Description
What this service covers
A cluster that works is not automatically a secure one. By default, every workload can talk to every other, containers get root privileges, resource limits are absent and secrets are stored in the cluster with only light encoding. Our team goes through your live managed cluster and closes these gaps without taking workloads down. Every change is committed to a manifest file, meaning the secured configuration can be reviewed and rebuilt at any time.
What you receive
- Default-deny network policies with explicit allow rules for each namespace
- Access control review so every workload identity has only the permissions it needs
- Workload security standards enforced, such as running without root and using locked file systems
- Requests and limits for compute and memory, based on real usage
- Secrets held in a managed vault, synced into the cluster under control
- Image scanning in the pipeline, backed by a written policy for critical issues
- Residual risk report, including what we deliberately left alone
The work in 4 stages
-
01
Stage 1: Baseline scan
An automated benchmark scan runs, and we also check by hand against recognised industry security benchmarks.
-
02
Stage 2: Ranking
Findings are ordered by how easily they could be exploited and how far damage would spread.
-
03
Stage 3: Fixes
Changes go in one namespace at a time, staging first and production after.
-
04
Stage 4: Confirmation
We rescan, check workloads are healthy and hand over all manifests.
Who it suits, and what we need from you
Ideal for
- Clusters set up in a rush during a migration and never revisited
- Teams completing a security questionnaire for a major customer
- Platforms where one breached workload could get to the database
What we need from you
- Admin rights on the cluster, plus a staging cluster that closely matches production
- An owner for each workload who can answer our traffic questions
- A change window for switching on network policies
You share these through the brief on your order page after checkout.
What changes for your team
- A breached container can no longer roam the cluster
- Resource-hungry workloads can no longer starve others of compute and memory
- Written proof ready for your next customer security review
Questions about this service
Will the new network rules break anything?
Do you need access to our production cluster?
Must our cluster be a managed service?
This is a remote service: nothing is shipped physically, and the work is delivered into systems you control. See delivery and handover and refunds and cancellation for the full terms.
Reviews
There are no reviews yet.