We design, deploy and maintain Kubernetes clusters — from dev to production, on-prem, bare-metal and in the cloud.
Services
- Cluster design: bare-metal, RKE2/K3s, managed (EKS/GKE/AKS)
- Networking: CNI, Ingress (Traefik/NGINX), mTLS and Service Mesh
- Observability: Prometheus, Grafana, Loki, tracing, error budgets
- GitOps: ArgoCD, FluxCD, GitLab CI and Helm/Kustomize deployments
- Security: RBAC, NetworkPolicy, pod security, scanning
- Cluster backup (Velero) and Disaster Recovery
- Pod cost and size optimization (HPA, VPA, quotas)
We enrich your projects with GitHub/GitLab automation and full technical documentation.
We implement Kubernetes cluster backup with Velero — complete backups of applications, cluster resources (including CRDs) and PV data, with restore in place, to a new cluster or into a cloud environment.
What it covers
- Cluster object backup: Namespaces, Deployments, Services, ConfigMaps, Secrets and CRDs
- PV data backup — CSI snapshots (VolumeSnapshots) and file-based copies (restic/Kopia)
- Scheduled backups and TTL retention policies
- S3-compatible storage: MinIO/S3 (self-hosted), Wasabi, AWS S3, Azure Blob
- Application migrations between clusters — backup in one, restore in another (dev/stage/prod)
- Recovery drills and Disaster Recovery procedures with RTO/RPO targets
- Monitoring integration — alerts on failed backups
- Extensions: cloud provider plugins, encryption, multiple BackupStorageLocations
We keep the configuration (velero install, schedules, storage location) in a GitOps repository and test restores regularly — so recovery after an outage is real, not just theoretical.
We deploy and maintain Kubernetes cluster networking on Cilium — a modern eBPF-based CNI with full security policy, Service Mesh and observability support.
What it covers
- Cilium (CNI) installation with KubeProxyReplacement, clustermesh and routing modes (native/routed/overlay)
- Service networking: ClusterIP, NodePort, LoadBalancer with BGP (via MetalLB) — no kube-proxy
- Network policies (CiliumNetworkPolicy) L3/L4/L7 — zero-trust between pods
- mTLS encryption of node/pod traffic and Ingress/Gateway API integration
- Observability: Hubble (flows, service map), Prometheus metrics, tracing
- Security: IDS (L7 filtering), identity-based networking, DSR (Direct Server Return)
- Migration from an existing CNI (e.g., Calico) without downtime, k8s + egress optimization
We keep the configuration (helm, podCIDR, IPAM, policies) in a GitOps repository and test changes on a staging cluster first.