Cloud Platforms
Popular
Cloud Bill Review
A detailed review of your cloud invoices that ends with a ranked list of savings, each marked with the effort and risk involved.
₹13,999
Cloud Platforms
OB-CLD-104
Container Cluster Security Hardening
We close the default security gaps in your running container cluster: network rules, permissions, resource limits, secrets and image checks.
- Timeline
- 15 working days
- Deliverables
- 7 listed
- Fixed price
- ₹37,999
What this service delivers
A container cluster that works is not automatically a safe one. By default, every workload can talk to every other workload, containers run with root privileges, resources are unlimited and secrets are only lightly encoded. We work through your live managed cluster and tighten each of these without taking services offline. Every change is saved as a configuration file in version control, so the secured setup can be reviewed and recreated whenever needed.
Deliverables 7 items
What you receive
- Network rules that block traffic by default and allow it per namespace
- Permission review so each workload has only the access it needs
- Container security settings enforced, such as running without root and with a read-only file system
- CPU and memory requests and limits set from observed usage
- Secrets moved to a managed secret store with controlled syncing
- Image scanning in the pipeline, with a written rule for critical issues
- Report of remaining risks, including what we intentionally left alone
How the work runs, in 4 steps
-
Step 1: Assess
Current settings, traffic paths and permissions are recorded
-
Step 2: Stage
Each control is applied and tested in the staging cluster first
-
Step 3: Roll out
Changes go to production namespace by namespace in agreed windows
-
Step 4: Report
The final configuration and remaining risks are documented
Who it suits, and what we need from you
Ideal for
- Clusters set up quickly during a migration and never revisited
- Teams filling in a large customer's security questionnaire
- Platforms where one compromised service could reach the database
What we need from you
- Admin rights on the cluster, plus a staging copy that mirrors production
- An owner for each workload to answer traffic questions
- A change window for switching on the network rules
You share these through the brief in your account after checkout.
What changes for your team
-
01
A single compromised container can no longer roam the cluster
-
02
No workload can starve the others of CPU or memory
-
03
Documented proof to hand over when a customer next audits your security
Questions about this service
Changes are tested in staging first and rolled out gradually in agreed windows, so disruption is kept to a minimum.
Yes. The controls are standard features of the container orchestration platform, regardless of which cloud provider hosts it.
This is a remote technology service, so nothing is shipped physically. Work is delivered into systems you control. Read delivery and handover and refunds and cancellation for the full terms.