infrastructure / Engineering project

Hybrid Kubernetes GitOps Platform

Enterprise GitOps k3s & Oracle OKE platform with NetBird WireGuard mesh

Designed and operated production hybrid k3s and Oracle OKE GitOps infrastructure. Uses NetBird WireGuard mesh to privately reach the OKE API via an independent anchor VM and link cloud workloads to local GPU inference clusters under Cilium egress network policies. Features authentik operator SSO (OIDC, OAuth, MFA), Infisical and OCI Vault secrets with External Secrets Operator, cert-manager PKI, Tetragon eBPF runtime security, VolSync/restic backups, and ephemeral Actions Runner Controller (ARC) GitHub runners promoting images via Git without CI cluster access.

Architecture & decisions

• Zero cluster credentials in CI: GitHub Actions Runner Controller (ARC) promotes image digests strictly via Git commits to ArgoCD repositories.
• Private API mesh: NetBird WireGuard peer connection to OKE private endpoint without public IP exposure.
• Least-privilege egress: Cilium egress network policies restrict cluster pods to explicit external domains.
• Automated PKI & Secrets: cert-manager + trust-manager for internal TLS, Infisical/OCI Vault synced via External Secrets Operator.

Technology

What to explore in a walkthrough

• Where the system runs today and which parts are production, development, or research.
• The architectural tradeoffs, failure modes, and tests behind these decisions.
• What AI agents contributed and how their output was reviewed.
• Operational evidence and measurable results available for review.

Project descriptions and experience are candidate-provided. This résumé's MCP tools are directly testable; other systems are available for an architecture walkthrough. Current and past employment positions and employers are private. Professional focus and target roles do not disclose a current job. Independent verification and references require direct contact.