Design Partner programme: the first 100 teams get SreNix free. 100 places left.

See the offer and apply
Examples / Multi-cluster drift
Fix example · Enterprise catalog · escalates for approval

A hot-fix that never made it back into the other regions

During an earlier incident, an engineer patched a secret reference by hand in one cluster to get a service back up. It worked — and was then forgotten. Two other clusters running the same service quietly kept the old reference.

What happened

SreNix runs the same check in every cluster you point it at, so drift like this doesn't hide for long.

  1. Detect: a check available on paid plans compares equivalent secret references across peer clusters that are meant to be deployed identically.
  2. Cause: prod-us-east had been hand-patched during an incident three weeks earlier. prod-eu-west and prod-ap-south were never updated to match.
  3. Decision: deciding which cluster holds the correct value — and pushing that change out to the others — is a judgment call, not a mechanical one.
  4. Escalate: SreNix sent the platform team a side-by-side comparison of all three clusters, with the outlier named.
  5. Verify: once the platform team reconciled the two lagging clusters through GitOps, SreNix confirmed all three matched.
finding · checkout-secrets (3 clusters)AWAITING APPROVAL → VERIFIED
16:44:09DETECTExternalSecret/checkout-secrets differs: prod-us-east vs. 2 peers
16:44:09CAUSEprod-us-east reference hand-patched during incident INC-4821, never reconciled
16:44:15POLICYcross-cluster reconciliation is outside the closed catalog · not auto-applied
16:44:20ESCALATEsigned comparison sent to platform-team · all 3 clusters named
17:30:52APPROVEplatform-team reconciled prod-eu-west and prod-ap-south via GitOps
17:32:10VERIFYall 3 clusters now reference the same Vault path
recorded to the signed audit log either way

Why this one waits for a person

Each cluster keeps its own memory — SreNix never mixes data between estates. What it can do is run the identical check everywhere and put the difference in front of the people who can say which side is right.

If you run SreNix across many clusters for different clients, this is the same mechanic behind the partner flywheel: patterns compound across the product, but nothing about any one client's cluster ever moves to another. See how that works for MSPs.

On-call should be quieter every week

Helm install in 5 minutes. No telemetry exfiltration. No per-investigation surprises.