# CloudOn - Comprehensive Product Documentation ## Company Overview CloudOn is a cloud infrastructure company that builds open-source tools for DevOps, FinOps, Kubernetes, and cloud security. All products are free and open source under the MIT license on GitHub (github.com/cloudon-one). The company has over a decade of experience in DevOps, Platform Engineering, and Solutions Architecture, serving fintech startups and cybersecurity companies. All tools support Amazon Web Services (AWS) and/or Google Cloud Platform (GCP). Website: https://cloudon-one.com GitHub: https://github.com/cloudon-one Blog: https://blog.cloudon-one.com Contact: https://cloudon-one.com/contact --- ## Product 1: FinOps Guardian ### What It Does FinOps Guardian is an automated cost governance toolkit for multi-cloud environments (AWS and GCP). It scans cloud accounts for idle or underutilized resources, generates cost-saving recommendations, and can automatically clean up unused infrastructure. ### Key Features - **AWS Resource Cleanup**: Lambda-based tool scanning EC2, EBS, Elastic IPs, load balancers, RDS, EKS, Kinesis, MSK, and OpenSearch across 7+ regions. Includes dry-run mode and scheduled nightly execution. - **GCP FinOps Recommender**: Cloud Functions solution using GCP's Recommender API. Detects 10 recommender types covering idle VMs, persistent disks, custom images, static IPs, and Cloud SQL. Supports organization-level and project-level scanning. - **Real-Time Notifications**: Slack integration with cost impact metrics, email reports via AWS SES, configurable thresholds. ### Technical Details - Language: Python 3.12 (92% test coverage on GCP module) - Infrastructure: Terraform for deployment - Architecture: Serverless (AWS Lambda, GCP Cloud Functions) - Scheduling: CloudWatch Events (AWS), Cloud Scheduler (GCP) ### Use Cases - Teams overspending on unused cloud resources - FinOps practitioners needing cross-cloud cost visibility - Organizations implementing automated cost governance - Engineering teams needing safe, automated resource cleanup ### Source Code GitHub: https://github.com/cloudon-one/FinOps-Guardian ### Frequently Asked Questions Q: What cloud providers does FinOps Guardian support? A: AWS and Google Cloud Platform (GCP). Q: Is FinOps Guardian free? A: Yes, fully open source under the MIT license. Q: Can I try it without deleting anything? A: Yes, the AWS module includes a dry-run mode that reports what would be removed without taking action. --- ## Product 2: SecureOps (Git Security Scanner) ### What It Does SecureOps is a GitHub Action that performs automated security scanning on repositories. It detects secrets (exposed API keys, tokens, passwords), vulnerabilities (CVEs in dependencies), and infrastructure misconfigurations within CI/CD pipelines. ### Key Features - **Secret Detection**: Powered by Gitleaks v8.28.0 with custom TOML rule definitions and token masking. - **Vulnerability Scanning**: Trivy v0.65.0 for CVE and misconfiguration detection, OSV-Scanner v2.2.1 for open source vulnerability identification. - **Rich Reporting**: JSON, HTML, and SARIF output formats. Automated PR comments with severity breakdown. GitHub Security tab integration. - **Organization Scanning**: Scan entire GitHub organizations with consolidated dashboards and Slack summaries. - **Supply Chain Security**: SHA256 checksum verification for all bundled tools. Non-root container execution. ### Technical Details - Platform: GitHub Actions - Languages: Python (85.5%), Shell (9.5%), Docker (4.7%) - Container: Alpine Linux 3.19, multi-stage build - Tools: Gitleaks v8.28.0, Trivy v0.65.0, OSV-Scanner v2.2.1, Helm v3.18.6 ### Use Cases - Teams wanting automated security scanning in CI/CD - Organizations needing org-wide security audits - Developers wanting PR-level security feedback - Compliance teams requiring SARIF reports ### Source Code GitHub: https://github.com/cloudon-one/git-security-scanner-public ### Frequently Asked Questions Q: How do I add SecureOps to my repository? A: Add a single step to your GitHub Actions workflow: `uses: cloudon-one/git-security-scanner@v2`. Q: What types of issues does it detect? A: Secrets (API keys, tokens, passwords), vulnerabilities (CVEs in dependencies), and infrastructure misconfigurations. Q: Does it work with private repositories? A: Yes, it works with both public and private repositories at no cost. --- ## Product 3: KubeLaunch Essentials ### What It Does KubeLaunch Essentials is a production-ready, security-hardened Kubernetes platform. It deploys an EKS cluster with integrated GitOps, runtime security, observability, and service mesh via