Kubernetes
25+
AKS / EKS clusters operated across environments
Senior Cloud Engineer · Platform Engineering
CLOUD / KUBERNETES / AUTOMATION / RELIABILITY
I engineer cloud platforms
that survive production.
Senior Cloud Engineer focused on Kubernetes, cloud architecture, infrastructure automation, networking, security, observability, FinOps and AI infrastructure.
Azure
AWS
Kubernetes
Terraform
Python
DevOps
SRE
AI Infrastructure
$ whoami
Senior Cloud Engineer building and operating distributed cloud platforms.
$ focus --current
Kubernetes · Cloud Architecture · Reliability · Security · Automation
$ scale --environment
25+ clusters · 500+ microservices · 1,000+ databases · 100+ VMs
$ _
01 / PRODUCTION SCALE
Engineering at real infrastructure scale
My work sits where application platforms, infrastructure, networking, security and operations meet.
Microservices
500+
Distributed workloads running across production platforms
Databases
1,000+
Azure SQL, Cosmos DB, RDS, MongoDB and PostgreSQL
Compute
100+
Azure and hybrid virtual machines
Reliability
99.99%
Availability / SLO-oriented platform engineering
MTTR
-35%
Faster incident resolution through automation and observability
Cloud cost
-25%
FinOps controls and workload-level optimization
Security
72 → 92
Microsoft Secure Score improvement
02 / ENGINEERING DOMAINS
Systems I engineer
The emphasis is not on collecting tools. It is on understanding how distributed systems behave under normal load, failure, change and operational pressure.
Kubernetes & Platform Engineering
Designing, operating and upgrading production Kubernetes platforms with attention to networking, scheduling, workload availability and operational safety.
- AKS / EKS
- Azure CNI / Cilium
- Helm / KEDA / HPA
- NetworkPolicy
- Cluster upgrades
- Workload disruption control
Cloud Networking
Building private, controlled connectivity between workloads, cloud services, data platforms and enterprise networks.
- Hub-and-spoke
- Private Endpoints
- NSGs
- Azure Firewall
- ExpressRoute
- DNS / routing
Infrastructure as Code
Treating infrastructure as versioned software with repeatability, policy enforcement, environment isolation and controlled change.
- Terraform
- Bicep
- Ansible
- Policy as Code
- State management
- CI/CD automation
Observability & SRE
Connecting metrics, logs, traces and service behaviour to actionable incident investigation.
- Grafana / Loki
- Datadog
- Azure Monitor
- Application Insights
- Prometheus
- OpenTelemetry
Cloud Security
Embedding security controls into platform architecture rather than treating security as a separate downstream activity.
- RBAC
- Azure Policy
- Defender
- Vulnerability remediation
- Secure Score
- Governance
FinOps & Cloud Economics
Connecting cloud consumption to business units, workloads, transactions and operational decisions.
- Cost anomaly detection
- Chargeback
- Unit economics
- Idle-resource detection
- Azure Cost Management
- Automation
AI Infrastructure
Exploring the infrastructure boundary between Kubernetes, AI workloads, agents, observability and cloud platforms.
- AI agents
- Kubernetes automation
- RCA pipelines
- AI platform architecture
- GPU / HPC networking
- Intellikube
Production Operations
Designing operational processes around failure, change, incident response, upgrades and repeatable remediation.
- Incident response
- Root cause analysis
- Patch automation
- Change management
- Runbooks
- Postmortems
03 / ARCHITECTURE
How I think about platform architecture
Production platforms are systems of dependencies. The engineering challenge is understanding where control belongs, how failures propagate and which boundaries reduce blast radius.
01
Application layer
Where business workloads meet the platform.
Microservices
↓
API / Service
↓
Data / Messaging
Engineering concern
The platform should provide safe defaults without hiding the operational characteristics of the workload.
02
Kubernetes layer
Scheduling, networking and workload lifecycle.
Ingress
↓
Service
↓
Pods
↓
Node Pools
Engineering concern
Availability depends on more than pod replicas. Scheduling, PDBs, node capacity, autoscaling, network policy and upgrade strategy all interact.
03
Network layer
Connectivity, isolation and traffic control.
Application
↓
CNI / Cilium
↓
NSG / Firewall
↓
Private Endpoint
↓
Managed Service
Engineering concern
A connectivity problem is not automatically an application problem. DNS, routing, security policy, endpoint state and identity must be separated during diagnosis.
