The previous visibility was a one-off platform review
Useful on the day the build-out was signed off, silent about every change made afterwards.
Assurance
Continuous assurance for a Kubernetes platform, so a clean cluster stays clean between deploys.
After a platform build-out on Google Kubernetes Engine, every workload was supposed to reach the cluster through Argo CD, from a Helm chart in a reviewed repository. Nothing stopped someone reaching for kubectl instead, and the only way to know the cluster still matched Git was to go and look.
← Some of our past work · anonymised prior delivery, no client named
Stack
Google Kubernetes EngineArgo CDHelmKyvernoWorkload IdentityBackup for GKE
Rough timeline
| Phase | Typical duration |
|---|---|
| Onboarding — cluster, Git and signals connected | 1 week |
| Baseline established | 1 week |
| Continuous, ongoing | no end date |
The challenge
A GitOps cluster is only as clean as the last change made through Git.
The build-out had every workload deployed through Argo CD from reviewed Helm charts. Nothing technical stopped a direct kubectl edit from a laptop with cluster-admin — it just was not supposed to happen.
Cluster-admin was still handed out for convenience
A direct kubectl edit under time pressure looks identical to a legitimate one until someone checks whether Git agrees with the cluster.
Nobody was watching Argo CD’s own signal
An application sitting OutOfSync is Argo CD reporting that the cluster has drifted from Git — a signal that already existed and was not being read.
What we found
Drift that Argo CD had already flagged, and nobody had gone to look at.
Applications had gone OutOfSync and stayed there
A handful of workloads had been patched directly against the cluster, weeks earlier, and Argo CD had been quietly reporting the drift the whole time.
Admission policy existed in some namespaces and not others
Kyverno policies blocking privileged containers and unbounded resource requests had been applied inconsistently as new namespaces were added.
Workload Identity coverage was partial
Some workloads still ran under the node’s default service account rather than a scoped Kubernetes service account bound to a Google Cloud identity — more access than the workload needed.
What InfraEdge changed
The same GitOps discipline, watched continuously instead of assumed.
| Change | What it did |
|---|---|
| Argo CD sync status tracked | OutOfSync and degraded applications surfaced as a trend, not left to be noticed the next time someone happens to open the Argo CD UI. |
| Admission policy audited across namespaces | Kyverno coverage checked namespace by namespace, so a new namespace missing its baseline policy is a finding, not a silent gap. |
| Workload Identity coverage tracked | Workloads still running under a default service account identified and routed to the owning team, rather than accumulating as a background risk. |
| Backup coverage checked against Backup for GKE | Cluster and persistent volume backup plans checked against which workloads actually hold state, so coverage matches what would need restoring, not just what someone remembered to protect. |
| Findings get an owner | Each new issue — an OutOfSync application, a policy gap, an over-privileged workload — is logged with a named owner and a status, so "we noticed" and "someone is on it" are two separate, visible facts. |
Outcome
Drift is visible the week it happens, not the month someone goes looking.
This is the shape of EdgeAssure applied to a Kubernetes platform: not a bigger remediation, but the discipline that keeps the cluster matching what Git says it should be.
The customer moved from a one-off platform review to a running picture of the same domains that mattered on day one — sync status, admission policy, identity scope and backup coverage — with new issues surfaced to a named owner the week they appear, not the next time someone happens to check the Argo CD dashboard.
Book a 20-minute triage call
Twenty minutes, no charge. We work out what would actually help — which is sometimes us and sometimes not. Nothing is priced on the call; if there is work worth doing, a written scope and a price reach you within 24 hours.