Skip to experience
Contact→→

Introduction

00 / SURFACE

Profile and scale

01 / TOPOLOGY

Each role below is a cluster — control plane, ingress, worker nodes, pods. The traffic is directional.

CNCF Kubestronaut and DevOps Engineer with 4+ years across Linux systems engineering and cloud infrastructure, operating production Kubernetes platforms on AWS, Azure, Oracle Cloud and bare metal. Runs multi-tenant clusters serving enterprise SaaS customers, delivered a legacy-to-microservice migration for a regulated banking environment spanning a multi-cloud estate with cross-provider disaster recovery, and productised a complete application stack into a published AWS Marketplace appliance.

Years in production
0+
Roles traversed
0

Anatomy of a Kubernetes cluster

02 / CLUSTER

Everything to the right is a real object. Six of these are running behind this page — one for each role in the record below — carrying 294 pods across 51 worker nodes.

Control plane
API server, etcd, scheduler. Three members, because quorum is three — and lifted above the workers that answer to it.
Worker node
A machine. Reports inward on a metronomic heartbeat, which is how you tell a health signal from traffic.
Ingress
Where outside traffic enters. Fans out only to the nodes the workload actually landed on.
Pods
Cattle. Scheduled onto a node, grouped into namespaces that cut across hosts, replaced while you watch.

Professional experience

R-0111/2025 — CurrentActive

DevOps Engineer at Raynet GmbH

Raynet GmbH

Multi-tenant production Kubernetes for enterprise IT asset and endpoint management SaaS.

  • 01Operate multi-tenant production Kubernetes clusters (RKE2, OKD/OpenShift) spanning 10+ nodes across Hetzner, AWS and Azure, hosting enterprise IT asset management and endpoint management SaaS products.
  • 02Run a production CloudNativePG cluster serving tenant-isolated namespaces at scale; eliminated connection exhaustion incidents by redesigning PgBouncer session-mode pooling.

Full record — 9 entries

0+
Cluster nodes
0
Cloud providers
0
AWS Marketplace product
R-0203/2025 — 11/2025

DevOps Engineer at Bestcloudfor.me

Bestcloudfor.me

Banking modernisation: legacy monolith to microservices across a multi-cloud estate with cross-provider DR.

  • 01Contributed, as part of a consultancy engagement, to a banking client's infrastructure modernisation programme, migrating legacy monolithic systems to a containerised microservice architecture with automated CI/CD and GitOps delivery.
  • 02Operated the client's multi-cluster Kubernetes estate: a large-scale production cluster on Oracle Cloud Infrastructure, a cross-provider disaster recovery cluster on Huawei Cloud, and a dedicated control plane cluster running core platform applications.

Full record — 6 entries

0
Kubernetes clusters
0+
Servers patched
0
Clouds, one DR path
R-0303/2024 — 02/2025

DevOps Engineer at Sensey

Sensey

One pipeline definition that reads each service's runtime and picks its own build path.

  • 01Designed a language-aware CI/CD pipeline that detected each service's runtime stack and selected the matching build, test and deployment path, delivering a seven-microservice application through a single shared pipeline definition.
  • 02Designed, deployed and managed Azure cloud infrastructure for production application workloads.

Full record — 5 entries

0
Microservices
0
Shared pipeline definition
R-0412/2023 — CurrentActive

Linux System Support at Anabiltek

Anabiltek

Part-time, ongoing: keeping production Linux estates healthy.

  • 01Provide ongoing Linux system administration, performance tuning and reliability improvements for production environments.
0.0yr
Continuous engagement
R-0501/2022 — 03/2024

System Specialist & DevOps Engineer at Freelance

Freelance

End-to-end ownership for long-term clients: provisioning, hardening, incident response.

  • 01Provided end-to-end Linux system administration for long-term clients, covering provisioning, hardening, performance tuning and incident response.
  • 02Containerised client workloads and introduced automated deployment pipelines in place of manual release processes.

Full record — 4 entries

0yr
Independent practice
R-0601/2022 — 08/2022

IT Officer at AET Electronics

AET Electronics

Where it started: keeping a manufacturing site running.

  • 01Maintained IT infrastructure across hardware, software and network layers for a manufacturing site, ensuring uninterrupted daily operations.
  • 02Applied security controls to protect company data and IT assets, and resolved end-user technical issues.
0→
The first layer

Technical skills

04 / GRAPH

A percentage next to a tool proves nothing. These are the systems and the technologies inside them — select one to see the roles it carried production traffic in, and what it ran alongside.

Select a technology

  • Kubernetes

  • Containers & Packaging

  • GitOps & CI/CD

  • Infrastructure as Code

  • Observability

  • Cluster Security

  • Cloud

  • Systems & Data

  • Scripting

Project case studies

05 / BUILDS

01 / 05

P-012025

Regulated Multi-Cloud Estate

Bestcloudfor.me — banking client

A bank's monolith became microservices without giving up the requirement that it survive losing a cloud provider.

Problem
Legacy monolithic systems in a regulated banking environment had to become a containerised microservice architecture. Regulation meant the estate also had to keep running if an entire cloud provider became unavailable, which ruled out a single-region answer.
Outcome
The migration ran with automated CI/CD and GitOps delivery, monitoring and logging through Prometheus, Grafana and the ELK stack, and a DR path that does not depend on the primary provider being reachable.