04
Cloud foundation
Governance, identity and infrastructure boundaries.
Management Group
↓
Subscription
↓
Resource Group
↓
Workload
Engineering concern
Governance should be enforced at the highest sensible boundary while leaving teams enough autonomy to operate their workloads.
05
Security layer
Preventive, detective and corrective controls.
Policy
→
Detection
→
Remediation
→
Validation
Engineering concern
Security automation should close the loop: detect, validate, remediate, verify and retain evidence.
06
Observability layer
Turning system behaviour into operational evidence.
Logs
+
Metrics
+
Traces
↓
Incident decision
Engineering concern
Observability is valuable when it shortens the path from symptom to evidence to decision.
04 / ENGINEERING EVIDENCE
Engineering case studies
Selected work explained through the engineering problem, mechanism, decisions, failure modes and outcome.
AKS platform engineering and upgrades
Operating and upgrading production AKS environments while controlling workload disruption, capacity and compatibility.
Scale
25+ clusters
Workloads
500+ services
Focus
Reliability
Problem
Kubernetes version upgrades introduce simultaneous risks across node pools, workload scheduling, networking, admission controls and application compatibility.
Engineering approach
- Staged upgrades by environment.
- Controlled node surge capacity.
- Validated workload health before progression.
- Monitored scheduling and disruption behaviour.
- Used rollback and escalation criteria.
Key trade-off
Higher surge capacity reduces upgrade duration but increases temporary infrastructure demand. The correct setting depends on workload density, node capacity and disruption tolerance.
Azure Landing Zone governance
Designing cloud foundations around management groups, RBAC, subscription boundaries, policy enforcement and network architecture.
Architecture
Management Group
→
Subscription
→
Resource Group
→
Workload
Engineering decisions
- Centralized guardrails for mandatory controls.
- Delegated ownership for workload teams.
- RBAC boundaries aligned with operational responsibility.
- Policy inheritance used for consistent enforcement.
- Network boundaries designed around trust zones.
Architectural principle
Centralize what must be consistent. Delegate what must remain close to the workload.
Vulnerability remediation pipeline
Turning vulnerability findings into a repeatable validation, remediation and verification workflow.
Scanner exports
↓
Storage
↓
Python validation
↓
Ansible remediation
↓
Verification
Engineering challenge
Large vulnerability inventories contain duplicates, unreachable targets, unsupported systems and findings that require different remediation paths.
Automation strategy
- Normalize incoming findings.
- Validate target state before remediation.
- Separate eligible from unsupported systems.
- Apply staged remediation.
- Re-check the resulting state.
Cloud cost anomaly detection
Building a cost monitoring workflow around daily anomaly detection, chargeback and workload-level economics.
>20%
Daily anomaly threshold
Engineering model
Cloud cost
→
Ingestion
→
Analytics
→
Anomaly
→
Action
Why it matters
Cost becomes more actionable when it can be attributed to a customer, API call, transaction, platform or workload rather than treated as a single monthly cloud bill.
Centralized Kubernetes logging
Centralizing Kubernetes logs through Loki and Alloy while integrating platform telemetry with wider operational tooling.
Pipeline
Pod logs
→
Alloy
→
Loki
→
Grafana
→
SIEM
Operational objective
Reduce the time engineers spend moving between clusters, namespaces and logging systems during incidents.
Observability principle
Collecting telemetry is not the objective. Reducing uncertainty during an incident is.
Intellikube
An experimental Kubernetes intelligence platform focused on predictive detection, investigation, root-cause analysis and post-incident reporting.
01
Detect
02
Investigate
03
Correlate
04
Explain
05
Report
Design question
Which parts of Kubernetes diagnosis should remain deterministic and which parts benefit from an AI reasoning layer?
Architecture direction
- Kubernetes-native signals.
- Structured investigation context.
- Evidence collection before reasoning.
- RCA and postmortem generation.
- Human review for operational actions.
Multi-cloud landing zone
Terraform-based cloud foundation covering AWS, Azure and GCP with policy, networking, identity and environment boundaries.
AWS
Azure
GCP
Engineering themes
- Environment separation.
- Terraform state boundaries.
- Policy as Code.
- IAM and network controls.
- Reusable platform modules.
