Our engineers work with the CNCF catalogue every day: the graduated and incubating projects that underpin production Kubernetes. Membership keeps us close to how those tools evolve, so what we build for clients tracks where the ecosystem is going, not where it was.
Cloud native is where we started.
Kubernetes practitioners since "cloud native" was a niche conversation, on production platforms across media, finance, energy, travel and education.
Three ways CNCF membership shows up in our work
First, in the platforms we build.
Second, in the standards we follow.
We contribute to open source across the cloud native community and engage with the CNCF Technical Advisory Groups whose remit overlaps with our work, particularly platform engineering, security, and observability. The standards we recommend are ones we help shape.
Third, in the advice we give.
Membership is vendor-neutral by design. We recommend what fits your architecture and your business, not what someone is selling. Three years of production work across the community means we have a view, not just a preference.
Where Kubernetes fits,
and where it doesn't
Kubernetes is the most successful distributed system ever built, and one of the easiest to misuse. It's the wrong answer for a small team with a single product who'd be better served by a managed platform. It's the right answer for organisations running multiple services at scale, with the operational maturity to support it.
We've migrated clients onto Kubernetes when it was the right call. We've talked clients out of it when it wasn't. Both conversations are part of the work.
Four principles guide how we engage. Kubernetes is infrastructure, not a product, which means the platform your product teams interact with is the one your team builds on top. Upstream first, custom last, because the CNCF catalogue has strong, widely-adopted building blocks for almost every problem a platform team faces. Operability beats novelty, because a production platform is judged on how it behaves at 3am, not on which new sandbox project it uses. And the cluster is not the boundary: security, identity, networking, cost, and data all extend across clusters, clouds, and on-premises environments, so we design for that from day one.
We've migrated clients onto Kubernetes when it was the right call. We've talked clients out of it when it wasn't. Both conversations are part of the work.
Four principles guide how we engage. Kubernetes is infrastructure, not a product, which means the platform your product teams interact with is the one your team builds on top. Upstream first, custom last, because the CNCF catalogue has strong, widely-adopted building blocks for almost every problem a platform team faces. Operability beats novelty, because a production platform is judged on how it behaves at 3am, not on which new sandbox project it uses. And the cluster is not the boundary: security, identity, networking, cost, and data all extend across clusters, clouds, and on-premises environments, so we design for that from day one.
A reference model for production Kubernetes
Every platform is unique, but the concerns are the same. This is the shape of a platform we typically help build and run, and as much a matter of what we leave out as what we include.
Cluster foundations
Conformant Kubernetes on any of the major clouds (EKS, GKE, AKS)
containerd as the default container runtime
CoreDNS for cluster DNS
etcd for the control plane's state, managed appropriately by the chosen distribution.
Networking and service connectivity
Cilium for CNI, network policy and eBPF-based observability where it fits the needs
Istio or Linkerd for service mesh when traffic management, mTLS and resilience warrant it, chosen on the concrete needs of the workload
Ingress and API gateway patterns selected to match the existing edge and identity stack
Delivery and GitOps
Argo CD or Flux for GitOps-driven continuous delivery: declarative, auditable, and aligned with the OpenGitOps principles maintained under the Argo and Flux communities
Argo Workflows for pipeline-style orchestration when a CI/CD workflow needs to live alongside the cluster
Security and supply chain
cert-manager for X.509 certificate issuance and rotation
Kyverno for admission control and policy
Harbor as a private OCI registry with scanning and signing
Supply-chain controls: signed images, SBOMs, provenance attestations, and a clear story from commit to cluster
Observability
Prometheus for metrics, paired with Alertmanager
OpenTelemetry as the default instrumentation standard for traces, metrics and logs, portable across backends
Fluentd or Fluent Bit for log collection
Grafana for visualisation and SLO dashboards
Our services
Platform engineering
We design and build production-grade Kubernetes platforms on AWS, GCP, Azure or on-premises. That typically covers: cluster lifecycle and upgrade strategy, multi-cluster and multi-tenant design, GitOps workflows, developer self-service, secure defaults, resource and autoscaling policies, and clear contracts between the platform team and the product teams that depend on it.
