devops24x7

Cloud architecture / Infrastructure as code

Cloud infrastructure, designed and coded to run independently.

Aleksey DmitrievIndependent engineer · Munich · 20+ years

Freelance Software & Infrastructure Engineer · Infrastructure as Code, Cloud Architecture, CI/CD

I design infrastructure that runs 24x7 on its own.

Contact LinkedIn ↗
Aleksey Dmitriev

Services

Infrastructure as Code & Cloud Architecture

I design and implement cloud infrastructure as code with Terraform, Kubernetes and Helm on AWS and GCP. This includes migrations between clouds and platforms, CI/CD pipelines and observability that is part of the platform design from the start.

Software Development

I develop backend applications, integrations between systems and automation tools in Python and Go. The result is tested code in your repository, with documentation that allows your developers to extend it.

Technical Consulting & Architecture Review

I analyse existing architecture and infrastructure code, identify risks and bottlenecks, and draw up a modernisation plan. While your team implements the plan, I advise it as a consultant.

Introducing a technology to your team: a workshop, how-to documentation and a pilot on your environment (Kubernetes, Istio, Argo CD, Terraform).

How I work

From first conversation to a documented handover.

  1. 01

    Introduction

    Discuss your goals, context and constraints.

  2. 02

    Assessment

    Agree on scope, priorities and deliverables.

  3. 03

    Implementation

    Design, code and validate the agreed solution.

  4. 04

    Handover

    Deliver code and documentation to your team.

Engagement terms

  • Tasks and priorities are agreed with you in the course of the project; I decide myself how and when the work is done.
  • Remote from Munich (CET); on-site meetings by arrangement.
  • Billing by the hour or per agreed milestone.
  • One invoice per month with a breakdown by task.
  • Contract under German law.
  • No German VAT for business clients outside Germany (within the EU: reverse charge).

Work examples

Selected engineering work from 2019 to 2026, anonymised: no client names, no industries, no absolute figures of the client.

Work example 1

Kubernetes on AWS: half the nodes, restarts only in an agreed window

Challenge

Several EKS clusters across AWS accounts had grown organically: fixed node groups sized for peak load, on-demand instances everywhere, batch jobs and long-running services on the same nodes. One cluster requested about 60 % of its CPU while using about 10 %. Any automatic node consolidation restarted services at random times.

Approach

Moved the clusters to Karpenter with consolidation of under-used nodes, separated batch jobs into their own node pools protected from eviction by policy, and added spot pools that service owners opt into with a toleration. The first consolidation run produced a node re-creation loop; after root-cause analysis, consolidation and node rotation were limited to one agreed window per day, with alerting rules on node age. Every change went through Terraform/Terragrunt and reviewed merge requests, rolled out cluster by cluster with verification after each.

Result

Node count down by more than half, node cost reduced accordingly. Services restart only inside the window; consolidation-related incidents stopped.

Work example 2

CI on self-hosted GitLab: from hand-configured bare-metal runners to autoscaling fleets

Challenge

Native builds ran on a handful of bare-metal runners configured by hand. The same build took anywhere from 7 minutes to over an hour depending on host load, the ARM queue starved, disks filled up with old images, artifact storage overflowed twice and failed jobs. About 40 % of the GitLab server's background jobs were spent on dead webhooks.

Approach

Designed autoscaling runner fleets on AWS (x86 and ARM, spot), defined as code and deployed through GitOps. Ran a test week on real jobs, migrated the heaviest project first, then retired the static runners and reinstalled their hosts for a compute cluster. Removed the dead webhooks, introduced CI history retention and build-cache limits, and wrote a server upgrade procedure with background-migration checks, handed over to the team.

Result

No static runners left. Stored pipelines down 58 %, background job latency down from minutes to seconds. A planned server upgrade fits into a window of about half an hour.

Work example 3

Bare-metal cluster for data-heavy compute, managed as code

Challenge

A data team needed compute with fast local disks and large data volumes that was disproportionately expensive in the cloud. The requirement: a cluster on rented servers with cloud discipline, meaning reproducible installation, encrypted data and shared storage access without keys on the hosts.

Approach

Started with a three-node pilot and grew the cluster to more than fifteen nodes: installation and bootstrap with Ansible, RAID0 for working data, LUKS on the data partition, a shared object-storage bucket mounted read-only on all nodes through a network policy instead of host keys. Wrote the procedure for adding, removing and reinstalling nodes and a user guide for the cluster.

