Base Cost: $1,398 / cluster (before any support modifiers or discounts)

The Panfactum Kubernetes cluster is the most production-ready, security-hardened, and cost-effective way to run workloads in the cloud. For every component we will proactively deploy the latest updates and security patches as well as provide frontline support (up to and including patching the upstream projects if necessary).

Each cluster includes the following:

• A dedicated AWS account in your AWS organization that includes conformance to our hardening standards.
• A dedicated VPC with the appropriate network segmentation and our improved NAT gateway system.
• A dedicated DNS subdomain for cluster workloads (including our subdomain delegation system, if required). Automatic DNS synchronization with ExternalDNS.
• A hardened EKS deployment that is kept updated so you do not need to pay the additional $360 / month extended support surcharge. Includes a custom bin-packing pod scheduler that can decrease costs by up to 30% compared to the built-in EKS scheduler.
• Built-in cluster autoscaling provided by Karpenter with custom configuration to optimize total cost savings.
• Built-in pod autoscaling provided by Vertical Pod Autoscaler so that you never need to manually configure resource sizes for your workloads.
• Out-of-the-box integration with AWS EBS for durable storage including automatic storage autoscaling.
• The Cilium network firewall and observability tooling.
• The Linkerd service-mesh for automatic network encryption and additional L7 capabilities (e.g., network-level retries, locality-aware routing, etc.).
• An optimized deployment of the components in the Grafana Stack for automatic collection of logs, metrics, and traces. This includes dozens of out-of-the-box dashboards and alerts for the various infrastructure components as well as a deployment of OpenCost so that you have granular cost data about every workload you deploy to your cluster.
• A customized NGINX Ingress Controller that can handle traffic at any scale with built-in support for HTTP complexities like CORS, CSP, and rate-limiting. Additionally, includes automatic integration with AWS Cloudfront for best-in-class performance and additional security hardening.
• Automatic public/private TLS certificate provisioning with cert-manager. Includes automatic rotation in accordance with industry best-practices.
• A highly-available deployment of Hashicorp Vault for secrets management.
• A highly-available deployment of Argo Workflows and BuildKit to 10x the speed of your CI/CD systems.
• A highly-available deployment of the Authentik IdP to replace expensive alternatives like Okta.
• Automatic, hourly full-cluster backups managed by Velero. Includes all stateful EBS volumes utilized by workloads in your cluster so you are never at risk of losing data.
• The Descheduler to automatically detect and resolve pod-level infrastructure problems.
• The Kyverno policy engine so that you can provide additional organizational controls and customize the default Kubernetes behavior.
• Automatic image caching to provide faster startup times and add resiliency to third-party registry outages.
• Integration with the Panfactum devShell which allows any developer to get started working with clusters in minutes from any maintain operating system (Windows, macOS, Linux). Access is automatically controlled via the same SSO paradigm as your AWS account (which we will configure if not already provided).
• A custom, SSO-integrated SSH bastion which allows you to securely connect to all of your private network resources without the need for a heavy-handed, complex VPN.