Application modernisation
Containerising and re-architecting legacy workloads for Kubernetes, starting with the ones where the change actually pays for itself. We care about a realistic migration path, not a full rewrite, and about leaving the estate in a state your team can maintain.
Security and supply chain
Cluster hardening, secrets management, workload identity, admission policy, image signing, SBOM generation, runtime detection, and the CI/CD integrations that keep the whole chain honest. Informed by CNCF TAG Security guidance and SLSA.
Observability and SRE
Telemetry pipelines built on OpenTelemetry, Prometheus, and the logging and tracing components above. On the practice side: meaningful SLOs and error budgets, on-call design, incident-response simulations ("fire drills"), and blameless postmortems that feed back into the platform. Our goal is always to reduce toil and increase the team's confidence in production.
GitOps and continuous delivery
Reproducible, auditable delivery pipelines built around Argo CD or Flux. Declarative environments, progressive delivery patterns, and a clear story for rollback. Where it helps, we implement patterns aligned with the OpenGitOps principles.
Training and enablement
Through our training, certifications and day-to-day collaboration, engineers get to sharpen their skills on the same tools used by the world's most demanding platforms. CNCF-aligned training pathways are a useful spine for that work.
Inside CNCF membership
We're a CNCF Silver Member, part of the Linux Foundation that is home to Kubernetes and over 150 graduated, incubating, and sandbox projects. Our engineers stay current because they learn from the people writing the standards, then bring those insights into every engagement.
Our engineers have made thousands of contributions to open source across the cloud native, JavaScript, and data communities, and attend KubeCon + CloudNativeCon each year. That keeps us close to what's being built, what's failing, and where the ecosystem is heading. We carry those patterns from one client to the next and bring them back to the practice.
Our engineers have made thousands of contributions to open source across the cloud native, JavaScript, and data communities, and attend KubeCon + CloudNativeCon each year. That keeps us close to what's being built, what's failing, and where the ecosystem is heading. We carry those patterns from one client to the next and bring them back to the practice.
Our Work
Media / Publishing
A global publishing platform on Kubernetes
A multi-tenant containerised environment serving dozens of brands across multiple markets from a single foundation. Declarative infrastructure, GitOps workflows, shared observability and security baselines.
Learn More
Fintech / Digital assets
Uphold: Kubernetes best practices and SRE for a regulated platform
Cluster hygiene, autoscaling policies, secrets and policy management, and supply-chain security. SRE practices including meaningful SLOs, error budgets, actionable observability, and blameless postmortems that feed back into the platform.
Learn More
Web3 / Digital assets
Ledger: DevOps maturity for a regulated digital-assets platform
A hands-on assessment and prioritised roadmap covering unified observability, incident-response simulations, and clearer alignment between development, SRE and platform teams. The work moved the organisation from reactive firefighting to a preventative culture.
Learn More
Fintech / Payments
Astrada: a PCI-compliant, Kubernetes-ready platform
A containerised, PCI-compliant architecture on AWS using Docker, Terraform, GitHub Actions and Atlantis. A secure tokenisation service on HashiCorp Vault and PostgreSQL with audit logging and key rotation.
Learn More
Cloud infrastructure
Joyent: a control plane for cloud native applications
CoPilot, an application management platform combining Triton cloud with ContainerPilot orchestration. Single sign-on, multi-service deployment, topology visualisation and real-time monitoring.
Learn More
Keep Reading
Engineering
Kubernetes Engineering Practice
The deeper view: how we design, build and run cloud native platforms, and the reference model we work from.
Learn More
Engineering
Software Engineering
Experienced engineers building robust, scalable systems with a focus on what matters.
Learn More
Design
Product Design and Development
Senior designers creating user-centred products that balance usability and business goals.
Learn More
Building or rebuilding on Next.js?
We’ll tell you what works in production, not just in demos.