A UK SaaS scale-up tried it in-house for six months: two engineers part-time, no observability, no audit log, a runbook on a Confluence page. The acquirer’s CTO walked the codebase pre-LOI and said one thing: “rip and replace, or take a 25% diligence haircut.”
Service Kubernetes platform engineering · EKS + GKE + AKS · UK senior-only studio
Kubernetes platform engineering for the team whose cluster. is 80% of its AWS bill.
GitOps via Argo or Flux, multi-tenant isolation, autoscaling with Karpenter, per-workload cost attribution, and observability. We build the internal developer platform your team self-serves on, then hand you the receipts your acquirer asks for.
24hreply, from a senior
200+projects shipped since 2019
Senioronly, on the spine
Why CTOs sign
You need kubernetes platform engineering. We ship it with senior engineers and the receipts your acquirer asks for.
The platform is the product floor. We build the internal developer platform your team self-serves on, then prove it on the diligence call. Thirteen K8s platforms shipped since 2020.
“The platform is the product floor. We build it, then prove it on the diligence call.”
001
0
K8s platforms shipped since 2020 on EKS, GKE, and AKS.
002
0
Production incidents on shipped platform engagements.
003
5 day
Fixed-scope audit. 30-page brief, six ADRs, fixed-price quote.
The CTO this page is for“rip + replace or 25% haircut” · retention signed
Helena ran the platform in-house. The product was fine. The diligence call was not.
The platform wasn’t a side quest. It was the product floor, and it had been treated as something one engineer would tidy up later. No GitOps, no cost attribution, no disaster-recovery rehearsal, bus factor of one.
We rebuilt over 12 weeks. Senior engineers paired daily, ADRs documented same day, the evidence pipeline wired on day one. The acquirer’s CTO came back, walked the same surface, and signed full-team retention. This page is for the CTO who decided the platform is the product floor and wants it built, not bought as a tool.
The pain. The day-1 platform architecture.
Each one is the difference between a platform your team trusts and one they route around.
- 01
“A workflow died silently. The customer found out before we did.”
Per-workload observability and alerting. Prometheus + OpenTelemetry traces. PagerDuty and Slack alerts on the signals that matter. The customer never finds out first.
- 02
“Who did what, when? No record. The SOC 2 auditor flagged it.”
Audit log per mutation, GitOps history end to end. Every cluster change recorded in Git and in the audit log. Tenant-admin viewable. The auditor is satisfied.
- 03
“The cloud bill spiked. Nobody could say why. The cluster is 80% of it.”
Per-workload cost tags and budget alerts. OpenCost attributes every pound. Karpenter and right-sizing trim the waste. The bill stabilises within 30 days.
- 04
“The backup runs. The restore was never tested. A disaster would be career-ending.”
Restore rehearsed quarterly. Velero backups. RTO and RPO documented and drilled on the calendar. Restore in under four hours, proven.
- 05
“One engineer knows the cluster. Our bus factor is one.”
Two-senior pairing and ADRs same day. Two senior engineers paired daily, decisions written down the day they’re made. Your bus factor goes to four, then to your team.
- 06
“An enterprise prospect asked for SOC 2, a DPA, a sub-processor list. We had none.”
Procurement pack from day one. SIG-Lite, CAIQ, DPA, SCCs, and a SOC 2 stance shipped day one. Procurement clears in days, not quarters.
- 07
“One customer’s job pegged the cluster and everyone else slowed down.”
Quotas, limits, and network policy per tenant. Resource quotas and limit ranges per namespace. Network policy isolates tenants. One noisy job can’t starve the rest.
- 08
“Someone kubectl-patched prod at midnight. Now the cluster doesn’t match anything in Git.”
GitOps with drift detection. If it isn’t in Git, it doesn’t survive. Argo or Flux reverts manual changes. The repo is the source of truth, enforced.
WHAT WE WIRE ON EVERY PLATFORM
Six capabilities your team self-serves on
The internal developer platform, built once, run by your engineers. No ticket queue. No bus factor of one.
GitOps delivery (Argo / Flux)
Declarative deploys from Git. Progressive rollout, automatic rollback, drift detection. The cluster matches the repo, always.
Autoscaling + Karpenter
Node and pod autoscaling tuned to your traffic. Spot instances where it’s safe. Scale-to-near-zero on quiet workloads.
Cost attribution (OpenCost)
Per-namespace, per-workload, per-tenant cost. Budget alerts. The answer to “why did the bill spike” in minutes.
Service mesh (Istio / Linkerd)
mTLS between services, traffic shaping, canary releases, retries and timeouts at the mesh layer. Wired only when you need it.
Observability stack
Prometheus + Grafana + OpenTelemetry. Dashboards your on-call actually opens. Alerts to PagerDuty and Slack, not a void.
