Cloud foundations
We build infrastructure as a service (IaaS) foundations on Google Cloud, Amazon Web Services, and Microsoft Azure: compute, networking, storage, and the platform services around them. Our cloud partnerships inform the architecture and day-to-day engineering. We choose services around your workloads, existing investments, and operational needs.
| Cloud platform | What we build with |
|---|---|
| Google Cloud | Compute Engine, VPC networking, Cloud Storage, and Google Kubernetes Engine (GKE). |
| Amazon Web Services | EC2, VPC networking, S3, and Amazon Elastic Kubernetes Service (EKS). |
| Microsoft Azure | Virtual Machines, Virtual Network, Blob Storage, and Azure Kubernetes Service (AKS). |
| Cloudflare | DNS, CDN, application security, and Workers for serverless services at the edge. |
Infrastructure as code makes provisioning repeatable and decisions reviewable. We use managed services where they make operational sense, and document the cloud-specific choices and dependencies.
Open source & delivery
We favor established open source projects, standard interfaces, and communities that outlast any individual consulting engagement. The Cloud Native Computing Foundation (CNCF) ecosystem is central to this approach, including Kubernetes, Argo, Helm, and Prometheus. We combine this open source foundation with Terraform for infrastructure provisioning.
| Technology | Its role in your platform |
|---|---|
| Kubernetes | A consistent foundation for running containerized applications, with declarative configuration and familiar operational tooling. |
| Argo CD | GitOps delivery that reconciles Kubernetes applications with the desired state recorded in your repositories. |
| GitOps | Versioned desired state, reviewed changes, and continuous reconciliation. A delivery practice your team can inspect and maintain. |
| Terraform | Infrastructure as code for cloud resources, with reusable configuration and reviewed plans. |
| Helm | Reusable Kubernetes application packaging and configuration. |
| Prometheus, Grafana & OpenTelemetry | Metrics, dashboards, alerts, and instrumentation that give your team visibility into production. |
Tool selection follows your requirements. We build an understandable stack with clear reasons for each component.
Open source from CloudKite
We publish practical tools from our infrastructure work at github.com/cloudkite-io. All of the open source tools we build at CloudKite are MIT licensed, so your team can inspect, adapt, and maintain them independently.
- Terraform modules: Reusable infrastructure definitions for provisioning cloud resources.
- Helm charts: Kubernetes application packaging and deployment configuration.
- GitHub workflows: Reusable continuous delivery workflows for GitHub Actions.
Your platform stays yours
Everything we build must keep working without CloudKite.
Your systems run in your accounts, with your repositories and your access controls. They have no dependency on proprietary CloudKite software, a CloudKite control plane, or a CloudKite license. Your team can continue provisioning, deploying, monitoring, and operating the platform when our engagement ends.
- Cloud accounts and billing: Your organization owns the accounts and retains administrative access.
- Code and state: Infrastructure definitions, deployment configuration, pipelines, and infrastructure state stay in systems you control.
- Identity and secrets: Your directory and secret stores remain the source of access, with CloudKite access scoped and removable.
- Operational knowledge: Architecture decisions, runbooks, recovery procedures, and working sessions give your engineers a practical path to operating independently.
Security from the start
Security belongs in the architecture, delivery pipeline, and daily operations. We use dedicated secret stores, scoped access, and auditable changes to make secure practices part of how the platform runs.
Secrets in the right place
Credentials stay out of source code and container images. We integrate applications and automation with your chosen secret manager, with access policies and rotation appropriate to each workload.
| Secret store | Where it fits |
|---|---|
| Google Cloud Secret Manager | Centralized secrets for Google Cloud applications and automation. |
| AWS Secrets Manager | Managed secrets for AWS workloads, with controlled access and rotation workflows. |
| Azure Key Vault | Azure secrets management with identity-based access controls. |
| 1Password | Team credential management and secrets automation for development and delivery workflows. |
SSO through your existing identity provider
We integrate access with Google Workspace / Cloud Identity, Microsoft Entra ID, and Okta, using SAML or OpenID Connect where supported. Group-based roles, multifactor authentication, and deliberate onboarding and offboarding help keep access accountable. 1Password also supports SSO integration with these providers.
Private access with Tailscale
We use Tailscale to connect engineers, services, and infrastructure over an encrypted private network. Identity-based access policies control who can reach which resources, keeping administrative access private and scoped to the people and systems that need it.
Controls that hold up in production
- Least-privilege IAM and Kubernetes RBAC, with separate human and workload identities.
- Short-lived credentials and workload identity in place of long-lived keys where supported.
- Network segmentation, encrypted connections, and encryption at rest.
- Reviewed infrastructure changes, dependency and image scanning, and a defined patching process.
- Audit logging, actionable alerts, and documented incident and recovery procedures.
SOC 2 support
We help clients turn SOC 2 requirements into working infrastructure controls and maintainable evidence. We work with your compliance lead and independent auditor to agree on scope, responsibilities, and the evidence your program needs.
| Control area | Implementation and evidence we help maintain |
|---|---|
| Access management | SSO, role assignments, access reviews, and records of provisioning and removal. |
| Change management | Pull-request approvals, infrastructure plans, and deployment histories. |
| Monitoring and response | Centralized audit logs, alert routing, incident records, and response runbooks. |
| System protection | Secret management, encryption configuration, vulnerability findings, and remediation records. |
| Recovery and continuity | Backup configuration, restore exercises, and documented recovery procedures. |
The goal is a repeatable operating practice that supports your SOC 2 examination and continues through everyday engineering work.