Lab
Reference architectures and illustrations of how I design and secure delivery. These are explainers, not live systems; for real work, see the case studies.
Reference architectures
Every change passes static, dependency, and dynamic checks before an immutable, pinned artifact is promoted through GitOps.
Secure CI/CD pipeline
01
Commit
02
Build
03
Gates
04
Registry
05
Deploy
Security plane
Vault secrets · OIDC to cloud · No long-lived CI keys
DECISION 1
Gates fail closed: a report nobody reads isn't a control.
DECISION 2
The artifact tested in staging is byte-for-byte the one in production.
DECISION 3
CI never holds cluster credentials; GitOps pulls instead of CI pushing.
Secure delivery · select a stage
Stage 01 · Commit
Branch protection & secret scanning
Nothing reaches the default branch without review and passing checks. Secrets are caught before they enter history, because a leaked key in Git is leaked forever.
Try to break it
Choose an attack
Attack vector
A developer commits an AWS access key in a config file.
$ pipeline run --scenario leaked-secretHow commit stops it
Secret scanning on push rejects the commit before it reaches the default branch, so the key never enters shared history.
Skills map
ns/cloud
Cloud Infrastructure
ns/automation
DevOps & Automation
ns/security
DevSecOps & Security
ns/kubernetes
Kubernetes & Orchestration
ns/platform
Platform Engineering
ns/observability
SRE & Observability
$ kubectl describe argocd -n platform
argocd
Platform Engineering
GitOps delivery: Git is the only way into production, and drift is reverted.
GitOps delivery, reusable patterns, and engineering standards.
Each domain is explained in depth, with evidence, on the expertise page.
Free tool
A 28-point self-assessment across RBAC, workloads, network, supply chain, secrets, and detection.