Custom Kubernetes Environments
One tenant per cluster. Your data isolated by architecture, not by a vendor's privacy policy.
A Kubernetes cluster is the substrate everything else runs on. For most mid-market companies, it doesn't make sense to build the operations capability internally — you'd need to hire a platform team, an SRE team, a security team, and keep paying them to maintain certifications you'll never use day-to-day. But the alternative — running your business on shared multi-tenant SaaS — is exactly the data-ownership problem we're trying to solve.
PKG runs the cluster for you. You own the substrate, and you own everything on it.
What you get
- Dedicated cluster on AWS (or your preferred cloud), in our account or yours, your choice
- Single-tenant by design — no other customers' workloads on your cluster, no shared databases, no shared cache, no shared anything
- Network isolation — private VPC, locked-down ingress, IP allowlisting where it makes sense, end-to-end TLS
- Identity & SSO — Authentik or your existing IdP, OIDC throughout, role-based access on every internal admin tool
- Observability — logs, metrics, alerts wired to whatever notification path you actually read (Slack, email, PagerDuty)
- Backups & disaster recovery — automated, tested, with documented restore procedures
- Upgrades & patching — Kubernetes itself, the OS layer, the application dependencies, on a defined cadence
- Incident response — humans who answer when something breaks, not a forum
What you don't get
- No multi-tenant SaaS hidden behind a "private" label — the cluster is yours; the data path doesn't loop through someone else's analytics product
- No vendor lock-in to a managed Kubernetes-flavor-of-the-month — standard upstream Kubernetes, standard Postgres, standard everything. If you want to take it elsewhere later, you can
- No "platform fee" plus per-user SaaS fees — the run-rate covers the cluster
What this looks like
We've been deploying and operating Kubernetes infrastructure on AWS for years, in production, with real customers. Single namespace per customer, dedicated databases (CloudNativePG operator), dedicated ingress, customer-owned domains, customer-owned data — all behind SSO, all backed up, all monitored.
This capability rarely ships alone. It's almost always paired with custom applications and an AI data platform on top. But if all you need is a private cluster operated by people who know what they're doing, that's a real engagement we'll take.