Services / Cloud infrastructure
CloudA landing zone you can take to production
Accounts, networks, IAM, and logs are in code. Kubernetes carries the application. Argo CD deploys. Terraform holds the foundation. Grafana and budget watch so the cloud does not run away in cost or configuration. A hybrid with on-prem is a normal scenario.
How it fits together
Foundation, cluster, delivery, steering
A subscription alone is not a platform. We put Terraform, Kubernetes, Argo CD, and observability together, with FinOps from day zero.
- A PoC does not skip IAM and logs. A shortcut at the start comes back as audit cost.
- Multi-cloud is not a goal. Repeatability and hybrid are, when the business needs them.
Account and network organization as code
Landing zone: org, folders, networks, IAM, logs, guardrails. A module per environment. Plan before apply. Drift does not stay for later.
Organization
Accounts and subscriptions with a blast radius boundary. Separate production, separate logs.
Network
VPC, peering, PrivateLink, hybrid to on-prem. Private origin by default.
Guardrails
SCP, policy, mandatory tags, no public bucket without an exception.
Review
Plan in a merge request. Apply with pipeline identity, not with a key on a laptop.
EKS, AKS, GKE, or self-hosted, the same discipline
A managed cluster does not excuse you from NetworkPolicy, etcd or volume backup, upgrade, and limits. We add serverless where the traffic model justifies it, not as a default creed.
Add-ons
Ingress, DNS, CSI, autoscaler. Versions in code.
Data
Managed databases or on the cluster with backup. Secret in vault, not in ConfigMap.
Upgrade
Version plan, PDB, test on staging. A change window with rollback.
Cost
Right-size the node group from the start, tags, anomaly. FinOps does not wait for the invoice.
The application enters through Git, not through the cloud console
The AWS console is not a deploy tool. Argo CD holds state. Cloud permissions stay in pipeline IAM and in GitOps, with an audit.
Environments
The same chart, different values. Promotion through merge, not through a click.
Boundaries
A project per team. Production has narrower RBAC.
Secrets
External secrets or Sealed, rotation, no plaintext in the repo.
Failure
Rollback to a commit. A playbook for the region and for the cluster itself.
Health, cost, and logs in one rhythm
CloudWatch, Metrics Server, and central logs go to Grafana or stay in the native tool with a bridge. What matters is that on-call has one picture and that budget sits next to SLO.
Telemetry
API, database, queue, EKS, tag cost. An alert on error and on a billing anomaly.
Logs
Retention, encryption, who reads. Cloud trail does not sit unused.
Hybrid
The same dashboard for VPC and for the server room, when the bridge is already there.
People
Engineering and finance see the cost of a service, not only the account total.
Operations
From account to production
First organization and network. Then cluster and GitOps. Finally SLO, budget, and hybrid.
- Landing zone Org, IAM, network, logs, tags, budget.
- Platform Cluster, add-ons, secrets, backup.
- Delivery CI, Argo CD, environments, RBAC.
- Rhythm Upgrade, cost, alert, policy review.
Talk
We will discuss landing zone, cluster, and cost
On that basis we will prepare a cloud scope, from foundation to day-2 rhythm.
Contact us