A private cloud carved out of the server room
Confidential · Platform Engineering
The business said
- “Renew the VM sprawl for another year”
- “Move everything to public cloud in one jump”
- “Buy more hypervisor capacity”
- “Keep one virtual machine per application”
- “Consolidate onto Kubernetes and run the server room like a product”
The server room was not out of capacity. It was out of shape: one VM per app, no shared observability, and nothing self-service.
An on-prem Kubernetes platform with full observability, on existing hardware
An IT services firm ran dozens of internal and hosted applications the way most companies quietly do: one virtual machine per application on a hyperconverged cluster, each with its own operating system to patch, its own quirks, and no shared way to see what any of them were doing. Capacity was wasted by design, and every new application meant another snowflake server. This was our own infrastructure, which made it the right place to prove the fix.
We consolidated onto Kubernetes running on the existing hardware. Clusters were built on the hyperconverged platform with native storage drivers, role-based access control for every team, ingress consolidated onto standard web ports, and VPN-gated access for anything private. Developer workflows moved to declarative deployments, so shipping an internal app became a manifest, not a server request.
Observability came as part of the platform, not per app: Prometheus and Grafana for metrics and dashboards, and an Elasticsearch, Fluentd, and Kibana stack for centralized logs. For the first time every workload, from HR systems to client-facing tools, reported into the same panes of glass.
The first production-grade workloads, including a live commerce staging environment, validated the platform, and the migration queue kept growing from there. The strongest proof point was the premise itself: before offering Kubernetes as a service to anyone else, we ran our own company on it.
- 2021, running since
- Prometheus + Grafana, metrics
- EFK stack, logs
- RBAC + VPN, access
- our own workloads, proof
