Our primary use case is running containerized Kubernetes workloads on EC2. We use the image as the base for our Kubernetes worker and control-plane nodes, hosting backend microservices, internal APIs, and CI/CD build agents that require a stable, secure, and consistently configured Linux platform.
Hardened, fast-launching base image that streamlined our Kubernetes node deployments
What is our primary use case?
How has it helped my organization?
It has reduced the time spent on node hardening and patching before workloads can be deployed. Because the image ships CIS Level 1 hardened with the SSM agent pre-installed and IMDSv2 enforced, our Kubernetes nodes come up audit-ready without a manual hardening pass, which has improved deployment consistency and reduced configuration drift across our clusters.
Predictable, repeatable EC2 launches have lowered our operational overhead and increased our confidence when scaling node groups.
What is most valuable?
The CIS Level 1 hardening applied by default is the most valuable feature. Root SSH is disabled, password authentication is off, UFW with default-deny is implemented, and MaxAuthTries is reduced to give us a secure baseline out of the box.
The pre-installed AWS Systems Manager (SSM) agent is also valuable because it lets us manage nodes through Session Manager without a bastion host or SSH keys. Removing snapd and stripping unnecessary packages reduces the attack surface and keeps the image lean, which matters for Kubernetes nodes where we want a minimal host footprint.
What needs improvement?
More published documentation around the exact CIS controls applied and how to layer additional Kubernetes-specific hardening, such as kubelet and CIS Kubernetes benchmark, on top would be helpful.
A minimal or slim variant tuned specifically for container hosts and clearer release notes per version would also be welcome. Out-of-the-box monitoring and observability integration could be expanded.
For how long have I used the solution?
We have used the ClearScale-hardened image for around 1 year and Red Hat Enterprise Linux overall for over 5 years.
Which solution did I use previously and why did I switch?
We previously used the stock Red Hat Enterprise Linux AMI and applied our own hardening with configuration management. We switched to the ClearScale image to get a pre-hardened, CIS-aligned baseline maintained by the vendor, which removed the burden of writing and maintaining our own hardening playbooks for every node.
What's my experience with pricing, setup cost, and licensing?
The per-hour software charge is modest and should be weighed against the engineering time saved on hardening, patching, and compliance work. For teams running Kubernetes at scale, evaluating the total cost of ownership rather than the hourly rate alone is important.
The time saved on audit preparation and node maintenance generally justifies it.
Which other solutions did I evaluate?
We evaluated the stock Red Hat Enterprise Linux AMI with in-house hardening, and rebuilding our own golden image internally before selecting the ClearScale-hardened image.
What other advice do I have?
I advise validating your application and Kubernetes component compatibility against the hardened defaults early. It is important to confirm firewall rules allow your cluster's required ports since UFW ships with default-deny. Once that is configured, the image is a solid, low-maintenance foundation for production Kubernetes nodes.
