Projects

14 projects · 2017 – today

  1. 2025Now

    Public sector / banking · Platform Architect

    12/2025 – 12/2026

    Identity and security across a cloud platform

    Central authentication, signed container images and clear rules for managing operators form the security foundation of a managed OpenShift platform spanning public and private clouds.

    • Users sign in to Azure Red Hat OpenShift through the organisation's central access management system.
    • Filtered group claims map to native OpenShift groups and ClusterRoleBindings. Four approaches were evaluated, with the chosen authorisation model documented in an architecture decision record.
    • The OIDC rollout covered all ARO clusters, supported by a runbook, a checklist for each cluster and an onboarding template for business units.
    • ImagePolicy at the CRI-O layer verifies image signatures using a separate Cosign key for each tenant, including in air-gapped environments.
    • A reference signing pipeline in GitLab CI/CD integrates with Vault for key management.
    • Four on-premises OpenShift clusters on vSphere underwent a coordinated upgrade, using the Artifactory mirror as the trust boundary.
    • A governance framework covers more than 30 operators across 10 clusters and 8 vendors, with classification, lifecycle states, a RACI matrix and a decommissioning process.
    • A central CA trust store uses Vault as its source, with certificates distributed through External Secrets Operator and trust-manager.
    Red Hat OpenShiftAzure Red Hat OpenShiftVMware vSphereArgoCDRed Hat ACMHelmHashicorp VaultExternal Secrets Operatortrust-managerCert-ManagerOpenID ConnectOAuth 2.0CosignSigstoreCRI-OOpenShift Service MeshGitLab CI/CDJFrog ArtifactoryOperator Lifecycle Manager+13 more

  2. Public sector · DevSecOps Architect

    06/2025 – 12/2026

    Core services for a multi-tenant container platform

    Multiple development teams share a container platform, but routine deployments should not depend on support tickets. A catalogue of core services on Azure Red Hat OpenShift lets teams manage those deployments through GitOps. The work later expanded to centralised identity management, a common test framework and reliable delivery pipelines.

    • Azure DevOps pipelines provision production services on ARO clusters, while Terraform provisions the network and storage resources they need.
    • The ArgoCD service provides GitOps workflows for development teams, with Cert-Manager handling TLS certificate renewal for each instance.
    • A shared service built on Azure Entra ID and Keycloak centralises authentication for all workloads.
    • Harbor and Red Hat Marketplace support the software supply chain, while Vault manages passwords and certificates in the clusters.
    • Training and coaching help operations teams and customers use ArgoCD, Cert-Manager and Helm in their daily work.
    • The identity architecture positions Vault as a central OIDC broker that resolves group membership and issues consistent RBAC claims. The design is documented in an architecture decision record.
    • Administrative single sign-on uses MFA, a phased rollout and emergency access procedures for production. The MFA design was assessed against GDPR Article 32 and BSI IT-Grundschutz requirements in consultation with the organisation responsible for the government identity system.
    • Terraform and OpenTofu manage identities as code, using a two-level group and permissions model based on the existing Entra ID structure.
    • Delivery pipelines moved from Azure DevOps to GitLab CI/CD, with parent-child pipelines, centralised state and locking for multi-tenant use.
    • A common test framework, approved by operations, covers 23 core services. It is deployed through GitOps as a Helm chart using an ArgoCD ApplicationSet.
    • Co-maintainer responsibilities include the operational and security architecture of a production service, along with the trust store used in shared Tekton pipelines.
    • Templates define operational and documentation standards for three deployment models. The work also includes providing DevSecOps guidance within a cross-team working group.
    Red Hat OpenShiftAzure Red Hat OpenShiftAzure CloudAzure Entra IDAzure DevOpsGitLab CI/CDTektonArgoCDHelmKustomizeKeycloakHashicorp VaultOpenID ConnectOAuth 2.0MFA (TOTP)TerraformOpenTofuAnsibleJinja2Cert-ManagerExternal Secrets OperatorOpenShift Service MeshHarborRed Hat MarketplaceApache KafkaConfluent Control CenterBSI IT-GrundschutzGDPR+22 more

  3. Public sector / justice · Platform Architect

    01/2025 – 12/2025

    Evaluating a platform for isolated networks

    OpenShift was evaluated as a platform for security-critical applications in fully isolated networks. Technical testing, cost modelling and risk assessment provided the evidence for a decision on whether and how to move towards production.

