Kubernetes

Repeatable cluster provisioning with iLO, Netplan, Ansible, Tekton, and Kubespray.

A highly available Kubernetes platform supporting containers and VM-as-a-Service patterns.

Rook Ceph, NooBaa, Prometheus, Grafana, and telemetry APIs for infrastructure visibility.

A practical look at investigating a K3s security documentation issue, comparing CIS Kubernetes Benchmark 2.1, and learning the project's required assessment workflow.

How a hub-issued Argo CD Agent certificate crosses an AWS Secrets Manager boundary through ESO PushSecret and ExternalSecret, without giving the non-AWS spoke ACM Private CA access.

Debugging an Argo CD login loop on a hub-and-spoke argocd-agent setup — from an OIDC callback loop and i/o timeouts down to a cross-chart NetworkPolicy gap that only bit us where enforcement was actually on.

How we gave RKE2/bare-metal spokes their own AWS identity without a shared trust anchor — one self-signed CA and anchor per cluster, one profile per role — so a stolen key is confined to its own cluster and a compromised consumer to its own role.

How we added schema validation to our Helm chart CI pipeline using kubeconform — solving the CRD schema problem, extracting schemas from live clusters, and surfacing results directly in PR comments.

Setting up GitHub Actions Runner Controller v2 on an existing AWS EKS cluster — from Helm installation and GitHub App authentication to troubleshooting missing tools on minimal runner images.

Why I am building a small portfolio and technical blog around DevOps, SRE, and platform engineering.

A deep-dive into our Proof of Concept evaluating Canonical's JAAS (Juju-as-a-Service) for managing edge Kubernetes clusters from a central AWS EKS control plane, covering architecture, setup, findings, and production considerations.