I build production-realistic infrastructure and Kubernetes-native platforms — with security baked in from day one, not bolted on afterward. Lately that includes the platform layer for LLM and RAG workloads: vector databases, self-hosted model serving, and GPU-ready infrastructure.
- Platform Engineering — designing Kubernetes platforms that other engineers can actually build on top of (GitOps, self-service, sane defaults)
- AI Platform Engineering — running LLM and RAG workloads as first-class Kubernetes citizens: vector storage with Qdrant and pgvector, self-hosted model serving with Ollama, vLLM and KServe, a unified LiteLLM gateway in front of models, and NVIDIA GPU / CUDA-aware infrastructure
- DevSecOps — shift-left scanning, admission control, and runtime security as a standard part of every deployment pipeline, not an afterthought
- Infrastructure as Code — Terraform-first, cost-conscious, reproducible environments
- Cloud-native Architecture — event-driven systems, autoscaling, and observability on Kubernetes
- Software Supply Chain Security — SBOM generation, image signing, and artifact verification with Syft & Cosign
I learn best by building real, end-to-end systems rather than isolated tutorials — every repo below runs on a live cloud environment, gets destroyed and rebuilt, and is intentionally over-engineered on the security side because that's the part most portfolios skip.
Most AI demos stop at a notebook. I focus on what comes after: how an LLM-powered application is actually deployed, secured, and operated in production.
- RAG pipelines — document ingestion, embedding, vector retrieval, and grounded generation, deployed as regular Kubernetes workloads
- Vector databases — Qdrant for dedicated vector search, pgvector for keeping embeddings next to relational data in PostgreSQL
- Self-hosted model serving — Ollama for quick local inference, vLLM for high-throughput serving, KServe for Kubernetes-native model deployment and scaling
- LLM gateway — LiteLLM as a single OpenAI-compatible entry point in front of self-hosted and external models
- GPU infrastructure — NVIDIA GPU scheduling on Kubernetes and CUDA-aware runtime setup
- Security & operations first — secrets from Vault, NetworkPolicies, ResourceQuotas, and GitOps delivery apply to AI workloads exactly as they do to any other service
| Project | What it demonstrates |
|---|---|
| ai-platform-lab | AI platform on Kubernetes (K3s) delivered via GitOps: Argo CD + Helm, a RAG backend with Qdrant and PostgreSQL, secrets injected by Vault Agent Injector, NetworkPolicies and ResourceQuotas, and a CI pipeline publishing images to GHCR |
| jenkins-security-lab | Jenkins CI with dynamic K8s agents feeding a full software supply-chain security pipeline: Checkov IaC scanning, Kaniko rootless builds, Syft SBOM generation, Trivy CVE gating, Cosign signing & attestation, Kyverno enforce-mode admission control, Falco runtime monitoring, Velero+MinIO backups — all local-first on kind |
| kafka-and-security-lab | Event-driven architecture (Kafka + KEDA) on AKS with a full DevSecOps pipeline: Trivy, Checkov, Kyverno, Falco, Velero, GitOps via ArgoCD |
| k8s-gitops-lab | GitOps workflow with Helm & ArgoCD on Kubernetes |
| k8s-operator-lab | Production-style Kubernetes Operator: CRD, reconciliation loop, OwnerReferences |
| vault-cicd-lab | HashiCorp Vault + GitHub Actions — secrets management and CI/CD integration on Kubernetes |
| observability-lab | Terraform + Ansible provisioned k3s with Prometheus, Grafana, Loki, and SLI/SLO/SLA implementation |
| terraform-lab | Azure infrastructure as code with Terraform, PostgreSQL |
Languages & OS
Cloud
Containers & Orchestration
AI & LLM Infrastructure
CI/CD & GitOps
IaC & Configuration Management
Observability
Security & Compliance
Data & Messaging
Backup & DR