Ask for a repository. Not a case study and not a deck: a link to code somebody on the team wrote, with the review history still attached.
DevOps consultants in Kenya are hard to compare for an ordinary reason. Every website in this market lists the same seven logos and none of it is falsifiable. CloudSpinx builds the delivery machinery engineering teams here and across East Africa run on, which is CI/CD pipelines, OpenTofu and Terraform, GitOps, Kubernetes, and enough observability to see what production is actually doing. Ours is readable before you hire us. We rank 4th of all contributors to the largest of the three infrastructure-as-code repositories behind Mojaloop, the open-source payment switch that national payment systems are built from, and 3rd on the other two, all of it Apache 2.0. The ledger is on our engineering record.
That is the bar this post argues for, not a courtesy to us. Apply it to everyone on your shortlist.
Every DevOps company in Nairobi has the same website
Docker, Kubernetes, Terraform, Jenkins, AWS, Azure, Prometheus, and a paragraph about culture. There is no ranked list of the best DevOps consultants in Kenya, and if one existed it would be sold by whoever appeared first on it.
Certifications tell you somebody passed an exam, and they are good exams. They do not tell you whether that person can pull a few hundred untagged cloud resources into state without an outage, which is the actual job here, because almost every estate in this market was clicked together first and codified later.
Three things are checkable inside an hour: code, a migration or upgrade they survived, and a quote with a handover line in it. The rest is furniture.
Four claims a DevOps consultant makes, and the artefact that settles each
The left column is what a website says, and none of it is a lie. All of it is equally true of anyone who has installed the tool once, which is why it cannot separate two suppliers.
The plan output is the item people skip. A plan that reports no changes is the only evidence that the code in the repository is what is actually running in the account, and it cannot be produced in a meeting. Ask for it against something they maintain, not a demo.
GitOps works the same way. Naming Argo CD is a purchase, not a practice. What matters is which repository the cluster reconciles from, who can merge to it, and what the controller does when somebody edits a live resource by hand.
While you are asking, ask which they write, Terraform or OpenTofu, and why. HashiCorp moved Terraform to the Business Source License, OpenTofu forked in response, and it now sits under the Linux Foundation as a drop-in replacement. We write OpenTofu by default and Terraform where a client's existing tooling requires it. Either answer is defensible. No answer means nobody on that team has read the license that governs your estate. The version of this test aimed at a cluster rather than a pipeline is what to ask a Kubernetes consultant.
Who owns the platform at handover
This gets settled by default rather than by decision, usually in week one, usually because the supplier's accounts already existed and yours had to be created.
The state file is the one with teeth. Whoever holds the backend holds both the map of the estate and the lock on changing it, so a migration cannot even be planned from outside it.
None of that is malice. It is momentum. The consequence only shows up when you want to change supplier, renegotiate, or bring the work in house, which is precisely the moment you have the least bargaining power.
Everything we build sits in the client's repositories and the client's backend from the first commit. That is how our DevOps and CI/CD engagements are scoped, rather than something promised in the final week of one.
What DevOps consulting costs in Kenya, and the shape of an honest quote
Start with the tooling, because it reframes everything after it. GitHub includes 2,000 Actions minutes a month on a Free plan for private repositories and 3,000 on Team, and a standard Linux runner past that is USD 0.006 a minute. Burn an extra 2,000 minutes in a month and you have spent twelve dollars.
So the cost of a DevOps program is people, all of it, and scope is the only thing worth negotiating. A quote that admits this has three lines instead of one: a short discovery, the build split into capabilities you could buy separately, and enablement, which is the time spent making your engineers able to run the thing.
Now find the enablement line on the cheapest quote in your pile. It is usually absent, which is why it is the cheapest, and the cost reappears later as a support contract you did not plan for. If a cluster is in scope, designing and running it is a third purchase again and should be priced as one rather than buried in a build.
Send us how you ship today and you get a scope and one figure back. That costs nothing and commits you to nothing.
When the consultant has to be in the building
Most of this work is remote and should be. Review happens in Git and a pipeline does not care where the engineer sits, so delivery across East Africa is a scheduling question rather than an engineering one.
Two things are not remote. AWS, Azure and Google run no region in this country, so runners, registries and control planes sit in Johannesburg or Frankfurt, and image pull time becomes part of every build. A cache close to the workload is worth more than most pipeline tuning.
The other is physical. A self-hosted runner in a Nairobi office is fast right up to the power cut, and then somebody has to reach the machine. Our commitment there is a one hour P1 response around the clock and same-day on site in Nairobi, and a remote-only contractor cannot write the second half of that sentence.
Write the exit into the contract
Not a service level. A date.
Pick a day a month after handover when your engineers deploy to production, roll one release back, and restore something, with nobody from the supplier in the channel. Put it in the statement of work. It costs a supplier who built the platform properly one quiet afternoon, and it is the only clause that tests the difference between something you own and a subscription with an engineer attached.
A supplier who flinches at that clause has just told you what the engagement really is. If the one you already have passes it, keep them.
If you want ours tested that way, send the shape of your stack through the scoping form or WhatsApp +254 713 403 044. Free, no obligation, and if the honest answer is that you do not need a pipeline yet, or do not need us, that is what you will be told.