    • The Hyper-V cluster architecture follows BSI IT-Grundschutz requirements and CIS benchmarks.
    • Ignition and Butane configure bootstrap, control-plane and worker nodes, with provisioning automated through Bash and Ansible.
    • Hardened RHCOS virtual machines integrate with the required storage, DNS and DHCP services.
    • The network design covers segmentation, routing and firewall rules, with highly available HAProxy load balancers.
    • An assessment of the existing container and virtualisation environment identifies migration options and integration requirements.
    • Performance and failover tests use oc, kubectl, kube-bench and kube-burner, with results analysed in Prometheus and Grafana.
    • Cost and capacity models compare licensing, hardware and operational requirements across three deployment sizes.
    • A feasibility study sets out the risks, compliance gaps and service-level requirements for the CIO board.
    • A phased rollout plan describes the path from pilot to production, including staffing needs and governance.
    • A design and proof of concept assess integration with existing monitoring, logging and SIEM systems using PRTG, Elasticsearch and Alertmanager.
    • GitLab and Harbor were assessed for production readiness and migrated to a revised Docker Compose and Hyper-V architecture using Ansible.
    Red Hat OpenShiftRed Hat CoreOSHyper-VHAProxyPrometheusGrafanaPRTGElasticsearchBashAnsibleGitLabGitLab GeoKubernetesPodmanPodman ComposeHarborApache HTTPDIgnitionButaneockubectlopenshift-installCoreDNSOAuth 2.0Red Hat MarketplaceDocker Composekube-benchkube-burnerAlertmanagerBSI IT-GrundschutzCIS Benchmarks+25 more

  4. E-commerce · Enterprise AI Architect

    01/2025 – 11/2025

    A self-hosted environment for practical AI

    An e-commerce company wanted to explore AI while retaining control of its data. A self-hosted lab brought open-source models and workflow tools into one environment for testing use cases, assessing costs and helping developers get started.

    • Ragflow, n8n, Ollama and OpenWebUI run together under Docker Compose.
    • Ollama serves open-source language models, with model downloads and updates automated during setup.
    • Python and Bash scripts automate user management and onboarding, giving new developers access within minutes.
    • The environment runs on hardened Hetzner Cloud infrastructure, with Traefik as a reverse proxy, Cloudflare at the edge and Tailscale for private connectivity.
    • Development, staging and production options each have a budget and an estimate of return on investment.
    • The proposed approach was presented to management and other decision-makers with a live demonstration.
    • Proof-of-concept workflows in n8n and Ragflow demonstrate practical use cases.
    • Workshops introduce development teams to the tools and workflows.
    • Prometheus, Grafana and Loki provide monitoring and logging from the outset.
    Ragflown8nOllamaLMStudioOpenWebUIOpenAIClaudeGeminiCodexTraefikDockerDocker ComposePrometheusGrafanaLokiGitHubAnsibleTaskfileBashPythonJinja2MySQLMinIORedisElasticsearchPortainer+20 more

  5. 2024

    Banking / public sector · Staff Platform Engineer

    06/2024 – 03/2025

    Developing the platform behind daily operations

    OpenShift environments in public and private clouds needed ongoing development as well as operational support. The work covered deployment automation, security integration, observability and repeatable upgrades, alongside training for internal teams.

    • GitLab CI/CD and Ansible automate platform configuration through infrastructure as code.
    • OpenShift clusters were enhanced to meet availability, performance and security requirements, including BSI standards.
    • Training, workshops and coaching help internal teams build their skills in cloud technologies, Kubernetes and OpenShift.
    • GitOps workflows automate application versioning, deployments and rollbacks.
    • A Python application synchronises tenant data with Red Hat Advanced Cluster Security to support consistent security policies.
    • OpenTelemetry and Dynatrace provide observability, with dashboards and alerts for operations teams.
    • A common update and patching process automates testing and deployment for clusters and platform components.
    • Ansible and GitLab CI/CD provide a test framework for OpenShift clusters running on VMware.
    Red Hat OpenShiftKubernetesRed Hat Advanced Cluster SecurityOpenTelemetryDynatracePythonGitGitLab CI/CDAzure CloudAnsiblePrometheusGrafanaDockerLinuxArgoCDVMware vSphereBSI IT-Grundschutz+11 more

