GKE, but it defends itself
A GKE platform wired end to end: observability, runtime security with automatic response, FinOps governance and an AI on-call that phones a human.
The brief was reliability, but reliability without security is theatre. This platform runs on GKE with Anthos Service Mesh, Config Sync and Policy Controller — everything reaches the cluster through Cloud Build, Cloud Deploy and Terraform pull requests, nothing by hand.
Telemetry funnels through an OpenTelemetry collector into Prometheus, Jaeger, Elastic and Grafana. Tetragon watches syscalls at runtime and feeds a SIEM, which drives SOAR playbooks that can push a WAF block rule, revoke tokens, rotate Vault secrets, quarantine a namespace, cordon nodes or trigger a CI/CD rollback — before anyone has opened a laptop.
Alongside it: FinOps with billing exported to BigQuery and quarterly reviews, CIS Kubernetes controls mapped to ISO 27001 and SOC 2, and an AI agent that reaches a human on Discord or by phone with text-to-speech when a playbook needs a decision.
where the effort went
the numbers
blameless postmortems, error budgets
built with
delivery record
The platform needed reliability, security response, cost governance, and auditability to reinforce each other instead of living in separate operational silos.
GitOps delivery to GKE through Config Sync and Policy Controller
Anthos service mesh and OpenTelemetry observability pipeline
Tetragon runtime detection connected to SIEM and SOAR playbooks
Automated containment, credential rotation, quarantine, and rollback actions
BigQuery billing export and recurring FinOps review process
Human escalation through Discord and text-to-speech phone calls
The constraints mattered as much as the finished interface.
after shipping
Fast response is useful only when the response path has explicit limits and a human decision point.
Reliability, security, and cost signals become more actionable when they share one operational timeline.