Result

A batch of ten nodes went live within days by following the procedure rather than one person's memory. Direct reads from the bucket are about seven times faster than the previous path.

Work example 4

More than ten EKS clusters upgraded three major versions ahead

The clusters lagged several Kubernetes versions behind and paid the surcharge for outdated versions. Upgraded all of them through the version chain together with the CNI, rehearsed on a test cluster, scheduled windows before peak load and documented the procedure as a playbook for the team. Surcharge gone; no incidents on the main clusters.

Work example 5

AWS platform: from bastion hosts and static keys to OIDC and managed services

A company with several web products on ECS and no infrastructure documentation. Designed an EKS environment from scratch as code (Argo CD, IRSA, CSI drivers for secrets and EFS, logs in OpenSearch, ExternalDNS), replaced the bastion with ECS Exec, migrated the database to Aurora Serverless, moved the repositories to GitHub Actions with OIDC instead of static keys, set up several site-to-site VPNs with BGP and moved the message broker from external hosting into AWS without incidents.

Work example 6

One deploy flow for eight repositories

The deploy pipelines of eight services opened merge requests into the GitOps repository in different ways and got stuck on parallel deploys. Moved them to a shared CI component with rebase-and-retry, verified it with four simultaneous deploys and closed more than a hundred stuck merge requests. Deploys no longer need manual intervention.

Work example 7

Cloud platform team for a B2B product

Led a team of seven engineers building the Kubernetes platform. Migrated production clusters from Docker to containerd, introduced a spot fleet for development environments at roughly a third of the on-demand node price, dedicated node groups for critical applications, requests/limits and capacity governance across teams, automated certificate renewal with cert-manager, the company's first Kubernetes operator in Go, managed Kafka with custom dashboards, GitOps with Argo CD and infrastructure as code with Terraform.

Software work

Own projects that show how I build software, not only infrastructure.

Analytics platform: from 40+ raw sources to decisions

An end-to-end pipeline that ingests data from more than forty heterogeneous sources, normalises and stores it as time series, scores it with a rule engine and LLM analysis with structured output, and delivers the result where people act on it: dashboards in a web application, scheduled digests and event-driven alerts in Telegram, with other channels pluggable. Engineering: collectors with consistency checks and recovery after failures, schema changes only through migrations, architecture decision records, end-to-end and unit tests, deployments with rollback. Python, PostgreSQL, TypeScript.

Speech-to-text and summarisation pipeline on own GPU hardware

Monitors video and audio channels, takes subtitles where they exist and otherwise transcribes on a GPU with voice activity detection and suppression of hallucinated text, then summarises with a locally hosted LLM and serves the results in a web application behind OAuth. Designed for privacy by default: nothing leaves the owner's perimeter, no external APIs. Recognition quality is tuned and documented per language and audio condition. Python.

Secrets tool for macOS with hardware-backed unlock

A command-line tool in Swift that keeps the password manager's master secret in the Data Protection Keychain, unlocks it with Touch ID and hands a post-quantum age key to SOPS for encrypting repository secrets. Zero network access, zero telemetry, a documented threat model.

Benchmark harness for LLM coding agents

The same task is given to several agents; the harness measures tokens, wall-clock time and quota use, and a separate evaluator agent scores the results against a rubric and writes the report. Tool choices are then made on numbers rather than impressions.

About

Design and development of custom software and infrastructure code, cloud architecture and related technical consulting for companies in Germany, Austria, Switzerland, the Netherlands, the UK and the US. Based in Munich, working remotely. No supply of hardware or licences, no ongoing operations.

In Germany since 2016, in Munich since 2019, working independently as a Freiberufler (liberal profession under German law). University degree (Specialist) in computer systems and networks (GUAP, St. Petersburg, 2002); more than 20 years in infrastructure and software development, built on a foundation in Linux, networking and systems programming. Languages I write in: Python, Go, Swift, TypeScript. Working languages: English, German, Russian.

  • Kubernetes
  • Terraform
  • Terragrunt
  • Helm
  • Argo CD
  • GitOps
  • AWS
  • GCP
  • Bare metal
  • Linux
  • Karpenter
  • Istio
  • Kafka
  • PostgreSQL
  • GitLab CI
  • GitHub Actions
  • Prometheus
  • Grafana
  • Python
  • Go
  • LLM integration

Contact