Hybrid On-Prem + Cloud Kubernetes over a WireGuard Mesh
A media company ran latency-sensitive streaming workloads on existing on-premise hardware and wanted cloud burst capacity, without dedicated links between sites. We joined both into one secure Kubernetes platform.
AWS Advanced Tier Partner★ 4.9/5 on Clutch (9 reviews)Replies within 1 business dayThe Challenge
A media company ran latency-sensitive streaming workloads on existing on-premise hardware. It wanted to add cloud burst capacity without throwing away that hardware.
It also did not want to pay for dedicated network links between sites, and the connection between on-premise and cloud had to be secure.
What We Built
Encrypted Mesh Between Sites
We connected every node with a WireGuard mesh, so traffic between on-premise and cloud is encrypted at the network layer. No dedicated links, and nothing exposed on the public internet.
One Kubernetes Platform Across Both
We ran K3s clusters with high-availability masters spanning on-premise and cloud, managed through Rancher, so both sites behave as one platform.
GitOps and Distributed Storage
We used ArgoCD for GitOps delivery, Longhorn for distributed storage, and CloudNativePG for databases, so state and deployments stay consistent across sites.
Low-Latency Streaming Stack
We ran OvenMediaEngine for live streaming behind NGINX ingress, with cert-manager and Let's Encrypt for TLS and Cloudflare for DNS.
Network Fabric
We used Flannel VXLAN for pod networking across the mesh, tuned for the low latency the streaming workloads needed.
The Result
- The platform holds 99.9% uptime.
- Inter-node latency stays under 35ms across on-premise and cloud.
- Total cost came in well below an equivalent all-cloud footprint, because the existing hardware kept doing real work.
Technology
Have a similar project?
Tell us what you are building and we will show you how we would approach it, with a free, no-obligation review.
Book a free consultation