Skip to experience
Alper Devrim

Alper Devrim

Golden Kubestronaut

DevOps Engineer. I design infrastructure that survives reality.

Get in touchDownload résumé

Summary

Golden Kubestronaut and DevOps Engineer with 4+ years across Linux systems engineering and cloud infrastructure, operating production Kubernetes platforms on AWS, Azure, Oracle Cloud and bare metal. Runs multi-tenant clusters serving enterprise SaaS customers and delivered a legacy-to-microservice migration for a regulated banking environment spanning a multi-cloud estate with cross-provider disaster recovery.

21

Certifications, 17 of them from the CNCF, including Golden Kubestronaut.

Years of experience
4+
Cloud platforms
5

Experience

DevOps Engineer

Raynet GmbH, Paderborn, Germany - Remote

Multi-tenant production Kubernetes for enterprise IT asset and endpoint management SaaS.

  • Operate multi-tenant production Kubernetes clusters (RKE2, OKD/OpenShift) spanning 10+ nodes across Hetzner, AWS and Azure, hosting enterprise IT asset management and endpoint management SaaS products.
  • Run a production CloudNativePG cluster serving tenant-isolated namespaces at scale; eliminated connection exhaustion incidents by redesigning PgBouncer session-mode pooling.
  • Hardened clusters with a restrictive Kyverno admission baseline and centralised secret delivery via HashiCorp Vault + External Secrets Operator with RS256 JWT authentication.
  • Built the OKD observability layer: alerting rules across infrastructure, database, GitOps and backup domains, wired to Alertmanager and a service that opens and resolves GitLab issues automatically.
  • Delivered an MSSQL backup solution as a reusable Helm chart for OpenShift (ServiceAccount, Role, RoleBinding, ExternalSecret and CronJob templates) with edition-aware compression, streaming backups to Hetzner S3 storage.
  • Migrated ArgoCD multi-source Applications to Helm chart v3, refactoring the values structure and moving secret delivery to ExternalSecret-based injection.
  • Recovered a customer-hosted production environment after a failed platform upgrade: analysed Helm release drift against previous revisions and executed a layered rollback across data, identity, cache, application and frontend tiers.
  • Hardened golden AMIs for public distribution: removed authorised keys and SSH host keys, reset cloud-init state, and sanitised journal and authentication logs so no build-time credentials or identity persisted into customer instances.
  • Published and maintain an AMI-based server product on AWS Marketplace, handling scanner-account sharing with snapshot create-volume permissions, submission review and version replacement workflows.
Cluster nodes
10+
Cloud providers
3
AWS Marketplace product
1
  • RKE2
  • OKD / OpenShift
  • Kyverno
  • HashiCorp Vault
  • External Secrets
  • ArgoCD
  • Helm
  • PostgreSQL
  • MSSQL
  • Alertmanager
  • GitLab CI
  • AWS
  • Azure
  • Hetzner

Selected work

  1. Bestcloudfor.me - banking client, 2025

    Regulated Multi-Cloud Estate

    A bank's monolith became microservices without giving up the requirement that it survive losing a cloud provider.

    Clusters
    3
    Cloud providers
    2
    Servers auto-patched
    50+
    Problem
    Legacy monolithic systems in a regulated banking environment had to become a containerised microservice architecture. Regulation meant the estate also had to keep running if an entire cloud provider became unavailable, which ruled out a single-region answer.
    Approach
    Three clusters with distinct jobs: a large production cluster on Oracle Cloud, a cross-provider disaster recovery cluster on Huawei Cloud, and a dedicated control plane cluster running the platform's own applications. The Kubernetes API and ingress sit behind a virtual IP served by a two-node HAProxy and Keepalived pair, carrying both north-south and east-west traffic. Delivery is GitOps; OS patching is generated from Qualys scan data and applied through a single Ansible dynamic-inventory run.
    Outcome
    The migration ran with automated CI/CD and GitOps delivery, monitoring and logging through Prometheus, Grafana and the ELK stack, and a DR path that does not depend on the primary provider being reachable.
    • RKE2
    • ArgoCD
    • Ansible
    • Prometheus
    • Grafana
    • ELK
    • Redis
    • Oracle Cloud
    • Huawei Cloud
    • Linux

  2. Raynet GmbH, 2026

    Tenant-Isolated Data Plane

    Connection exhaustion is not a database problem. It is a pooling-mode problem.

    Connection exhaustion incidents
    0
    Alerting domains
    4
    Problem
    A production CloudNativePG cluster serves tenant-isolated namespaces at scale. As tenants multiplied, the shared connection budget did not, and the platform hit connection exhaustion incidents that surfaced to customers as failures in unrelated features.
    Approach
    Redesigned the PgBouncer pooling so tenant workloads share a bounded set of server connections in session mode instead of each namespace consuming its own. Backups run as a reusable Helm chart for OpenShift - ServiceAccount, Role, RoleBinding, ExternalSecret and CronJob templates, edition-aware compression, streaming to Hetzner S3 - so a new tenant inherits a backup policy rather than needing one written.
    Outcome
    Connection exhaustion incidents eliminated. Alerting rules across infrastructure, database, GitOps and backup domains route to Alertmanager, and a service opens and resolves GitLab issues automatically so an alert becomes tracked work without a human relaying it.
    • OKD / OpenShift
    • PostgreSQL
    • MSSQL
    • Helm
    • External Secrets
    • Alertmanager
    • Hetzner
    • RBAC

  3. Sensey, 2024

    Language-Aware Delivery

    Seven services in different runtimes, delivered by one pipeline definition that reads what it is building.

