Managed Kubernetes & Container Platform Services
A cluster you can upgrade without holding your breath, whose etcd backup you have actually restored, and which you could rebuild from code in under an hour.
What this usually looks like
The cluster runs. The problem is everything about changing it, or recovering it, or explaining it to anyone.
- Nobody wants to touch the version upgrade because the last attempt broke ingress.
- etcd backups exist, but no restore has ever been timed, so nobody knows if they work.
- Secrets live in a ConfigMap repo that is one bad commit from leaking.
- Multi-tenancy is enforced by convention and a stern README.
Three ways to buy this
Audit if you want to know how bad it is. Build if you have the team and want the capability. Managed if you don't want to own the pager. Most engagements start with the audit and decide afterwards.
Audit
A fixed-price health check — the cheapest way in
- Control-plane and etcd health review, backup restorability test
- Network policy and RBAC effective-permission audit
- Upgrade path assessment from your current version
- Pod Security and admission-control gap list
Build
One-off delivery: design, code, hardening, handover
- Cluster built from an approved design (HA control plane, external etcd)
- GitOps from day one — Argo CD or Flux, with environment promotion
- Cilium-based networking, network policies, and observability
- CSI storage, ingress via Gateway API, cert-manager, external-secrets
- Upgrade runbook validated on a staging cluster before production
Managed
Build plus 7×24 on-call, SLA and quarterly drills
- Version upgrades executed on an approved patch window
- etcd backup verification — a real restore, every quarter, timed
- Node lifecycle and autoscaling tuning
- Cluster policy drift detection and remediation
- Capacity review with cost per workload reported
What we actually deploy
Specific tooling, not categories. If a version matters to your decision, ask — we will tell you which one we would pick and why, including when the answer is the older one.
Distributions & installers
- upstream kubeadm 1.31–1.34
- Kubespray
- RKE2
- K3s
- Talos Linux
- k0s
- OKD / OpenShift
- Cluster API
Bare metal providers
- Metal3
- Sidero
- vSphere provider
- Cluster API on Proxmox
Networking
- Cilium 1.16–1.18 (eBPF, kube-proxy-free)
- Calico
- Multus CNI
- MetalLB / PureLB
- Gateway API 1.2
- BGP peering / FRR
Storage (CSI)
- Rook-Ceph
- Longhorn
- Trident
- OpenEBS Mayastor
- CSI hostpath
GitOps & lifecycle
- Argo CD
- Flux v2
- Helm / Kustomize
- Renovate / Dependabot for pinned versions
Policy & secrets
- Kyverno
- OPA Gatekeeper
- Pod Security Admission
- External Secrets Operator
- HashiCorp Vault
- SOPS + age
Autoscaling & scheduling
- HPA / VPA
- KEDA
- Cluster Autoscaler
- Kueue
- Volcano
Multi-cluster
- Rancher Prime
- Karmada
- vCluster
- Argo CD ApplicationSet
- Cilium Cluster Mesh
What we will be measured on
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
- Rolling upgrade with zero dropped packets on a monitored service, and a rollback plan rehearsed beforehand.
- etcd backup restore tested every quarter, with the measured recovery time published to you.
- Full cluster rebuild from IaC in ≤ 45 minutes on the same hardware.
- 100% of workloads governed by an enforced policy — not a README.
- No cluster-admin credentials in daily use; break-glass access is logged and time-boxed.
What we would build, and where the weak point is
Three control-plane nodes is the minimum for real consensus. If they sit in the same rack on the same PDU, that is a single point of failure wearing a quorum costume — we will say so.
marks a single point of failure we would raise with you rather than hide. Every architecture has one; the question is whether you know where it is.
What we don't do
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
- Out of scope
Application code, Helm charts for your own services, CI pipelines
We give you the platform and the guardrails. Your application team owns their manifests.
- Requires partner
Managed cloud K8s (EKS/GKE/AKS) as a primary deliverable
We integrate with them and can operate them, but our engineering strength is where you own the whole stack.
- Out of scope
Windows container workloads
Linux nodes and Linux containers only.
- Requires partner
24×7 on-call
Included in Managed tiers under /managed/, not in a one-off Build engagement.
What it looked like last time
A production cluster carried from Kubernetes 1.26 to 1.33 across four upgrade windows with a measured zero-error rate on ingress traffic, plus a quarterly etcd restore that completes in under 11 minutes.
Anonymised under NDA. No client names, no logos, no invented metrics. Full case library on the work page.
Talk to the kubernetes platform lead about your kubernetes & container platform
Send us the architecture, or just describe what broke most recently. You'll get an engineer's answer, not a discovery questionnaire.
Talk to a kubernetes platform lead: botonwa@gmail.com · +86 130 5181 3099