Kubernetes that stays up, clusters that stay private, supply chains that stay signed. I design, run and secure cloud-native infrastructure — and I'll tell you, plainly, where the real risk is.
Each engagement is scoped like a service unit: a clear job, a healthy state, and a restart policy when something breaks at 3 a.m.
Design, run and upgrade clusters that don't surprise you. Bare-metal and self-hosted (K3s / kubeadm), HA control planes, controlled version upgrades, no-drama node lifecycle.
Defence built into the dataplane: Cilium NetworkPolicy with default-deny, eBPF runtime detection with Tetragon, pod hardening, tight RBAC. Security as architecture, not a scanner bolted on at the end.
Pipelines that ship without drama. Signed images, SBOMs, reproducible builds, secrets that never live in a manifest. GitHub Actions to a private registry and your own ingress.
Private by default. WireGuard / AmneziaWG mesh between nodes and regions, encrypted east-west traffic, links that survive DPI-heavy and sovereignty-constrained networks across BRICS.
When it's already on fire: root-cause analysis, secret-leak remediation with coordinated rotation, recovery runbooks so the answer next time is "redeploy," not "archaeology."
Tell me what you're operating today and where it hurts. I'll map it to a scope — or tell you that you don't need me yet.
Position and tradeoffs, not a price list. This is where the seniority is.
I run Kubernetes well — and I'll tell you when you've outgrown it, or haven't grown into it yet. Most teams under a few dozen services need things scheduled, restarted and secured, not a platform team. The honest answer ships faster than the fashionable one.
If a node dies, the answer is "redeploy," not "remember." Everything is code: manifests, pipelines, network policy, the cluster itself. No snowflake servers, no undocumented 3 a.m. fixes.
Rootless containers, least-privilege RBAC, network default-deny, secrets out of specs, runtime detection in the kernel. Fewer attack surfaces by design beats a long report of findings after the fact.
I scope what an audit does and doesn't cover, in writing, before it starts. Direct contact, no account managers, no synergy decks. Specifics of client work stay under NDA — your infrastructure isn't a case study.
Boring where it should be, sharp where it matters. Tools chosen because they fail predictably and recover cleanly.
# this site is built and shipped through the same pipeline I set up for clients — static build, signed, deployed to my own Traefik + Podman via GitHub Actions. dogfood or it didn't happen.
Field notes from real clusters — the failures, the tradeoffs, the things that aren't in the docs. The main proof of expertise.
› full writeups land in phase 2 (Astro/MDX). Want one early? ask.
Anonymised. Patterns, not logos.
Migrated a live multi-region cluster to an eBPF dataplane, moved every plaintext secret out of pod specs, and added runtime detection — without a maintenance outage the users could feel.
Reproducible GitHub Actions pipelines, signed images, database-backed services with controlled rollouts. Deploys stopped being events.
A WireGuard/AmneziaWG backbone linking nodes across jurisdictions with DPI on the path — encrypted, obfuscated, and stable under throttling.
Mapped the blast radius of a reused credential across hosts, staged a dual-credential rotation, and shipped recovery runbooks so it can't silently recur.
› specifics under NDA. Reference conversations available for serious engagements.
Kubernetes that won't stay up, a cluster you're not sure is private, a pipeline held together by hope, or an audit you've been putting off. One engineer, direct reply.
$ mail hi@run-as-daemon.dev