0

Clusters

0

Cloud providers

0+

Servers auto-patched

replicateClientsKeepalived VIPFloating addressHAProxy AHAProxy BRKE2 APIIngressMicroservicesRedis SentinelStateful tierDR cluster — HuaweiCross-providerPrometheus · Grafana · ELK
P-022026

Procurement-Ready Appliance

Raynet GmbH

A complete application stack, productised into an AMI a stranger can launch — with nothing from the build machine left inside it.

Problem
Enterprise buyers want to acquire software through AWS procurement, not through a deployment project. That means the entire stack has to ship as one image. It also means every image is handed to people who did not build it, so anything the build process left behind becomes a customer-facing security problem.
Outcome
A published, maintained AMI-based server product on AWS Marketplace, where no build-time credential or identity persists into a customer instance.

0

Published Marketplace product

0

Build credentials in the image

sharereviewlaunchSource & chartGitLab CIBake AMISanitisekeys · cloud-init · journalsSnapshotScanner accountcreate-volume grantMarketplace listingCustomer instance
P-032026

Tenant-Isolated Data Plane

Raynet GmbH

Connection exhaustion is not a database problem. It is a pooling-mode problem.

Problem
A production CloudNativePG cluster serves tenant-isolated namespaces at scale. As tenants multiplied, the shared connection budget did not, and the platform hit connection exhaustion incidents that surfaced to customers as failures in unrelated features.
Outcome
Connection exhaustion incidents eliminated. Alerting rules across infrastructure, database, GitOps and backup domains route to Alertmanager, and a service opens and resolves GitLab issues automatically so an alert becomes tracked work without a human relaying it.

0

Connection exhaustion incidents

0

Alerting domains

streamcompressopen / resolveTenant namespacesPgBouncersession mode, boundedCloudNativePG primaryReplicaBackup CronJobHetzner S3AlertmanagerGitLab issuesopened & resolved automatically
P-042024

Language-Aware Delivery

Sensey

Seven services in different runtimes, delivered by one pipeline definition that reads what it is building.

Problem
A seven-microservice application spanned several runtime stacks. The obvious answer — a pipeline per service — means seven definitions to keep in sync, and seven places for a build convention to quietly drift.
Outcome
Seven microservices delivered through one definition, with Prometheus and Grafana providing real-time metrics on what the pipeline put into production.

0

Microservices

0

Pipeline definition

CommitDetect runtimeselects the pathPath APath BPath CTestContainer imageHelm releaseAKSPrometheus · Grafana
P-052026

Admission & Secret Baseline

Raynet GmbH

Make the safe path the default path, so no workload has to remember to be safe.

Problem
Cluster defaults let workloads request more privilege than they need, and secrets arrived through whatever route the deploying human chose. Both are fine until the cluster is multi-tenant, at which point they are the whole risk surface.
Outcome
Policy and secret handling became properties of the platform rather than instructions in a runbook — a new namespace inherits both.

RS256

JWT authentication

0

Hand-delivered secrets

applymaterialiseadmitmountGitHashiCorp VaultArgoCDExternal SecretsRS256 JWTKyverno admissionreject, not auditSecretWorkload

CI/CD delivery pipeline

06 / PIPELINE

  1. 01Commit—

    A change enters the system with an author and a reason.

  2. 02Plan—

    State the intended change against real infrastructure before touching it.

  3. 03Build—

    Detect the runtime, take the matching path, produce an artefact.

  4. 04Test—

    Prove the change before it can reach anything that matters.

  5. 05Security scan—

    Turn scan findings into remediation that actually runs.

  6. 06Containerise—

    Package the release so the cluster receives one thing, versioned.

  7. 07Deploy—

    Git is the desired state; the cluster converges toward it.

  8. 08Observe—

    The deploy is not finished until something is watching it.

pipeline #44170/8 stages

Awaiting trigger…

Certifications

07 / CREDENTIALS

Keystone

CNCF Kubestronaut

02/2025

Select a code for the full credential

  • OpenTelemetry Certified Associate
  • Istio Certified Associate
  • Certified Backstage Associate
  • Kyverno Certified Associate
  • Prometheus Certified Associate
  • Certified Argo Project Associate
  • Certified GitOps Associate
  • Certified Cloud Native Platform Engineering Associate
  • AWS Certified Solutions Architect — Associate
  • AWS Certified Cloud Practitioner
  • CNCF Kubestronaut
  • Certified Kubernetes Security Specialist
  • Kubernetes and Cloud Native Security Associate
  • Kubernetes and Cloud Native Associate
  • Certified Kubernetes Application Developer
  • Certified Kubernetes Administrator
  • Microsoft Certified: Azure Fundamentals

Engineering principles

08 / OPERATOR

Reliability
Systems are judged on their worst day. Design for the failed upgrade, the exhausted connection pool, the region that went away.
Automation
A procedure that lives in someone's memory is an outage waiting for a holiday. Put it in a playbook, a chart, or a pipeline.
Observability
You cannot operate what you cannot see. Alerts should describe a symptom a human recognises, and route to someone who can act.
Simplicity
Every abstraction is a thing to debug at 03:00. The best platform is the smallest one that meets the requirement.
Ownership
Shipping it is not the job. Running it, patching it, restoring it and being the one who is called — that is the job.

Contact

09 / CORE

Contact→→[email protected]