Kubernetes platforms
Cluster topology, namespace and RBAC models, ingress and certificate plumbing, autoscaling and node-pool sizing that survives a real traffic spike.
Platform Engineer · Kubernetes · GitOps · CI/CD
Delivery infrastructure that is boring on purpose.
I design and run Kubernetes platforms and GitOps delivery pipelines for teams shipping across several regions. My goal is simple: every change reaches production the same way, is reviewable in Git, and can be rolled back in one commit.
Focus areas
Four things I spend my week on
Different labels, one problem: shortening the distance between a merged pull request and a healthy workload in production.
GitOps delivery
Argo CD app-of-apps layouts, environment promotion through Git, Helm and Kustomize overlays that stay readable after the twentieth service.
Pipeline engineering
Shared Jenkins and GitLab CI libraries so a new service gets build, scan, sign and deploy on day one instead of copy-pasting someone else's YAML.
Reliability & cost
Golden signals, alerts people actually act on, and the unglamorous work of finding the idle node pool that costs more than the team's laptops.
How I think about it
The platform in four layers
Every tool below sits in exactly one layer. When something breaks, the layer tells you who owns the fix.
Deliverydeveloper-facing
Jenkins shared libsGitLab CI
Argo CDArgo Rollouts
Environment promotion
Platformshared services
Helm chartsKustomize
External Secretscert-manager
Ingress NGINXHarbor
Runtimewhere workloads live
KubernetesContainerd
PrometheusGrafana
LokiOpenTelemetry
Foundationcompute & network
TerraformAnsible
VPC & peeringObject storage
Managed databases
Current work
Where the interesting problems are
Multi-region GitOps
One control plane, several regional clusters, and a repository layout where the difference between Vietnam and Indonesia is a values file — not a fork.
Pipelines as a product
Treating CI/CD like an internal product: versioned shared libraries, a changelog, deprecation windows, and templates a team can adopt without asking me.
Supply chain hygiene
Image scanning, base-image refresh policies, secret management that keeps credentials out of Git, and least-privilege service accounts by default.
Trajectory
From servers to platforms
I started where most people in this field start — keeping machines alive — and gradually moved up the stack until the machines stopped being the interesting part. The through-line has always been the same: remove the manual step.
2019 — 2020
Linux & system administration
Bare-metal and VM fleets, Nginx, MySQL, backups, and the first scripts written purely out of impatience.
2021 — 2022
Containers & automation
Docker in production, Ansible for configuration, and the first CI pipelines that replaced a wiki page of deploy steps.
2023 — 2024
Kubernetes at work
Cluster operations, Helm packaging, monitoring stacks, and learning the hard way why resource requests matter.
2025 — now
GitOps & platform engineering
Argo CD control planes, multi-region delivery, shared pipeline libraries, and treating the platform as something with users.
Working method
Four rules I keep coming back to
Git is the source of truth
If cluster state cannot be reconstructed from a repository, it is not infrastructure — it is a souvenir.
Automate the second time
Do it manually once to understand it. Automate it the second time, before the shape of the problem is forgotten.
Make rollback cheap
A deploy is only as safe as its reverse. Cheap rollback buys the confidence to ship on a Friday.
Write it down
A runbook someone else can follow at 3am is worth more than a clever fix only I understand.
Latest writing
All posts →
Notes from the platform
- 2026-08-12 Running GitOps across four regions without four forks A repository layout where regional differences live in values files, and the control plane stays one Argo CD.
- 2026-06-28 Shared Jenkins libraries that teams actually adopt Versioning, deprecation windows, and why a pipeline library needs a changelog like any other product.
- 2026-05-09 Resource requests are a capacity plan, not a guess How badly-set requests quietly double a cluster bill, and a simple loop for correcting them.
Working on delivery or platform problems?
Happy to compare notes on Kubernetes, GitOps layouts, or CI/CD that has outgrown its YAML.