One Binary, Any Cloud: Sovereign Kubernetes with Cluster API and GitOps

Every managed Kubernetes offering solves the same problem the same way: you hand the control plane to someone else. That is convenient — until data-residency rules, an audit, or an exit clause force the uncomfortable question: could we run this ourselves, in-region, on our own hardware, tomorrow?

This talk shows how we answered "yes" with KubeAid, an open-source application platform for Kubernetes, and its single-binary orchestrator, kubeaid-cli. The CLI starts a throwaway K3D management cluster on your laptop, installs Cluster API, provisions the target on AWS, Azure, Hetzner or plain bare metal, then pivots every Cluster API object onto the new cluster with clusterctl move so it manages itself — and the laptop cluster is discarded. From that moment everything is GitOps: one general.yaml is rendered into a config repository you own, and Argo CD reconciles the complete KubeAid platform — Cilium, cert-manager, kube-prometheus, Rook-Ceph, Velero, Sealed Secrets, and the rest of the stack your applications need — on top of upstream defaults you override only where you genuinely differ.

We will set up a cluster live, from an empty directory to a self-managing Kubernetes cluster with the KubeAid platform reconciled by Argo CD. Then we will cover what most talks skip: day two. We will walk through how the same binary reports backup status across the cluster — Velero for workloads and volumes, CloudNativePG for databases — how recovery works when a cluster has to be rebuilt from nothing but its Git repository and its backups, and how the cluster is compliance-ready from day one rather than hardened afterwards: admission policies enforced by Kyverno, continuous vulnerability scanning with Trivy Operator, runtime security with Tetragon, secrets encrypted in Git with Sealed Secrets, access centralised through SSO, and every platform change landing as a re-viewable commit — defaults that map to ISO 27001:2022 and cover GDPR and NIS2 goals out of the box.

You will leave with a reproducible recipe for an application platform whose entire definition lives in a repository you control — backed up, recoverable, compliant, auditable, portable across providers, and not tied to any single vendor, including the one that wrote it.

• How Cluster API's management-cluster pivot removes the "who manages the manager" problem

• A GitOps layout where one YAML drives provisioning, the application platform and its backup policy, and drift is impossible by design

• How backup health and recovery are built into the platform, and what that means for your exit strategy

• What "compliance-ready from day one" looks like in practice: policies, scanning, runtime security and access control as platform defaults, mapped to ISO 27001, GDPR and NIS2