What is actually inside kloudease
Your platform is production-ready from day one: if your application already runs on Kubernetes, you go live right away – no need to worry about infrastructure, clusters or operations. Here is everything that makes this possible.
Infrastructure
One platform, whatever the cloud
kloudease is provider-independent. Whether STACKIT, AWS or Azure – you get the same platform with the same components and the same operations. You decide where it runs.
STACKIT by default – all from one source
As a STACKIT partner, we source the infrastructure for you. You have one contract partner and one invoice for platform and infrastructure, and your clusters run in the Heilbronn region.
Just the same on AWS and Azure
Already on AWS or Azure? Then we run kloudease in your account (bring your own infrastructure, from Business). For your teams, the platform looks exactly the same as on STACKIT.
Dedicated to you
You get your own STACKIT organisation, your own AWS organisation or your own Azure account. The infrastructure belongs to you and runs for you alone – nothing is shared with other customers.
Domain out of the box
Every cluster comes with a ready-to-use domain such as production.your-company.kloudease.tech – including DNS and certificates. Bring your own domain simply via CNAME.
Kubernetes: hardened, dedicated, production-ready
The interface for your teams is standard Kubernetes. Your clusters are production-ready from handover, so your application can go live straight away. We take care of everything underneath:
- Your own clusters – you get your own workload clusters with their own control plane, plus sandbox clusters from Business
- Lifecycle with Gardener – Gardener creates, updates and heals your clusters, and cluster state (etcd) is backed up continuously
- Hardened out of the box – policies block privileged containers and host access, set secure defaults such as non-root, and check resource limits and pinned image tags
- Garden Linux – a lean operating system built for Kubernetes on every node
- Storage – pre-configured storage classes with a cost-efficient default, S3-compatible object storage on request (beta)
- Upgrades by AOE – Kubernetes ships a new version three times a year, and we roll out updates and patches in fixed maintenance windows
- Capacity per tier – from one workload cluster with five nodes on Starter to custom capacity on Enterprise
- Certified – AOE is a Kubernetes Certified Service Provider (KCSP) and a Silver Member of the CNCF
In the cluster
Pre-installed and maintained by us
You find these components from the CNCF ecosystem in every workload cluster – tuned to work together and kept up to date by us.
GitOps with Flux
Flux comes pre-installed in your cluster. You describe your applications as HelmReleases in Git – optionally with our workload-helm chart.
Ingress, DNS and certificates
Traefik routes traffic to your services, ExternalDNS creates the DNS records, and cert-manager obtains and renews certificates from Let’s Encrypt.
Secrets
Your secrets live in OpenBao, the open-source fork of HashiCorp Vault. External Secrets Operator brings them into your namespaces (from Business).
Policies
Kyverno and native ValidatingAdmissionPolicies enforce secure defaults in every namespace, without you having to maintain them.
Roles and access
You sign in with your identity provider. Admin, developer and viewer apply per namespace, and platform namespaces stay protected.
Metrics
Prometheus Operator with kube-state-metrics and node-exporter. Register your applications simply via ServiceMonitor or PodMonitor.
Logs
The OpenTelemetry Collector gathers all logs from your cluster and ships them to the central Loki instance.
Backup and recovery
Velero backs up your Kubernetes resources and volumes, retained according to your tier.
Platform: what runs around your clusters
Not everything belongs in the workload cluster. We run these services for you centrally or in your own services cluster:
- kloudease API – your organisation, projects and clusters are Kubernetes resources in a dedicated management layer based on kcp. Today AOE manages your environment through it; self-service is in development
- Managed services and managed applications – we run Postgres, Redis, n8n or Open WebUI for you on a dedicated services cluster, separate from the workload clusters for your applications. Updates, backups and monitoring are on us
- Identity and single sign-on – your own Keycloak realm for the platform, clusters and managed services, from Business federated with your identity provider via OIDC or SAML
- Central observability – metrics from all your clusters come together in one Prometheus, logs in Loki, and you find dashboards and queries in Perses
- Verified delivery – every platform component is built as a versioned package (Open Component Model), checked before rollout and delivered to your clusters via Flux
Add-ons
Available on top
Extend the platform with more capabilities, per platform or workload cluster. Items marked “Coming soon” are in the works.
- from 200 €
Web application firewall
A managed web application firewall in front of your workload cluster that stops attacks such as SQL injection or bot traffic before they reach your applications.
- from 496 €
SREaaS
We operate your applications too – with monitoring and incident management around the clock, so your team gets its nights and weekends back.
- Enterprise
Custom SLA
SLA targets, escalation paths and reporting, contractually agreed just for you.
- Coming soon
GitOps with Argo CD
Argo CD as an alternative to Flux, pre-configured and integrated into your clusters.
- Coming soon
Tracing
Distributed tracing for your applications with Grafana Tempo.
- Coming soon
Service mesh
Istio with mTLS and traffic management between your services.
- Coming soon
Geo-redundancy
Your workload clusters protected across sites.
- Coming soon
Confidential computing
Encrypted workloads in a trusted execution environment.
Operations: what the SLA covers
Your platform runs around the clock in every tier. Service level objectives grow with the tier:
- Availability – 99.5% on Starter, 99.75% on Business, 99.9% on Enterprise, each per year
- Complete outage (P1) – response within 1 h and recovery within 4 h (Business), 30 min and 2 h (Enterprise)
- Partial outage of critical functions (P2) – response within 2 h and recovery within 16 h (Business), 1 h and 4 h (Enterprise)
- Recovery and data loss – RTO 4 h and RPO 4 h (Business), 2 h and 2 h (Enterprise), RPO 24 h on Starter
- Retention – logs and metrics 30/30, 90/60 or 180/90 days, backups 30, 90 or 180 days following the grandfather-father-son principle
- Critical vulnerabilities – from CVSS 9.0 we handle them as P2 incidents
And your applications?
How your containerised software runs on kloudease – and who is responsible for what.