Secrets + policy as code
External Secrets, Vault, OPA Gatekeeper. Nothing ships that violates policy. Secrets never live in a YAML file in Git.
The stack we ship every platform on.
Git as the source of truth. Terraform underneath. The hiring pool that means your next platform engineer is productive on day one.
T1
What we build every platform on
GitOps-firstKubernetes (EKS)TerraformHelmArgo CDFluxKarpenterPrometheusGrafanaOpenTelemetryGitHub ActionsOpenCostVelero
T2
When your platform brief calls for it
reach when neededIstioLinkerdVaultExternal SecretsOPA GatekeeperCiliumCrossplane
T3
The infrastructure underneath
AWS-defaultAWSAWS RDS / AuroraS3 + CloudFrontAWS KMSCloudWatch + GuardDutyAWS BackupRedisApache KafkaPostgreSQLDockerDatadogSentry
From “rip and replace” to retention signed
What changes when the platform is built as the product floor, not patched as a side quest.
12 wk
In-house cluster to acquirer-defendable
GitOps via Argo, multi-tenant isolation, Karpenter autoscaling, per-workload cost attribution, observability end to end, evidence pipeline live day one.
Results
Helena’s platform,
Helena’s platform,
after the rebuild, in numbers
We rebuilt an in-house cluster as an acquirer-defendable platform: GitOps via Argo, multi-tenant isolation, Karpenter autoscaling, per-workload cost attribution, observability end to end, evidence pipeline live day one.
Diligence
12 wk
In-house to defendable
Full
Team retention signed
Run cost
−31%
Cluster spend, 30 days
< 4h
Tested restore time
Track record
13
Platforms since 2020
0
Production incidents
Audit first. Then the sprint.
You bound the risk at week one. A £8K audit before a single line of platform code ships.
5-day audit
Two senior engineers read your estate and brief, then write it all down.
- 30-page written brief
- Six architecture decision records
- Risk matrix, ranked by severity
- Fixed-price quote for the sprint
Platform sprint
Eight to fourteen weeks of fixed-scope shipping, audit-led and evidence-first.
- GitOps, autoscaling, cost attribution
- Observability and DR rehearsed
- Multi-tenant isolation wired
- ADRs and audit log throughout
Retainer
One day a week of a senior engineer for three to six months.
- Performance and cost tuning
- New surface, new workloads
- Your team gets unblocked
- 30-day walk-away both ways
What CTOs actually ask before signing
Pain-first, soft-second.
The audit is £8K, fixed. The sprint is typically £45K to £110K, fixed-price, scoped at the end of the audit. No day-rate, no scope creep. You see the number before you commit, and you decide whether to continue after week one.
No. We work in place where possible. If a migration makes sense, we scope it at the audit and run the old and new in parallel until you sign off. We’ve never forced a rip-and-replace that wasn’t the cheaper option for the client.
An ADR pack, an audit log, a GitOps history, an evidence pipeline, and a SOC 2 stance. The acquirer’s CTO walks the surface and signs full-team retention. That happened three times across 2024 and 2025. We don’t ask you to take our word for it; the receipts do the talking.
Yes. We default to EKS on AWS because that’s where most UK SaaS already runs and the hiring pool is deepest. We’ve shipped GKE for ML-heavy products on Google Cloud and AKS for enterprise clients with Microsoft contracts or NHS Azure tenancies. The lock-in path is documented either way.
Usually, yes. We wire per-workload cost attribution with OpenCost so you can see where the money goes, then right-size requests, add Karpenter for node autoscaling, and move safe workloads to spot. A 30% cut on cluster spend inside the first 30 days is a typical outcome, not a promise.
Every engagement has two senior engineers paired, not one. Every decision goes into an ADR the same day, and the whole platform lives in Git. Two handovers in seven years, both inside 48 hours. Your bus factor is never one with us, and it isn’t one when we leave.
No, the opposite. We ship on standard Kubernetes, Terraform, Helm, and Argo, the most hireable platform stack in the UK in 2026. GitOps means your next engineer reads Git and is productive on day one. We also train your eventual hires during the engagement.
It’s built to. The evidence pipeline goes live in week one, SOC 2 Type 1 is achievable in 8 to 12 weeks if you don’t have it, and the DPA, SCCs, and DSAR runbook ship by default. We’ve been through these diligence calls, and the platform is built so they’re short.
In context
See it in context.
A look at the kind of kubernetes platform engineering surface we hand over — real screens, real data, documented and yours from day one.
One paragraph. That’s it.
Tell us your current estate, your deadline, and the outcome you need. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it, plus the next audit slot.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox.
- Day 5
Audit on your desk.
30-page brief, six ADRs, a risk matrix, a fixed-price quote.
- Wk 8–14
Platform shipped.
GitOps, autoscaling, cost attribution, observability, DR rehearsed.