worklog
Project log
A living record of infrastructure work, projects, and things I built or figured out.
Bootstrapping a GKE platform for shared GitLab CI runners
2025-05-01
How I set up a GKE cluster from scratch in europe-west3 to host shared GitLab CI/CD runners for the organization, including Workload Identity, Node Auto Provisioning, and IAP-based jump host access.
Migrating from managed node groups to Karpenter on EKS
2025-03-10
Replaced managed node groups with Karpenter for cost-driven autoscaling. Consolidation mode cut idle compute by ~30%.
External Secrets Operator with GCP Secret Manager
2025-01-20
Wired External Secrets Operator to GCP Secret Manager using Workload Identity — no static keys, secrets sync on schedule.
Multi-tenant GitOps with FluxCD across shared clusters
2024-12-01
Structured Flux tenancy so each team owns their namespace resources while platform team retains cluster-scope control.
Long-term metrics storage with Thanos Sidecar
2024-09-15
Extended Prometheus retention from 2 weeks to 13 months by adding Thanos Sidecar, remote object storage, and a Thanos Query layer.
Internal Terraform module for opinionated EKS clusters
2024-06-01
Wrapped the upstream EKS module with org defaults — VPC layout, IRSA, Karpenter, add-ons — so teams provision clusters via a single module call.