Projects

Infrastructure I've built on AWS and Kubernetes, with the architecture decisions, implementation details and what I'd change next time.

9 projects

Production EKS Cluster with Terraform: VPC, Node Groups and IRSA coverInfrastructure

Production EKS Cluster with Terraform: VPC, Node Groups and IRSA

  • Terraform
  • AWS EKS
  • Kubernetes
  • AWS VPC
  • Helm
  • IRSA
  • Cluster Autoscaler
  • AWS Load Balancer Controller

I kept setting up EKS by hand and forgetting steps, so I put all of it in Terraform: a VPC across 3 AZs, private node groups, IRSA, the Load Balancer Controller and Cluster Autoscaler. Everything else runs on this.

    View DetailsGitHub
    Node.js API on EKS: Helm, HPA, ALB Ingress and Secrets Manager coverDevOps / Platform

    Node.js API on EKS: Helm, HPA, ALB Ingress and Secrets Manager

    • Kubernetes
    • Helm
    • AWS EKS
    • HPA
    • ALB
    • AWS Secrets Manager
    • Docker
    • ECR

    This puts the EKS cluster to work. A Node.js API packaged with Helm, scaled by HPA and Cluster Autoscaler, routed through an ALB, and configured through Secrets Manager without a single secret in Git.

      View DetailsGitHub
      EKS Cost Optimization with Karpenter and Spot Instances coverInfrastructure

      EKS Cost Optimization with Karpenter and Spot Instances

      • Karpenter
      • AWS EKS
      • Spot Instances
      • Kubernetes
      • AWS SQS
      • Helm

      Cluster Autoscaler only scales fixed node groups, so you pay for CPU the pods never use. I replaced it with Karpenter on Spot: right-sized nodes, consolidation within 30 seconds, and 40% lower compute cost with no app changes.

        View Details
        Kubernetes RBAC Hardening: Least Privilege, Kyverno and Weekly Audits coverDevOps / Platform

        Kubernetes RBAC Hardening: Least Privilege, Kyverno and Weekly Audits

        • Kubernetes
        • RBAC
        • EKS
        • AWS CloudWatch
        • Pod Security Standards
        • kyverno
        • Alerts
        • SNS

        Cluster-admin gets handed out because it's the easy fix, and nobody cleans it up. On a deliberately misconfigured EKS cluster I cut the bindings from 8 to 1, blocked regressions with Kyverno, and added a weekly audit to Slack.

          View DetailsGitHub
          Kubernetes Pod Security Standards and Network Policies coverDevOps / Platform

          Kubernetes Pod Security Standards and Network Policies

          • Kubernetes
          • Pod Security Standards
          • Network Policies
          • EKS
          • DevSecOps

          RBAC decides who can act in the cluster. This covers the other two layers on EKS: the restricted Pod Security profile (no root, no privilege escalation) and network policies that only allow the paths each pod needs.

            View DetailsGitHub
            Observability Stack on Kubernetes: Prometheus, Grafana, Loki and Alertmanager coverObservability

            Observability Stack on Kubernetes: Prometheus, Grafana, Loki and Alertmanager

            • Prometheus
            • Grafana
            • Loki
            • Alertmanager
            • Kubernetes
            • Helm

            Prometheus, Grafana, Alertmanager and Loki on EKS, installed with Helm, with dashboards kept as code. Having metrics and logs in one view took MTTR from 15 minutes to under 3, and alerts reach Slack with context.

              View DetailsGitHub
              GitOps CI/CD: GitHub Actions and Argo CD with Multi-Environment Promotion coverDevOps / Platform

              GitOps CI/CD: GitHub Actions and Argo CD with Multi-Environment Promotion

              • GitHub Actions
              • Argo CD
              • Docker
              • AWS ECR
              • Kubernetes
              • GitOps

              GitHub Actions builds and scans the image, then Argo CD syncs it to the cluster. No kubectl from a laptop, rollback is a git revert, and what's running in production is always visible in the repo.

                View DetailsGitHub
                AWS Multi-Account Landing Zone: Organizations, IAM Identity Center and SCPs coverCloud Architecture

                AWS Multi-Account Landing Zone: Organizations, IAM Identity Center and SCPs

                • AWS Organizations
                • IAM Identity Center
                • SCPs
                • CloudTrail
                • GuardDuty
                • Terraform

                One AWS account means one incident can reach every workload. I split it into management, security, shared services and workload accounts, with SSO through IAM Identity Center, SCP guardrails and CloudTrail everywhere.

                  View DetailsGitHub
                  Cloud Cost Optimisation: Datadog and AWS Spend Reduction coverCost Optimisation

                  Cloud Cost Optimisation: Datadog and AWS Spend Reduction

                  • Datadog
                  • AWS
                  • APM
                  • Log Management
                  • Cost Analysis
                  • Savings Plans

                  Our Datadog bill had grown for 18 months without anyone reviewing it. Tiered log retention, 10% trace sampling on successful requests, unused-resource cleanup and a Savings Plan cut it by 15%, about $800 a month.

                    View DetailsGitHub