Kubernetes & service mesh
Kubernetes is an open source platform for managing containerized workloads, built around declarative configuration: you describe the state you want and the system works to maintain it, with scaling, failover, service discovery, rollouts and self-healing. It provides building blocks rather than a finished platform, so the surrounding choices matter.
What we do
- Cluster design, upgrades and capacity planning
- Cilium CNI with identity-based network policy
- Service-to-service mTLS with a service mesh where justified
- GitOps delivery with Argo CD or Flux
- Helm and Kustomize packaging standards
- Hubble and Prometheus observability
- Gateway API ingress and traffic rules
- Backup and rebuild runbooks for clusters
Cilium handles networking with eBPF in the Linux kernel: identity-aware policy from Layer 3 to 7, kube-proxy replacement, Cluster Mesh across clusters and Hubble flow visibility. Service meshes such as Linkerd, the first mesh and the only one graduated from the CNCF, add mutual TLS between services; Istio is the other widely used option. For delivery, Argo CD and Flux apply GitOps: Git is the source of truth and the cluster is continuously reconciled to it.
We keep clusters small and boring: one network policy model, one GitOps tool, mTLS where it earns its cost. Experience on these projects, not a partnership. Works with our cloud management and cybersecurity services.
Leading platforms we work with
- Kubernetes
- Cilium
- Linkerd
- Argo CD
- Flux
- Istio
Platforms and practices
- Helm and Kustomize
- Gateway API
- Hubble observability
- Progressive delivery with Flagger
References
- Kubernetes: overview
- Cilium: introduction
- Linkerd: what is a service mesh
- Argo CD documentation
- Flux: concepts
- CNCF: Istio project (Graduated, 12 July 2023)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Kubernetes & service mesh for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat does Kubernetes do and not do?
Kubernetes manages containerized workloads from declarative configuration, with scaling, failover, rollouts and self-healing. It provides building blocks, not a finished platform, so networking, security and delivery choices still matter.
Do we need a service mesh?
Only where it earns its cost. A mesh such as Linkerd or Istio adds mutual TLS between services, but also operating effort. We use it where mTLS between services is a real requirement.
What does Cilium add?
Networking with eBPF in the Linux kernel: identity-aware policy from Layer 3 to 7, kube-proxy replacement, Cluster Mesh across clusters and Hubble flow visibility.
What is GitOps?
Git is the source of truth and the cluster is continuously reconciled to it, using Argo CD or Flux. Every change is reviewed and reversible.
When should we not use Kubernetes?
For a few applications, plain containers or virtual machines are simpler to run. We avoid adding a platform your team would struggle to operate.
How do you recover a cluster?
We write backup and rebuild runbooks, with the cluster described in Git so it can be recreated, and test them. Clusters are kept small and boring.