Cloud infrastructure and identity, built in real environments.
Architecture decisions, measured behaviour, failure drills, trade-offs and the things that broke.
A private GKE platform serving nginx and sky through one global Gateway
with managed TLS. Terraform builds the network and cluster. Keyless GitHub Actions delivery builds,
scans and rolls out immutable images. The platform is operated through measured limits and failure
drills rather than architecture claims alone.
| 125 rps 8 Pods, no failures |
394 ms p95 under load |
70.5 s median deploy |
0 rollout connection failures, from 72 |
| Platform Private nodes, custom VPC, Cloud NAT, Gateway API, managed TLS and autoscaling across three zones. |
Delivery Keyless federation, immutable images, required checks, gated rollouts and automated upstream pin updates. |
Security and operations Pod Security, default-deny networking, Cloud Armor, observability, failure drills and a measured threat model. |
flowchart LR
User((User)) --> Edge[Global Gateway<br/>TLS + Cloud Armor]
Edge --> Nginx[nginx]
Edge --> Sky[sky]
Actions[GitHub Actions<br/>keyless delivery] --> Registry[Artifact Registry]
Registry --> GKE[Private GKE nodes]
GKE --> Nginx
GKE --> Sky
GKE -. logs and metrics .-> Monitor[Cloud Monitoring]
Terraform GKE Kubernetes
Gateway API Cloud Armor
Workload Identity Federation GitHub Actions k6
The rest of the work is grouped by the problem it explores. The larger labs include build notes, architecture decisions, validation evidence and troubleshooting records.
| Area | Projects |
|---|---|
| Identity across clouds | Entra ID to AWS IAM Identity Center · Two-site AD DS synced to Entra ID |
| Identity governance | Conditional Access, PIM and access reviews · OIDC SSO and SCIM for Grafana |
| Azure platforms | Hub-and-spoke with cross-premises connectivity · Azure Container Apps platform |
| Applications and access | Sky · OAuth 2.0 and token claims in .NET 8 · Least-privilege Azure MCP access |