05 / INCIDENT ENGINEERING
How I troubleshoot production systems
Good troubleshooting is a process of reducing uncertainty. Start with symptoms, form hypotheses, collect evidence and eliminate possibilities.
INCIDENT WALKTHROUGH
SEV-2
Application cannot reach a private database
01
Symptom
Application requests begin timing out.
02
Hypothesis
Separate application, DNS, routing and security possibilities.
03
Evidence
Inspect pod state, DNS resolution, routes, network policy and endpoint configuration.
04
Root cause
Identify the first layer where expected behaviour diverges.
05
Remediation
Correct the underlying control and validate end-to-end.
kubectl
kubectl get pods -A -o wide
Confirm workload state, node placement and restart behaviour.
kubectl
kubectl get networkpolicy -A
Check whether Kubernetes-native traffic controls are involved.
Azure
az network private-endpoint-connection list
Validate private endpoint connection state.
DNS
nslookup database.private.endpoint
Separate DNS failure from downstream connectivity failure.
06 / ARCHITECTURAL REASONING
Decisions matter more than tool lists
Senior engineering is often about choosing between imperfect options under operational, security and business constraints.
Centralized governance vs team autonomy
Constraint
Security and compliance controls must be consistent.
Decision
Enforce mandatory controls centrally while delegating workload-specific ownership.
Availability vs deployment speed
Constraint
Platform upgrades must finish quickly without unnecessary workload disruption.
Decision
Use staged rollout, capacity planning and explicit disruption controls.
Automation vs uncontrolled blast radius
Constraint
Manual remediation does not scale, but unrestricted automation can amplify mistakes.
Decision
Validate eligibility, execute in stages, verify results and preserve evidence.
AI reasoning vs deterministic controls
Constraint
AI can explain complex system behaviour but should not blindly control production infrastructure.
Decision
Collect structured evidence deterministically and use AI as a reasoning and explanation layer.
07 / FAILURE ENGINEERING
What can go wrong?
Production engineering is incomplete if the design only describes the happy path.
Kubernetes upgrade
Node drain causes workload disruption because replicas, topology and PDB constraints were not considered together.
Mitigation Preflight checks + staged upgrade + workload validation.Private connectivity
Application resolves the wrong address or cannot route to the private endpoint.
Mitigation Validate DNS, routes, endpoint state and policy independently.Terraform drift
Manual cloud changes create divergence between declared and actual infrastructure.
Mitigation Detect drift, review plans and restore controlled ownership.Security automation
Automation remediates a system that should have been excluded or requires a different remediation path.
Mitigation Eligibility validation + allowlists + staged remediation.08 / EXPERIENCE
Production experience
01
Senior Cloud Engineer
CURRENT Nov 2024 — Present
Equity Group Holdings / Equity Bank Kenya
- Engineer cloud and Kubernetes platforms supporting large-scale distributed workloads.
- Design and operate Azure Landing Zone governance, networking, identity and security controls.
- Operate 25+ AKS/EKS clusters supporting 500+ microservices.
- Support infrastructure spanning 1,000+ databases, 150+ storage accounts and 100+ VMs.
- Automate vulnerability remediation, infrastructure provisioning and operational workflows.
- Build observability and FinOps capabilities to improve reliability, incident response and cloud economics.
02
Cloud Platform / Infrastructure Engineer
2024
E&M Technology House
- Built and supported AWS-based application platforms and Kubernetes workloads.
- Managed EKS deployments using Helm and Terraform.
- Automated migration, deployment and operational workflows.
- Improved deployment speed and reduced manual release work.
03
Software Engineer
2022 — 2024
E&M Technology House
- Developed Java and Spring Boot microservices and REST APIs.
- Worked with messaging and financial integration patterns.
- Built applications that later became part of cloud-native deployment and platform workflows.
09 / CREDENTIALS
Certifications
AWS Certified DevOps Engineer – Professional
AWS
AWS Certified Solutions Architect – Professional
AWS
Certified Kubernetes Administrator
Linux Foundation / CNCF
AWS Certified Security – Specialty
AWS
AWS Certified Solutions Architect – Associate
AWS
Microsoft Azure Administrator Associate
Microsoft
FinOps Certified Engineer
FinOps Foundation
FinOps Certified Practitioner
FinOps Foundation
ITIL 4
PeopleCert
Aviatrix Certified Engineer
Aviatrix