Roadmap

Each item comes to the lab as a working demo, proven before it's called done. Several are designs I've already built in the cloud.

Recently done

What Result
Edge protection with CrowdSec Every site sits behind CrowdSec in Traefik: it bans scanning and brute-forcing IPs, pulls a community blocklist, and blocks requests exploiting known CVEs, while the OWASP Core Rule Set records what it would catch. It needed real client IPs first: Traefik had been seeing one internal address for everyone and writing no access logs. Proven from a phone on cellular: a secrets probe got 403, a ban took effect within a minute, and logins, git push and CI image pushes all passed. With CrowdSec's WAF unreachable, every site kept working. (Compute & networking)
MinIO backups on a keyless role The same pattern as Gitea's: a nightly tarball of MinIO's volume, its objects plus its users and policies, on its own write-only role, kept 7 days. Proven by starting a throwaway MinIO on the restored copy: the same 116 objects and 1.7 GB as the live server, the largest object byte-for-byte identical, and no errors.
Gitea backups on a keyless role Every night, a tarball of Gitea's volume (repositories, registry, attachments, keys) goes to S3 on a role that can only write: it can't list, read or delete backups, and an S3 rule expires them after 7 days. Proven with a restore drill: all 15 repositories pass git fsck, the encryption keys are there, and the registry matches the live volume. (Gitea)
kubectl login through Zitadel kubectl logs in through the browser like every other app, and the cluster sees each person by name. Access is a Zitadel role: admin maps to cluster-admin, read-only to view. Proven on all three servers: kubectl auth whoami shows the Zitadel user and roles, the read-only role can list pods but not read Secrets or change anything (checked against RBAC), and anonymous requests are refused. The keyless AWS test job still passes after the restarts. With Zitadel unreachable, the apiserver starts in seconds and the admin kubeconfig still works. (Identity)
Keyless AWS access for workloads A pod trades its own Kubernetes service-account token with AWS STS for one hour of credentials on its own IAM role. