A bit about myself
25+ years in IT — from networks and Windows infrastructure to Kubernetes security and cloud engineering. CKA and CKS certified, AWS Solutions Architect Professional, with deep hands-on experience in cluster hardening, DevSecOps pipelines, supply chain security, and offensive security. I build infrastructure that does not get pwned. Based in Tel Aviv.
Infrastructure & Security
Platform Engineering
3-node kubeadm cluster · Calico CNI · containerd · k8s v1.35
$ kubectl get pods -n production web-7d9f8b-xk2p 1/1 Running api-6c8df9-m3nw 1/1 Running HPA min:2 max:10 cpu:42% PDB minAvailable: 1
K8s Production Patterns
Production-grade manifests — default-deny NetworkPolicy, least-privilege RBAC, zero-downtime RollingUpdate, HPA with scale-down stabilization, PDB, and a full Helm chart.
GitHub$ kubectl get networkpolicies -A default default-deny-all default allow-dns-egress production allow-ingress-nginx PSA: restricted · audit: on
K8s Security Hardening
Zero-trust network segmentation, least-privilege RBAC, Pod Security Admission, API server audit policy, and custom seccomp profiles — all on a physical kubeadm cluster.
GitHub$ kubectl get prometheusrule -n monitoring homelab-custom-alerts Active NodeMemoryPressureHigh EtcdHighCommitDuration PodCrashLooping
K8s Observability Stack
kube-prometheus-stack tuned for a RAM-constrained homelab — custom PrometheusRule CRDs for node, etcd, and pod-lifecycle alerts. Alertmanager routing with push notifications.
GitHub$ argocd app list app-of-apps Synced Healthy production-workloads Synced Healthy monitoring-stack Synced Healthy selfHeal: on prune: on
GitOps — ArgoCD Homelab
Full GitOps setup using App of Apps. AppProject with source/destination restrictions, per-application selfHeal policies, ArgoCD RBAC mapped to identity provider groups.
GitHub$ terraform plan -out=eks.tfplan + aws_eks_cluster.main endpoint_public_access = false kms_key_id = alias/eks-key http_tokens = "required" # IMDSv2
Terraform AWS EKS Secure
Modular Terraform for a hardened EKS cluster — private API endpoint, KMS secrets encryption, IMDSv2 enforced, IRSA for pod-level IAM, S3 + DynamoDB remote state.
GitHub$ ./etcd/backup.sh Snapshot saved: etcd-20260519.db Verified: hash OK size: 4.2MB $ ./rbac-audit/find-clusteradmin.sh 2 bindings found — review needed
K8s Incident Response
Operational runbooks for a live cluster — etcd backup/restore, certificate expiry checks, node isolation scripts, Falco alert triage playbook, and RBAC overprivilege auditing.
GitHub$ ip link show vxlan.calico vxlan.calico: mtu 1450 UP # Cilium tested — OOM killed host # reverted to Calico VXLAN podCIDR: 10.244.0.0/16
K8s Networking Deep Dive
Calico VXLAN config, multi-tier NetworkPolicies, CoreDNS customization, ingress-nginx on bare metal. Honest post-mortem on a Cilium migration attempt that OOMed the control plane.
GitHubFrontend & Apps
Applications
Bybit Trading Dashboard
Real-time cryptocurrency trading interface. Multi-order management, live portfolio tracking, authenticated session handling, and order book visualization via Bybit REST API.
GitHub
Jacob Skate Co.
Full e-commerce storefront in React 18 and TypeScript. Full-viewport hero carousel, product grid, cart management, dark/light theme — 30+ components, zero UI library dependencies.
GitHub
SAP-C02 Study Tracker
Per-lesson gap analysis for Adrian Cantrill's AWS Pro course. Flags post-2021 service changes with OUTDATED / GAP / EXTRA tags. Supplements sorted inline so you study the delta at exactly the right time.
GitHubVerified Credentials
Certifications
Amazon Web Services
Get In Touch