Challenge

Teams needed to ship to production safely and repeatably — without manual cluster access and without shared secrets.

Solution

Private AKS with separated node pools (system/user/spot), Azure CNI, AAD integration, Workload Identity and Network Policies. Workloads deployed via GitOps (FluxCD HelmReleases), with Dynatrace and Ingress NGINX.

Outcome

▸Secure-by-default, fully GitOps delivery

Challenge

A bare-metal environment with no load balancer and no governance — container workloads had no production foundation to build on.

Solution

A production on-prem platform on RKE2 with Cilium CNI (L2 Announcements, LB IPAM) and KubeVIP in ARP mode. A secure, scalable foundation for container workloads on bare metal.

Outcome

▸2 production clusters, governance via Kyverno

Challenge

Deployments via manual kubectl and helm were unauditable and inconsistent across environments — nobody knew exactly what was really running in the cluster.

Solution

Declarative Kubernetes management via Git: FluxCD (clusters/dev·test·prod, HelmReleases, Kustomizations, environment overlays) on Azure and ArgoCD app-of-apps on-prem. Environment state driven by reconciliation, no manual kubectl.

Outcome

▸Auditable, repeatable deployments

Challenge

Dozens of clusters, each with its own monitoring — no unified view and slow root-cause analysis during incidents.

Solution

Full-stack observability: Dynatrace (DynaKube, Operator, OneAgent) for AKS, plus federated Prometheus → Thanos, Grafana and Loki/Alloy on-prem. A single view of metrics and logs across environments.

Outcome

▸Federated metrics from 20+ clusters

Challenge

Long-lived secrets in pipelines were a security risk and a burden — rotation was manual and a credential leak would mean access to the whole infrastructure.

Solution

Migrated CI/CD authentication to OIDC Workload Identity Federation — the pipeline requests a token, Azure AD validates the trust, and Terraform works with short-lived credentials. The end of long-lived secrets in pipelines.

Outcome

▸No long-lived secrets in the pipeline

Challenge

Multi-environment infrastructure was drifting apart — copy-pasted configs, drift between dev/test/prod, and changes everyone was afraid to run.

Solution

A modular Terraform/Terragrunt composition for multiple environments — modular root composition, dynamic AKS node pools via for_each, and workspace separation. Infrastructure that's readable, repeatable and safely deployed through a pipeline.

Outcome

▸Multi-env Azure landing zones

Challenge

Logs scattered across pods and VMs — during an incident it was hard to piece together what actually happened and in what order.

Solution

A logging pipeline with Fluent Bit as the collector and Loki as the backend — log parsing and label extraction (e.g. ServiceName from log_processed) for fast searching and filtering during incidents.

Outcome

▸Logs that are usable in real troubleshooting

Challenge

Critical systems with no proven recovery plan — an outage would have meant unknown RPO/RTO and improvising under pressure.

Solution

A DR strategy for AKS, PostgreSQL, Keycloak and Redis — combining backup, restore and infrastructure re-creation via IaC to minimize RPO and RTO.

Outcome

▸Designed around RPO/RTO

Challenge

Provisioning SAP infrastructure took days, required manual work from specialists and blocked 20+ teams.

Solution

A self-service platform for 20+ teams to provision SAP infrastructure across Azure, AWS and a private Telekom Cloud. Custom Azure API functionality in JS for SAP administrators.

Outcome

▸Provisioning under 15 minutes

Challenge

Teams needed their own CI/CD ecosystem — no vendor lock-in, with full control over data and cost.

Solution

Full provisioning of a self-hosted GitLab instance on Hetzner Cloud via Terraform — from networking to running. Cut CI/CD setup time for dev teams.

Outcome

▸Infrastructure 100% as code