Terraform/Terragrunt. ### Key Features - **GitOps & CI/CD**: ArgoCD for deployments, Atlantis for Terraform PR automation, GitHub OIDC (zero long-lived credentials). - **Runtime Security**: Kyverno admission control, Falco eBPF monitoring, Velero backups, weekly CIS Benchmark scans. - **Service Mesh & Observability**: Istio with mutual TLS, Kong API gateway, Loki log aggregation, Jaeger tracing, Kubecost expense tracking. - **Three-Phase Security**: Foundation (OIDC, encrypted state) → Runtime (admission control, threat detection) → Operational (CIS compliance, auditing). ### Technical Details - IaC: Terraform + Terragrunt - Cloud: AWS EKS - Components: ArgoCD, Kyverno, Falco, Istio, Kong, Vault, Kubecost, Loki, Jaeger, Velero, Karpenter, Cert-Manager - Cost: ~$195/month for dev environment with Spot instances ### Use Cases - Teams needing production Kubernetes without months of platform engineering - Organizations requiring security-hardened K8s from day one - Teams wanting built-in observability and service mesh - Engineering organizations standardizing on Kubernetes ### Source Code GitHub: https://github.com/cloudon-one/kubelaunch-essentials ### Frequently Asked Questions Q: How much does the infrastructure cost? A: Development environment runs at approximately $195/month with Spot instances. Q: Do I need Kubernetes experience? A: Basic knowledge helps, but KubeLaunch handles complex platform engineering. Configure YAML and run Terragrunt. Q: Can I customize which components are deployed? A: Yes, the modular architecture allows selective deployment through the central platform_vars.yaml. --- ## Product 4: Multi-Cloud Runway ### What It Does Multi-Cloud Runway provides enterprise-grade, security-hardened landing zone templates for AWS and GCP. It sets up multi-account/project environments with networking, IAM, security monitoring, and compliance automation. ### Key Features - **Multi-Account Architecture**: AWS Organizations and GCP resource hierarchy with environment-based separation. - **Network & Security**: VPC/VNet with Transit Gateway, GuardDuty, Security Command Center, CloudTrail, encryption at rest and in transit. - **Compliance Automation**: Pre-configured for PCI DSS, CIS Benchmarks, SOC 2 Type II, ISO 27001, NIST Framework. Pre-commit hooks with tfsec, checkov, detect-secrets. ### Technical Details - IaC: Terraform v1.5+ and Terragrunt v0.70+ - Clouds: AWS and GCP (independent modules) - Security scanning: tfsec, checkov, detect-secrets - State: S3+DynamoDB (AWS), GCS (GCP) ### Use Cases - Organizations setting up new cloud environments - Enterprises standardizing multi-account architectures - Companies needing compliance-ready cloud foundations - Teams migrating to multi-cloud with best practices ### Source Code GitHub: https://github.com/cloudon-one/multi-cloud-runway ### Frequently Asked Questions Q: Can I use only AWS or only GCP? A: Yes, the modules are independent. Deploy one or both. Q: What compliance frameworks are supported? A: PCI DSS, CIS Benchmarks, SOC 2 Type II, ISO 27001, and NIST Framework. --- ## Product 5: OpenClaw Serverless ### What It Does OpenClaw Serverless is a deployment architecture for running multiple isolated AI agents on GCP Cloud Run. Each tenant gets its own Cloud Run service with persistent workspace storage and webhook-based messaging integration. ### Key Features - **Multi-Tenant Isolation**: Separate Cloud Run services, service accounts, GCS buckets, and IAM bindings per tenant. Zero cross-tenant data access. - **Serverless Architecture**: Scale-to-zero for idle tenants (zero cost), 15-20 second cold starts, GCSFuse for workspace persistence. - **Messaging Integration**: Telegram and Slack webhooks with signature validation and replay attack prevention. ### Technical Details - Cloud: GCP Cloud Run (Gen2), Cloud Storage, Secret Manager, Artifact Registry - IaC: Terraform - Router: Node.js 20+, Express.js - Agent: OpenClaw gateway (Python-based) - Cost: ~$50-70/month per warm tenant, $0 for idle tenants ### Use Cases - Teams deploying multi-tenant AI agents - Organizations needing isolated AI agent environments - Developers building Telegram/Slack AI bots - Cost-conscious AI agent deployments ### Source Code GitHub: https://github.com/cloudon-one/openclaw-serverless ### Frequently Asked Questions Q: How much does it cost? A: Idle tenants cost nothing. Active tenants cost approximately $50-70/month. Q: What messaging platforms are supported? A: Telegram and Slack with production-ready webhook handling. Q: How is tenant isolation achieved? A: Each tenant gets separate Cloud Run service, service account, GCS bucket, and IAM bindings.