Capability map
A focused stack, grouped the way a platform is built.
Foundation, delivery, operations — plus the tools that show up in each layer. Everything here is something I have run in production, not something I have read about.
Core platforms
Azure
Primary platform — landing zones, AKS, edge, governance
Google Cloud
GKE platforms, networking, and workload migration
AWS
Workload hosting, FTR reviews, and cross-cloud delivery
Kubernetes
Runtime standards, multi-tenancy, and release paths
Terraform
Module design, state strategy, and drift control
Capabilities
Foundation
The cloud estate everything else is built on.
- Cloud architecture
- Multi-cloud landing zones, HA and DR decisions, and workload placement.
- Networking & edge
- Ingress, WAF, CDN, service mesh, mTLS, and traffic management.
- Identity & governance
- Cloud IAM, Entra ID, federation, access reviews, and policy guardrails.
Delivery
How change reaches production, repeatably.
- Platform engineering
- Golden paths, paved roads, and platform-as-a-product delivery.
- IaC & automation
- Terraform modules, GitOps workflows, drift control, and review.
- DevSecOps
- Policy enforcement, scanning, supply-chain checks, and secure defaults.
Operations
Keeping it up, visible, and affordable.
- Reliability engineering
- SLOs, incident response, capacity planning, and MTTR reduction.
- Observability
- Telemetry strategy, dashboards, alert routing, and signal quality.
- Systems & scripting
- Linux, Windows, ESXi, Python, Bash, PowerShell, and KQL.
Toolbelt
Containers & Kubernetes
- Docker
- Helm
- AKS
- GKE
- EKS
- Argo CD
- Argo Rollouts
- Istio
- NGINX Ingress
CI / CD
- GitHub Actions
- Azure DevOps
- GitLab CI
- Jenkins
- Spinnaker
Observability
- OpenTelemetry
- Prometheus
- Grafana
- Loki
- Alertmanager
- Datadog
- New Relic
Security & Policy
- Microsoft Sentinel
- Defender for Cloud
- Azure Policy
- OPA / Gatekeeper
- Kyverno
- HashiCorp Vault
- Azure Key Vault
- External Secrets Operator
- Cert-manager
- Checkov
- Trivy
- Terrascan
Networking & Edge
- Azure Front Door
- Azure Application Gateway
- GCP Cloud Armor
- GCP Cloud Load Balancing
- AWS CloudFront
- Cloudflare
- NGINX
- Envoy
Identity & Access
- Microsoft Entra ID
- Azure AD B2B / B2C
- OIDC
- SAML
Cost Management
- Kubecost
- Azure Cost Management
Scripting & Automation
- Python
- Bash
- PowerShell
- KQL
Virtualisation
- VMware ESXi
- Linux
- Windows Server