A platform,
by hand.

Self-authored Terraform module powering self-service GitLab runner fleets: 100% Spot, attribute-based instance selection, Fleeting plugin for the Docker Autoscaler executor, multi-arch. The module that runs a production CI fleet at SaaS scale — and 3,767 downloads says other organisations had the same problem.

Curated Claude Code skills for DevOps workflows: ArgoCD cluster onboarding via Pod Identity + AssumeRole, AWS SSO auth recovery, Terraform → ArgoCD migration, k8s triage, FinOps. Real community traction in 7 months.

ALB in one AWS account, EKS workloads in another — the textbook answer puts an NLB in each spoke account. With AWS LBC v3, you can register pod IPs directly into a cross-account target group. Validated on a pilot cluster, then rolled to all six staging clusters in a single day.

3-month epic standing up dedicated devops clusters, the ApplicationSet pattern for multi-cluster fan-out, and cluster onboarding via Pod Identity + cross-account AssumeRole — no bearer tokens. Authored ~70% of the underlying GitOps repo.

Auto-PDB ClusterPolicy on every multi-replica Deployment fleet-wide. Observation-VPA generation via a separate-by-kind rule design. CRD drift suppression for ArgoCD. Migrated from Terraform Helm onto an ApplicationSet.

Crossplane v2.5.3 (Upbound) bootstrapped on dedicated devops clusters in Pipeline mode. The first usable Composition — AppWorkloadBucket with S3 versioning + lifecycle + CORS — shipped to prod. Declarative AWS resources reconciled by k8s controllers instead of terraform apply.

How a SaaS platform used Kyverno to auto-generate PDBs for every microservice that lacked one — preventing service downtime when Karpenter consolidates nodes and closing the operational gap of "we forgot to add a PDB."

A local dev platform that mirrors production: k3d + Traefik locally, EKS in the cloud, identical Kustomize bases and overlays across environments. Tilt for rapid feedback; GitLab CI for immutable image promotion from staging to prod.

How a CI workload arrives, an EC2 Spot instance boots, runs the job, and the ASG returns to zero. Attribute-based selection, price-capacity-optimized allocation, deliberate capacity_rebalance = false, Packer AMI builder.

The IAM trust, the security-group topology, and the readiness-gate ordering that makes the NLB hop go away. Three IAM gotchas account for > 90% of the debugging time; they're catalogued here so the next person doesn't have to find them live.

Dedicated devops clusters. Self-managing app-of-apps bootstrap. ApplicationSet fan-out. Server-Side Diff at the controller level. The migration sequence that takes an addon off Terraform Helm without restarting workloads.

Honed across six k8s versions (1.22 → 1.34) on roughly fifteen production clusters. Module bumps first, GitOps versions separate, cluster_version last, one cluster at a time. The Kyverno PDB gotcha. The ArgoCD OOM gotcha. The NLB-vs-gen-3-instance gotcha. The unlock-runbook you need ready.

Validate → Checkov → plan → Infracost → auto-apply. The OIDC dance, the resource_group: trick that makes concurrent merges safe, and the cache-key fix that bought a 37% pipeline speedup fleet-wide.

Replacing IRSA with Pod Identity across 10 production + 5 staging EKS clusters in two days. Why before_compute = true is non-optional. The cross-account variant. Why AWS LBC v3 needs the SA annotation removed.