The Boundary in Detail

This page lists the responsibility boundary layer by layer, naming the specific technologies involved. For the short version, see What You Can Do vs. What We Manage.

Kubernetes

CTO2B manages:

• Provisioning and upgrading EKS clusters
• Node group health and scaling
• Platform-level Kubernetes components

You manage:

• Your application manifests and Helm charts
• Setting appropriate CPU and memory requests/limits for your pods
• Your container images

Boundary example: If your pods are being evicted due to memory pressure — check whether your resource limits are set correctly before raising a ticket.

Deployments & GitOps (ArgoCD)

CTO2B manages:

• Running and maintaining ArgoCD
• The app-of-apps structure that manages your applications
• Investigating sync failures caused by platform issues

You manage:

• Your Helm values and Kubernetes manifests in your Git repo
• Keeping your container image tags up to date
• Fixing sync failures caused by your own configuration changes

Boundary example: If ArgoCD shows your app as OutOfSync because of a bad image tag or broken manifest — that's yours to fix. Your CSE can advise, but won't edit your Git repo.

Databases (AWS RDS)

CTO2B manages:

• Provisioning the RDS instance
• Engine version and security patching
• Automated backups and retention
• Instance sizing (with your input on growth expectations)
• Network security and connectivity to your cluster

You manage:

• Your database schema and its evolution (migrations)
• Query performance and index strategy
• Application connection strings and credentials rotation
• Stored procedures, triggers, and custom database functions

Boundary example: Slow queries, N+1 problems, and index tuning are application-layer concerns. If database response times increase due to infrastructure (e.g., IOPS limits, storage pressure), CTO2B will investigate.

Ingress & networking

CTO2B manages:

• Running Traefik as the ingress controller
• Provisioning and renewing TLS certificates automatically via cert-manager
• Load balancer (AWS NLB) configuration

You manage:

• Your domain DNS records — pointing your domains at the load balancer is your responsibility
• The routing rules in your Ingress manifests
• Choosing hostnames and path routing for your services

Boundary example: If your application URL is not resolving, first check that your DNS record is pointing to the correct load balancer address. If DNS is correct and the platform ingress is healthy, raise a Sev-2 ticket.

Observability components

CTO2B manages:

• Deploying and maintaining Prometheus, Grafana, and Loki
• Platform-level alert rules and routing to your Slack channel
• Grafana access provisioning

You manage:

• Reading and interpreting your application's own metrics and logs
• Custom dashboards for your application (not included in standard support)
• Tuning your own alert thresholds (requires a ticket to action)

Boundary example: CTO2B will tell you if your cluster is unhealthy. Reading your application logs to diagnose a bug is your team's job.

Related articles

• What You Can Do vs. What We Manage — the summary
• SLA Policy — severity levels and response targets
• Getting Help — how to raise a request