DevOps Jobs

Self-healing drift correction
The GitOps controller continuously reconciles live cluster state against the declared state in Git. Any manual modification (whether from a misconfiguration or an unauthorized user who gains limited API access) is automatically reverted within seconds. A human operator never runs kubectl apply against a production cluster.

Wall 2: Compute isolation with Karpenter
Namespace isolation operates at the Kubernetes API layer. Wall 2 drops to the compute layer: the actual machines where tenant code executes. In Harmony, tenants do not share compute nodes.

The dual-taint strategy
ReadyOn’s Karpenter provisioners create nodes with two taints: a tenant-identifier taint (for example, tenant=acme-corp) and a workload-type taint (for example, workload=frontend). A pod must tolerate both taints to be scheduled. Tenant A’s frontend nodes are distinct from Tenant A’s batch nodes, and both are entirely separate from Tenant B’s infrastructure.

Admission controller validation
Even if a pod is created with forged tolerations, an admission controller validates that the toleration claims match the namespace’s tenant identity. The scheduler cannot be directed into cross-tenant placement.

Scoped node credentials
All application nodes enforce IMDSv2 with a reduced hop limit, preventing pods from reaching the instance metadata endpoint. The IAM role attached to each node is scoped to a single tenant’s resources, limiting the scope of a container escape. Platform nodes run on managed node groups with a separate taint that no tenant workload can tolerate.

Wall 3: Network isolation at the VPC layer
Walls 1 and 2 operate within the Kubernetes abstraction. Wall 3 drops below Kubernetes entirely, enforcing isolation at the Amazon VPC and security group level: infrastructure that the Kubernetes control plane does not manage and that a pod with limited access cannot manipulate.

Per-tenant security groups
Each tenant’s Amazon Aurora cluster is protected by a security group that allows inbound connections only from the security group attached to that tenant’s application nodes. Tenant A’s nodes cannot open a TCP connection to Tenant B’s database. This is an Amazon VPC security group rule enforced by the AWS software-defined network. Crossing it would require overcoming that networking layer itself.

Multi-tier VPC architecture
The VPC is divided into four tiers: a public perimeter tier (load balancers only), an application tier (EKS worker nodes in private subnets), a database tier (Aurora clusters with no internet access), and a control plane tier (private EKS API endpoint, VPN-only access with OIDC and MFA).

Default-deny network policies
Kubernetes network policies enforce default-deny for inter-namespace traffic. Tenant pods communicate only with pods in their own namespace and explicitly allowed platform services. All other traffic is denied and logged. Amazon VPC Flow Logs capture all network traffic for anomaly detection.