The full cluster capability matrix
23 disciplines, each with its own page. Every page tells you the same five things: what the current situation usually looks like, what we deliver in each engagement tier, which technologies and versions we use, the numbers we will be measured on, and — the part most vendors skip — what we don't do.
Everything above it depends on this being boring
Switches, routers, firewalls, SAN fabrics and the services that hold the network together. The layer that never fails until it does, and the one most often run on tribal knowledge.
Network clusters (L2/L3)
Firewall pairs that actually fail over on purpose, switch stacks and MLAG pairs that neither loop nor blackhole when a member dies, and routers whose routing convergence you have measured instead of assumed.
- EVPN-VXLAN / MLAG
- FRR + BGP · VRRP
- Fortinet FGCP / PAN-OS HA
SAN & storage networking
Dual-fabric SANs with zoning a human can read, multipathing proven by actually pulling a path, and NVMe-oF over lossless Ethernet that does not drop a frame under load.
- FC zoning · dual fabric
- NVMe-oF (RDMA / TCP)
- dm-multipath · ALUA
Foundation network services
The three services nobody capacity-plans for, and the first three that page the whole company at the same minute when they fail.
- BIND 9 · Knot · PowerDNS
- Kea DHCP HA
- chrony · PTP grandmaster
SD-WAN & multi-site
Every site is a small cluster with one big dependency: the link. We design for the link being gone, not for it being fast.
- WireGuard overlay
- FRR + BFD sub-second failover
- Policy-based breakout
The layer everything else stands on
Hardware, operating systems, orchestration, high availability, traffic entry and identity. Get this wrong and every layer above inherits the problem.
Bare metal & OS layer
Twenty machines arrive. In fifteen minutes each they are identical, provisioned from Git, and ready to join a cluster — with nobody logging in by hand.
- MAAS / iPXE
- Ansible + AWX
- Talos / Flatcar
Kubernetes & container platform
A cluster you can upgrade without holding your breath, whose etcd backup you have actually restored, and which you could rebuild from code in under an hour.
- kubeadm / RKE2 / Talos
- Cilium + eBPF
- Argo CD GitOps
High availability & failover
Most HA clusters have never actually failed over. We build them so the failover works, and then we prove it by pulling the plug.
- Pacemaker + STONITH
- Keepalived + VRRP
- DRBD 9 / LINSTOR
Load balancing & ingress
Traffic enters your infrastructure once, and it enters through a design you can explain, test with real numbers, and renew certificates without anyone waking up.
- LVS / IPVS
- HAProxy + Envoy
- Gateway API / Cilium
Directory, identity & secrets
One directory that can answer "who has access to what", replicated across sites, with certificate and secret lifecycles that do not depend on a calendar reminder.
- FreeIPA / 389 DS
- Keycloak · OIDC / SAML
- Vault + Consul
Where the outages hurt
Where the value lives and where an hour of downtime costs the most: databases, messaging, streaming, object and file storage, and the analytics built on top of them.
Distributed storage
Ceph, BeeGFS and MinIO clusters designed around your real failure domains, benchmarked with fio, and proven to survive a disk, a node, and a rack going away.
- Ceph + Cephadm
- BeeGFS / Lustre
- Rook on Kubernetes
Database clusters
The cluster that keeps your business alive. Planned failover in seconds, backups you have actually restored, and upgrades performed while the application keeps writing.
- Patroni + etcd
- Galera / Group Replication
- ClickHouse + Keeper
Caching & messaging
Kafka, Pulsar, NATS and Redis clusters that survive a broker loss without losing a record, and that tell you about consumer lag before your customers do.
- Kafka KRaft
- Strimzi on K8s
- Redis Cluster
Big data & lakehouse
Spark, Flink, Trino and an open table format on storage you control — so analytics stops being a separate, expensive, fragile universe.
- Spark on K8s
- Trino / Iceberg
- Flink on K8s
File & block services
The file services your users actually touch every day, made redundant without changing a single path or permission they are used to.
- clustered Samba · CTDB
- NFS-Ganesha · pNFS
- CephFS / DRBD backends
Where the money goes
The expensive part, and the part most often under-utilised or badly scheduled — from batch HPC to GPU fleets to the desktops people log into every morning.
HPC & AI / GPU clusters
Your GPUs are expensive and mostly idle. We fix the part that wastes them: the scheduler, the fabric, the storage feeding them, and the way jobs queue.
- Slurm + Slinky
- NVIDIA GPU Operator + DRA
- vLLM / KServe
Observability clusters
Metrics, logs and traces that survive a node loss, alert on things that matter, and cost less than the infrastructure they watch.
- Prometheus + Thanos
- Loki + OpenTelemetry
- OpenCost
VDI & desktop virtualisation
Centralised desktops judged on one number: how long a login takes during the morning rush, when everyone arrives at once.
- Proxmox VE + Kasm Workspaces
- golden image pipeline
- profile redirection
What the business actually sees
The application tier, the pipeline that deploys it, and the platform that keeps a fleet of clusters consistent. Where platform engineering stops being a job title and becomes infrastructure.
Virtualization & HCI
Licence costs that do not triple every renewal. Proxmox VE, Ceph, KubeVirt and OpenStack, with a migration plan that includes a tested way back.
- Proxmox VE + Ceph
- Harvester / KubeVirt
- OpenStack Kolla
Fleet, DR & security
The layer that holds every other cluster type together: fleets that deploy the same way everywhere, DR that has been rehearsed, and security that produces evidence.
- Karmada / Fleet
- Velero + witness DR
- Vault + Cosign
Application & web clusters
Deployments that happen on a Tuesday afternoon because the application tier holds no state — which is the actual prerequisite, not the deployment tool.
- nginx + PHP-FPM
- Tomcat · WildFly · JVM clustering
- Redis sessions · object storage
CI/CD & artifact platforms
Your pipeline is production infrastructure now. It gets the same availability design, backup and monitoring as anything customer-facing.
- GitLab Runner fleet
- Harbor HA registry
- Argo CD + Vault
The layer that decides whether you survive it
Backup, recovery and security operations. The two disciplines where the deliverable is evidence rather than architecture, and where nobody is impressed until the day they need it.
Backup & disaster recovery
Recovery tiers with a measured RTO, an off-site copy that cannot be encrypted by ransomware, and a restore drill the board can read.
- Proxmox Backup Server · Bareos
- Velero · Kasten
- Immutable off-site vault
Security operations clusters
Security tooling you cannot query under load is security tooling nobody uses. Indexing and retention are capacity problems before they are policy problems.
- Wazuh · OpenSearch
- Suricata / Zeek
- hardening baselines (CIS)
Not sure which one you need?
That is normal, and it is usually two or three of them. Describe the symptom and we'll tell you which discipline it actually belongs to — including when the answer is 'none of them, here's a cheaper fix'.