary tokens

  • Not ours

    Managed detection & response staffing

    24×7 SOC analyst coverage

21 · 10 categories

Edge, SD-WAN & multi-site

Every site is a small cluster with a big dependency: the link. Design for the link being gone, not for it being fast.

  • Core practice

    WireGuard mesh / overlay networking

    WireGuard · Tailscale · NetBird · ZeroTier

  • Core practice

    Multi-site L2/L3 extension

    VXLAN · EVPN multi-site · stretched VLAN discipline

  • Core practice

    Edge Kubernetes fleet

    K3s · k0s · KubeEdge · OpenYurt · offline-tolerant updates

  • Core practice

    Remote-site failover

    local breakout · DC failover · link-state automation

  • Core practice

    Centralised fleet management

    Rancher · Argo CD · SUSE Edge · GitOps at the edge

  • Core practice

    Site survivability

    local cache · store-and-forward · degraded mode

  • Regular delivery

    SD-WAN overlay

    VeloCloud · Cisco Catalyst SD-WAN · Fortinet Secure SD-WAN

    our practice
  • Partner-led

    WAN optimisation & SD-Branch

    vendor appliances · policy routing

  • Partner-led

    Private cellular & 5G core

    CBRS · private 5G core · SIM provisioning

  • Not ours

    OT / ICS control systems

    PLC programming · SCADA engineering · safety systems

22 · 10 categories

Multi-cluster, migration & platform engineering

Where a fleet stops being "some clusters" and becomes a platform. This is the layer that determines your cost per workload.

  • Core practice

    Multi-cluster management

    Karmada · Open Cluster Management · Rancher

    our practice
  • Core practice

    Fleet provisioning

    Cluster API · Terraform/OpenTofu · Ansible

  • Core practice

    Cloud → bare metal migration

    cost modelling · workload porting · cutover plan

  • Core practice

    VMware → KVM / Proxmox migration

    virt-v2v · wave planning · rollback rehearsal

  • Core practice

    Datacentre relocation

    rack move · cluster evacuation · data replication

  • Core practice

    Infrastructure as code at fleet scale

    Terraform · OpenTofu · Ansible · Terragrunt

  • Core practice

    Policy as code

    Kyverno · OPA Gatekeeper · Conftest · CI gates

  • Core practice

    Capacity & cost engineering

    utilisation analysis · right-sizing · headroom modelling

  • Core practice

    Cluster health assessment

    38-point checklist · SPOF map · prioritised findings

    our practice
  • Regular delivery

    Internal developer platform

    Backstage · Port · golden paths · service catalogues

Why we publish the gaps A capability list with no gaps in it is not a capability list, it is a brochure. The categories marked partner-led or not ours are the ones our competitors quietly accept and then subcontract. We would rather name them now and bring the right specialist into the room on your behalf — including, where it is genuinely better for you, one who is not us.

Found your cluster on this list?

Tell us which one is keeping you up at night. A thirty-minute call with an engineer, no deck, no obligation — and if it is one of the categories we do not own, we will say so on that first call.