Cloud-native infrastructure and SaaS platform engineering. Building production-grade systems on Azure with Kubernetes, Terraform, and GitOps.
Multi-tenant fleet management SaaS platform built end-to-end on Azure — from infrastructure to application layer.
| Layer | Stack |
|---|---|
| Infrastructure | Azure AKS · Terraform modular (7 modules) · Azure Blob remote state |
| GitOps | ArgoCD · pull-based · auto-sync · self-heal · drift detection |
| CI/CD | GitHub Actions · Trivy SAST · ACR push · automated GitOps tag update |
| Application | FastAPI (Python 3.12) · PostgreSQL StatefulSet · multi-tenant JWT auth |
| Secrets | Azure Key Vault · CSI Secrets Store · VM Managed Identity · zero secrets in YAML |
| Observability | Prometheus · Grafana · Log Analytics Workspace · Azure Monitor Agent |
| Security | Microsoft Sentinel · 3 KQL scheduled rules · brute force · privilege escalation · kubectl exec detection |
| Networking | ingress-nginx · cert-manager · Let's Encrypt TLS · Azure Load Balancer |
| Identity | Microsoft Entra ID · RBAC least-privilege · Managed Identities · custom Terraform role |
Repos: fleetops · fleetops-gitops
- GitOps as single source of truth — Git state drives cluster state. Manual
kubectlchanges are reverted on next ArgoCD reconciliation cycle. - Zero secrets in code — no credentials in YAML, Docker images, or Git history. Key Vault + CSI driver handles all secret injection at runtime.
- Least privilege by default — every identity (Managed Identity, Terraform SP, AKS node pool) holds only the minimum roles required. Assigned and auditable via Terraform.
- Immutable artifacts — Docker images tagged by commit SHA, never
latest. ACR as the single source for all deployments. - Observability as code — Grafana dashboards persisted as JSON in GitOps repo. Sentinel KQL rules managed declaratively.
Kubernetes: AKS 1.35 · ArgoCD · ingress-nginx · cert-manager · Helm · HPA · StatefulSet · PVC
IaC: Terraform modular · Azure Blob remote state · CI/CD gated apply
CI/CD: GitHub Actions · Trivy · ACR · GitOps tag automation
Azure: AKS · ACR · Key Vault · Managed Identity · Entra ID · Log Analytics · Microsoft Sentinel · Azure Load Balancer · Azure Disk
Application: FastAPI · PostgreSQL · Python 3.12 · JWT · Prometheus metrics
Security: Microsoft Sentinel · KQL · RBAC · CSI Secrets Store · encryption at rest