  6. 2023

    E-commerce · Head of DevOps

    06/2023 – 08/2024

    Building an e-commerce platform and its team

    Building a multi-cloud platform for an online shop also meant building the team to run it. The engagement combined Kubernetes architecture and deployment automation with the creation of a Platform & DevOps department.

    • The platform architecture spans Kubernetes on Hetzner Cloud and the Plusserver Kubernetes Engine.
    • Project management covers resourcing, budgets, service providers and architectural decisions.
    • The Platform & DevOps department was built and led with a team of ten or more people.
    • Dockerfiles package Java Spring Boot and Python Flask applications into containers.
    • GitLab CI/CD pipelines test the online shop's applications and build container images, with Gradle handling the Java builds.
    • Terraform provisions and initialises infrastructure, including Kubernetes and ArgoCD.
    • ArgoCD automates deployments, while Helm charts define applications and supporting services such as Kafka, Solr, Cert-Manager and Nginx.
    • Prometheus and Grafana monitor the systems, with alerts routed through PagerDuty.
    • OpenSearch and Fluent Bit collect and process logs.
    • Vault synchronises credentials, certificates and passwords, while Google Cloud Storage distributes protected configuration files.
    • Keycloak provides authentication and role-based access to critical systems.
    • A Kafka cluster supports asynchronous messaging.
    • The backup strategy uses Ansible, MinIO and Restic on dedicated Hetzner servers.
    JavaSpring BootGitLabGitLab CI/CDGitLab Container RegistryTerraformGoogle CloudGoogle Cloud StorageDockerPrometheusGrafanaOpenSearchFluent BitKubernetesPlusserver Kubernetes EngineApache KafkaSolrCert-ManagerNginxGradlePythonFlaskArgoCDHelmHashicorp VaultKeycloakAnsibleMinIOResticHetzner CloudPagerDuty+25 more

  7. 2022

    Public sector · Senior Cloud Consultant

    12/2022 – 07/2023

    Self-service foundations in a private cloud

    Development teams needed a repeatable way to provision environments in a private cloud. The work combined automated virtual machine provisioning, a DNS management API and consistent build and release workflows.

    • A GitLab pipeline provisions virtual machines for development teams using Ansible, Bash and PowerShell.
    • A Python FastAPI application creates and updates DNS zone files, with OAuth protecting access.
    • The API is packaged as a Docker container and deployed through GitLab CI/CD and Puppet.
    • Network topologies define how services are connected within the VMware environment.
    • Ansible and Bash automate the management and updating of Squid proxies used for external connectivity.
    • Unit tests verify key modules in containerised Java Spring Boot applications during the build.
    • Terraform and Ansible provision and initialise infrastructure.
    • Build, release and deployment workflows automate application versioning and delivery.
    • Selenium tests verify the Next.js platform's user interface.
    PythonFastAPIJavaSpring BootGitLab CI/CDAnsiblePuppetBashPowerShellDockerTerraformRed Hat Enterprise LinuxWindows ServerVMware vSphereNext.jsSeleniumGitHub ActionsSquidOAuth 2.0+13 more

  8. 2021

    Financial services · Senior Platform Engineer (Cloud)

    11/2021 – 12/2022

    Connecting cloud delivery with operational data

    Cloud operations depend on accurate data as well as reliable deployments. For a financial-services platform, APIs and automation connected application delivery with infrastructure records, patching documentation and notifications. Python, Ansible and Azure DevOps supported the workflows.

