Olivier Guandalini
ProjectsExperienceContact

DevOps · SRE · Platform engineering

Olivier Guandalini

DevOps and SRE engineer, I run critical infrastructure at scale: more than 400 Linux servers on-prem and Kubernetes clusters. On this site, the platforms I build on my own time, end to end: from Terraform to GitOps, SLOs and runbooks.

See the projectsMy experience
TLSwwwAWS · eu-north-1VPCSpot · 1aSpot · 1bNLBEKS 1.36Secrets ManagerState bucketPod IdentityGitHubInternet
GitOps, from gitTrafficSecrets

Projects

Two projects, each one finished before the next

Every repository can be cloned and run: a README to start in minutes, the decisions written down, the checks run on every change.

Hover or tap a tool to see what it is, and what it does here.

Finished

platform-eks-gitops

A Kubernetes platform developed on a laptop with k3d, then validated on AWS EKS. Argo CD installs every component from git, no secret lives in the repository, the demo API has SLOs with burn-rate alerts, and one command tears the AWS side down.

  • KubernetesOrchestrationRuns containers across a group of machines, restarts them when they fail, and spreads the traffic between them.HereThe platform runs on it twice, on k3d on a laptop and on EKS, at the same version.
  • TerraformInfrastructure as codeDescribes infrastructure as code: a plan shows what will change before anything is created or destroyed.HereCreates the VPC, the EKS cluster, its Spot nodes and IAM roles, 28 resources, then destroys them all.
  • AWS EKSCloudKubernetes managed by AWS: Amazon runs the control plane, the nodes run the workloads.HereTwo Spot nodes and no NAT Gateway: about $0.18 an hour, and make down leaves nothing that bills.
  • k3dOrchestrationA whole Kubernetes cluster in Docker containers, on a laptop: the same platform locally, for free.HereThe whole platform on a laptop, in under 5 minutes from a fresh clone.
  • Argo CDGitOpsKeeps the cluster in line with what git describes: to change the platform, you change the repository, not the cluster.HereOne manifest is applied by hand; Argo CD installs everything else from the repository, wave by wave.
  • Envoy GatewayTrafficThe way into the cluster, through the Gateway API: it routes HTTP and HTTPS traffic to the right service.HereThe single way in, over HTTPS, to Grafana and to the demo API.
  • External SecretsSecretsCopies secrets from a store such as Vault or AWS Secrets Manager into Kubernetes, so that none is written in git.HereReads Vault on k3d and AWS Secrets Manager on EKS: only the store changes between the two.
  • VaultSecretsThe secret store by HashiCorp: passwords, keys and certificates kept encrypted, with every access controlled and logged.HereThe secret store on k3d, in dev mode, standing in for AWS Secrets Manager.
  • PrometheusObservabilityCollects the metrics of every service over time, and evaluates the alerting rules on them.HereScrapes the demo API and evaluates the burn-rate rules of its SLOs.
  • GrafanaObservabilityDashboards over the metrics and the logs: what the platform is doing, at a glance.HereThe SLO dashboard, shipped with the application, behind the gateway.
  • SlothObservabilityTurns an SLO written in a few lines into the Prometheus rules and burn-rate alerts it needs.HereTwo SLOs of the demo API, availability and latency, become 6 groups of rules.
  • GitHub ActionsCI/CDThe CI of GitHub: on every pull request, it runs the checks, builds and scans what ships, and deploys it.HereThe 14 checks of the repository on every pull request; the image built, scanned by Trivy and published from main.
Take the guided tourRead the code on GitHub
~/platform-eks-gitops
$ make local-verify
checking the local platform:
  ok    Argo CD applications                       all applications healthy
  ok    gateway, HTTP listener                     listener answers (HTTP 404)
  ok    gateway, HTTPS listener                    TLS terminated, issuer CN=platform-local-ca
  ok    secret synced from Vault                   "stored in Vault, never in git"
  ok    Grafana behind the gateway                 reachable over HTTPS (HTTP 200)
  ok    demo API behind the gateway                answers through the gateway
  ok    demo API scraped by Prometheus             ServiceMonitor in place
  ok    SLO rules from Sloth                       6 rule groups generated by Sloth
  ok    SLO dashboard in Grafana                   dashboard shipped with the application

Measured from a fresh clone: 4 minutes 33 seconds until this check is all green.

Finished

portfolio-site

This site. Static pages in two languages, readable without script, checked on every pull request (links, types, Lighthouse at 90 or more), then deployed to GitHub Pages with a short-lived OIDC token rather than a stored key.

  • AstroWebA site generator: the pages are built once into static HTML and CSS, with no framework sent to the browser.HereEvery page of this site, in two languages, readable without script: it only drives the guided tour and reveals the blocks as they come into view.
  • TypeScriptLanguageJavaScript with types: a mistake, such as a missing translation, fails the build instead of reaching the page.HereThe words of every page are typed: a missing translation fails the build.
  • GitHub ActionsCI/CDThe CI of GitHub: on every pull request, it runs the checks, builds and scans what ships, and deploys it.HereLinks, types, the tour clicked through in Chrome and Lighthouse on every pull request, then the deployment.
  • GitHub PagesWebThe static hosting of GitHub: this site is published there on every merge, with no server to run.HereHosts this site, deployed with a short-lived OIDC token rather than a stored key.
  • LighthouseTestingThe page audit by Google: performance, accessibility, best practices and SEO, each scored out of 100.HereScores every page of each pull request, which fails if one falls under 90.
Read the code on GitHub