    Microservices
    7
    Pipeline definition
    1
    Problem
    A seven-microservice application spanned several runtime stacks. The obvious answer - a pipeline per service - means seven definitions to keep in sync, and seven places for a build convention to quietly drift.
    Approach
    One shared pipeline definition that detects each service's runtime stack at the start of the run and selects the matching build, test and deployment path. Releases are packaged with Docker and Helm; source control, work tracking and release automation are integrated in Azure DevOps as a single delivery workflow rather than three tools joined by convention.
    Outcome
    Seven microservices delivered through one definition, with Prometheus and Grafana providing real-time metrics on what the pipeline put into production.
    • Azure DevOps
    • Docker
    • Helm
    • AKS
    • Azure
    • Prometheus
    • Grafana
    • YAML

  4. Raynet GmbH, 2026

    Admission & Secret Baseline

    Make the safe path the default path, so no workload has to remember to be safe.

    JWT authentication
    RS256
    Hand-delivered secrets
    0
    Problem
    Cluster defaults let workloads request more privilege than they need, and secrets arrived through whatever route the deploying human chose. Both are fine until the cluster is multi-tenant, at which point they are the whole risk surface.
    Approach
    A restrictive Kyverno admission baseline rejects non-conforming workloads at the door rather than auditing them afterwards. Secret delivery is centralised through HashiCorp Vault and the External Secrets Operator using RS256 JWT authentication, so a workload receives a Secret the cluster materialised for it and no long-lived credential is copied between environments. ArgoCD multi-source Applications were migrated to Helm chart v3 with the values structure refactored and secret delivery moved onto ExternalSecret injection.
    Outcome
    Policy and secret handling became properties of the platform rather than instructions in a runbook - a new namespace inherits both.
    • Kyverno
    • HashiCorp Vault
    • External Secrets
    • RBAC
    • ArgoCD
    • OKD / OpenShift
    • Helm

Skills

Specialises in GitOps delivery with ArgoCD and Helm, policy-driven cluster security with Kyverno and HashiCorp Vault, and observability with Prometheus, Grafana and Alertmanager, backed by Terraform and Ansible automation.

Kubernetes

Distributions operated in production, not just clusters created.

  • RKE2
  • OKD / OpenShift
  • AKS
  • EKS

Containers & Packaging

How a change becomes an artefact.

  • Docker
  • Helm
  • Kustomize

GitOps & CI/CD

How an artefact becomes a running system.

  • ArgoCD
  • GitHub Actions
  • GitLab CI
  • Azure DevOps

Infrastructure as Code

The estate, declared.

  • Terraform
  • Ansible

Observability

Symptoms a human recognises, routed to someone who can act.

  • Prometheus
  • Grafana
  • Alertmanager
  • ELK

Cluster Security

Admission control and secret delivery as platform defaults.

  • Kyverno
  • HashiCorp Vault
  • External Secrets
  • RBAC

Cloud

Five providers, including a cross-provider DR path.

  • AWS
  • Azure
  • Oracle Cloud
  • Huawei Cloud
  • Hetzner

Systems & Data

The layer everything else is standing on.

  • Linux
  • PostgreSQL
  • MSSQL
  • Redis

Scripting

Glue, and the tooling around the glue.

  • Python
  • Bash
  • YAML

Certifications

Golden Kubestronaut

CNCF,

The CNCF's highest certification distinction, awarded for holding the foundation's complete portfolio - every Kubernetes and cloud native certification it offers - together with the Linux Foundation's systems administrator credential.

All 19 certifications

CNCF

  • CNPECertified Cloud Native Platform Engineer
  • CCACilium Certified Associate
  • OTCAOpenTelemetry Certified Associate
  • ICAIstio Certified Associate
  • CBACertified Backstage Associate
  • CKACertified Kubernetes Administrator
  • KCAKyverno Certified Associate
  • PCAPrometheus Certified Associate
  • CAPACertified Argo Project Associate
  • CGOACertified GitOps Associate
  • CNPACertified Cloud Native Platform Engineering Associate
  • CKSCertified Kubernetes Security Specialist
  • KCSAKubernetes and Cloud Native Security Associate
  • KCNAKubernetes and Cloud Native Associate
  • CKADCertified Kubernetes Application Developer

AWS

  • SAAAWS Certified Solutions Architect - Associate
  • CCPAWS Certified Cloud Practitioner

Linux Foundation

  • LFCSLinux Foundation Certified Systems Administrator

Microsoft

  • AZ-900Microsoft Certified: Azure Fundamentals

Education

08/2025

Computer Engineering

Bachelor's Degree

Cumhuriyet University, Sivas, Türkiye

06/2021

Computer Programming

Associate Degree

Eskişehir Technical University, Eskişehir, Türkiye

Languages

Turkish
Native
English
Professional Working

Let's build something that doesn't go down.

[email protected]

Sivas, Türkiye - Remote