Services

Engineering services. Made in EU.

Service catalogue

Delivered by a team of senior engineers with upstream contributions to FluxCD, ArgoCD, Kyverno, KEDA, and Terraform providers. Engagements run 4–16 weeks fixed-scope, with optional extension once the platform is live.

Kubernetes Platform Engineering

Multi-cluster, multi-tenant Kubernetes platforms across upstream Kubernetes, the managed services (EKS, GKE, AKS), and OpenShift. We deliver cluster topology, networking, observability, and security baselines aligned to your workload profile.

Target outcomes

  • Multi-cluster topology with defined fault domains
  • Multi-tenant isolation via namespaces, network policies, RBAC, and resource quotas
  • Observability stack (metrics, logs, traces) with SLO-based alerting
  • Security baselines: Pod Security Standards, admission policies, image scanning, signed artifacts

Typical engagement: 8–16 weeks · fixed-scope or T&M

Cloud Migration

Cloud migrations across AWS, GCP, Azure, and Oracle OCI, including OpenShift-on-cloud and OpenShift-on-bare-metal targets. Phased delivery with strangler-fig or lift-and-shift patterns selected per workload.

Target outcomes

  • Migration assessment and phased plan with rollback gates per phase
  • Cross-cloud delivery across AWS, GCP, Azure, and Oracle OCI
  • Containerization (or selective de-containerization) aligned to workload requirements
  • ECS, VM-based, or OpenShift workloads migrated to upstream Kubernetes without downtime

Typical engagement: 12–24 weeks · phased delivery

Terraform & Infrastructure as Code

Terraform module library, multi-account or multi-project structure, state management, and policy gates in CI. Includes upstream contributions to the providers we depend on.

Target outcomes

  • Module library for AWS, GCP, Azure, and Oracle OCI with versioning
  • Multi-account structure (AWS Organizations, GCP folder hierarchy) with standard configurations
  • Remote backends, state locking, and drift detection
  • CI gates with tflint, tfsec, Checkov, and OPA before plan and apply

Typical engagement: 4–10 weeks · fixed-scope project

GitOps Adoption

FluxCD or ArgoCD as the sole reconciler for your clusters. Deployments via Git commit, rollbacks via revert, automated image promotion, and progressive delivery integrated with SLOs.

Target outcomes

  • FluxCD or ArgoCD deployed with multi-cluster fan-out
  • App-of-apps pattern for tenant and environment onboarding via pull request
  • Automated application delivery on merge to main
  • Image automation via Flux Image Reflector or Argo Image Updater
  • Progressive delivery (canary, blue/green) via Flagger or Argo Rollouts with SLO-based rollback
  • Automated cluster bootstrap
  • Drift detection and reconciliation enforced from Git

Typical engagement: 6–12 weeks · fixed-scope project

GitHub Organization Governance

Organizations accumulate hundreds of repositories created manually, with inconsistent settings, ad-hoc branch protections, and incomplete ownership records. We bring the fleet under consistent governance — new repositories arrive correctly configured, existing repositories are aligned to organizational standards, and every change is auditable.

Target outcomes

  • New repositories provisioned with policies, ownership, and access aligned to organizational standards
  • Consistent branch protection, review, and status check enforcement across the fleet
  • Centralized management of repository ownership, secrets, and team access
  • Existing repositories aligned to the governance baseline

Typical engagement: 6–12 weeks · fixed-scope project

Observability & SLO Engineering

Metrics, logs, and traces deployed and integrated for production debugging. SLOs and SLIs defined with product and engineering, enforced through alert routing and error budgets.

Target outcomes

  • Prometheus, Grafana, Loki, and Tempo stack deployed and integrated
  • SLOs and SLIs defined per critical user journey, with alerts derived from them
  • On-call rotation, paging policies, and runbook templates aligned to SLOs
  • Cardinality and retention controls for predictable telemetry cost

Typical engagement: 6–10 weeks · fixed-scope or T&M

Cloud Cost Optimization (FinOps)

FinOps audit across AWS, GCP, Azure, and Oracle OCI. We identify waste, right-size workloads, and establish ongoing cost governance practices.

Target outcomes

  • Cost breakdown by team, service, and environment
  • Rightsizing analysis across compute, storage, and managed services
  • Reserved capacity, Savings Plan, and Committed Use strategy aligned to forecast
  • FinOps practices (tagging, budgets, anomaly detection) embedded in the organization

Typical engagement: 4–8 weeks audit + optional extension

Compliance & Security Baselines

SOC 2 and ISO 27001 preparation focused on infrastructure controls. Policy-as-code with Kyverno or OPA, secrets management, and automated audit-evidence collection.

Target outcomes

  • Kyverno or OPA policies authored against your compliance scope
  • Secrets management (External Secrets, Vault, KMS) standardized across clusters and accounts
  • Audit-ready logging and access controls across clusters, cloud accounts, and CI systems
  • Evidence collection integrated with CI for recurring audit cycles

Typical engagement: 8–12 weeks pre-audit + optional extension through certification

Platform Engineering for Regulated Industries

Platform engineering for fintech, healthcare, energy, and public-sector organizations. Compliance controls integrated into platform design, with documented audit trails and operational evidence.

Target outcomes

  • Compliance controls (PCI DSS, HIPAA, NIS2, GDPR, DORA) integrated into platform design
  • Data residency and isolation patterns for regulated workloads
  • Change management and approval workflows aligned with audit requirements
  • Disaster recovery and business continuity exercised end-to-end

Typical engagement: 12+ weeks · phased delivery or extended engagement

Looking for something not listed, or unsure which engagement model fits? We scope a fit on a 30-minute call.

Contact Sophotech