Scoped access, managed secrets, self-healing deploys: our move to Kubernetes

How we migrated from Cloud Run to private Kubernetes clusters: WireGuard access, centralized secrets management, and self-healing GitOps deploys. Real numbers from a four-month migration.