    • A Flask REST API processes existing and new records in PostgreSQL.
    • Dockerfiles and Azure DevOps pipelines build and deploy the API to Azure Container Instances.
    • Ansible and Jinja2 generate documentation for infrastructure updates and patching procedures.
    • Terraform provisions Azure Key Vault secret stores as infrastructure as code.
    • AKS clusters were configured and migrated using Helm charts.
    • Automated notifications report the start, progress and completion of patching, using cluster and customer records from the SQL-based configuration management database.
    • Python synchronises customer records between Azure DevOps repositories and the configuration management database.
    • A shared Docker base image provides the tools used by Azure Pipelines.
    • Ansible and Bash automate Red Hat Enterprise Linux administration.
    • Operational responsibilities include OpenShift clusters and the containerised applications they host.
    • The team uses Scrum to plan and deliver work in increments.
    PythonFlaskPostgreSQLDockerAzure DevOpsAzure Kubernetes ServiceAzure Container InstancesAzure Key VaultHelmTerraformAnsibleRed Hat OpenShiftKubernetesSQLJinja2BashRed Hat Enterprise LinuxScrum+12 more

  9. Software engineering · Senior Azure DevOps Engineer

    06/2021 – 12/2021

    Repeatable GitOps installation and upgrades

    A central GitOps service needed a consistent installation and upgrade process across new and existing OpenShift clusters. A plugin automates ArgoCD installation within a restricted namespace, checks the cluster state, configures authentication and verifies the installation with test workloads.

    • The team plans and delivers work through Scrum sprints.
    • Azure Pipelines runs the Ansible installation tasks inside Docker containers.
    • An Ansible role installs ArgoCD using customer-specific configuration.
    • Kustomize adapts the Kubernetes resources from the ArgoCD repository for the initial installation.
    • An Ansible test module checks Cert-Manager, Keycloak, ArgoCD, roles and RoleBindings before installation.
    • Jinja2 templates generate namespaces, roles, ConfigMaps and secrets for each target cluster.
    • Automated tests determine which installation or update tasks are needed based on the current cluster state.
    • Automation creates, updates and removes Kubernetes and OpenShift resources as required.
    • ArgoCD integrates with the cluster's existing Keycloak instance for single sign-on.
    • A test suite uses ArgoCD to deploy test workloads defined in an Azure DevOps repository.
    • The engagement also covers OpenShift administration and the development of containerised applications.
    Azure DevOpsGitKubernetesRed Hat OpenShiftPythonAnsibleDockerHarborKeycloakArgoCDKustomizeBashOpenID ConnectOAuth 2.0Cert-ManagerJinja2Scrum+11 more

  10. Managed services · IT Systems Engineer (Cloud)

    01/2021 – 11/2021

    Standardising managed container platforms

    Common standards help keep managed clusters consistent while allowing for individual customer requirements. Existing GitLab automation was extended to provision and update OpenShift resources, documentation and access through repeatable workflows.

    • Ansible records cluster, network and namespace details in the central SQL-based configuration management database.
    • The team organises its work into Scrum sprints.
    • Playbooks check and update namespaces, quotas, limits, logging, images, roles and role bindings.
    • Terraform provisions Harbor registries for container images.
    • Python and Ansible keep customer and cluster information up to date in the relevant GitLab repository READMEs.
    • OpenShift project templates give new namespaces a predefined set of resources.
    • Ansible checks, creates and updates the templates used by managed namespaces.
    • GitLab CI/CD stages run the automation that updates cluster resources.
    • Keycloak instances for customer access are provisioned automatically.
    • The work also includes developing and operating containerised applications on OpenShift.
    GitLab CI/CDGitKubernetesRed Hat OpenShiftTerraformPythonAnsibleDockerNetApp StorageTridentKeycloakScrumRed Hat Enterprise LinuxHarborSQL+9 more

  11. 2020

    Medical technology · Process Automation Engineer

    04/2020 – 01/2021

    An API for infrastructure data

    Operational data from Linux systems needed to be collected and processed centrally. A containerised Python API receives the data, converts it into a common format and forwards it to a Kubernetes management cluster, with authentication and automated deployment built in.

    • YAML templates define a common structure for the collected cluster data.
    • A Python module automates pull, commit and push operations for the associated Git repositories.
    • A parser combines JSON data from multiple sources and converts it into the agreed YAML format.
    • Flask-HTTPAuth controls access to the API.
    • A Python application collects operational data from Red Hat Enterprise Linux servers through scheduled jobs and sends it to the Flask API over HTTP.
    • Helm charts and GitHub Actions automate deployment to the target clusters.
    • GitHub Actions builds and pushes container images to Harbor when the source code changes.
    • A team of three uses Scrum, with priorities managed on a Kanban board in Jira.
    • Ansible automates Red Hat Enterprise Linux administration.
    • The engagement also includes developing and operating containerised applications on Kubernetes.
    GitHubGitHub ActionsGitKubernetesPythonAnsibleDockerHarborFlaskFlask-HTTPAuthHTTPHelmJSONYAMLScrumKanbanJiraRed Hat Enterprise Linux+12 more

  12. 2019

    Automotive · Senior Azure DevOps Engineer

    08/2019 – 12/2020

    Kubernetes infrastructure for enterprise applications

    Several Azure Kubernetes Service clusters were built for enterprise applications, with availability, networking and access control as the main priorities. Azure DevOps, Terraform and Ansible supported provisioning and configuration, backed by operational documentation and ongoing support.

    • Source code is managed in Azure DevOps repositories, with delivery organised through Kanban and Scrum.
    • Development work is coordinated across internal and external engineering teams.
    • Azure resource groups organise the infrastructure, while container registries store application images.
    • Terraform defines and provisions the infrastructure as code.
    • Azure Virtual Network provides the required network configuration for each customer.
    • Cluster configuration covers permissions, quotas, network security groups, Application Gateway and VPN access.
    • Ansible manages namespaces, deployments, network policies, PodDisruptionBudgets and role bindings.
    • Azure Firewall rules control private and public access to the clusters.
    • The authentication interface integrates with Azure Key Vault.
    • Project documentation is maintained in SharePoint, with second- and third-line support managed through ServiceNow.
    Azure DevOpsAzure FirewallAzure Load BalancingAzure Application GatewayAzure VPN GatewayAzure Virtual NetworkAzure Container RegistryGitKubernetesAzure Kubernetes ServiceTerraformPythonAnsibleDockerUbuntuHarborAzure Key VaultScrumKanbanSharePointServiceNowOAuth 2.0OpenID ConnectAzure Entra IDKeycloak+19 more

  13. Medical technology · Process Automation Engineer

    07/2019 – 03/2020

    Making production data usable

    A web application for medical-device production combined data entered by staff with readings from existing machine systems. It processed those inputs into production metrics and estimates of maintenance intervals.

    • A React front end captures production data entered by staff.
    • A Java Spring Boot REST API receives the submitted data.
    • Java functions retrieve additional readings from an existing machine API.
    • Processing modules account for environmental influences and calculate production metrics.
    • Further modules extrapolate measurements to estimate maintenance intervals.
    • The modules were ported from Java to C# to improve performance and maintainability.
    • The C# REST API runs as a .NET Core application in Docker.
    • Docker Compose deploys the front end and back end together.
    JavaJavaFXSpring BootC#React.NET CoreDockerDocker Compose+2 more

  14. 2017

    Automotive · Industrial Engineer

    10/2017 – 05/2019

    A prototype for real-time production analytics

    A Kubernetes-based prototype brought together real-time data from circuit-board manufacturing for analysis and visualisation. The minimum viable product was used to evaluate a distributed application architecture, from data collection and storage to the user interface.

    • A distributed Node.js application running on Kubernetes forms the basis of the prototype.
    • Services and deployment workflows support continuous collection and processing of manufacturing data.
    • The engineering team develops and tests platform components in agile sprints.
    • Node.js and Express provide containerised backend services.
    • A React front end runs on Kubernetes and scales with demand.
    • MongoDB provides persistent storage as a containerised database service.
    • Prometheus and Grafana provide infrastructure and application monitoring, with dashboards and alerts.
    • Network policies, Istio, TLS, role-based access control and secrets management protect the components.
    • Jenkins automates builds and deployments, supported by unit, integration and security tests.
    • The MVP evaluation includes deployment across multiple clouds and training for users and operations staff.
    KubernetesNode.jsExpressReactMongoDBDockerDocker ComposeJenkinsPrometheusGrafanaIstioTLS+6 more

  15. 2017 · Where it began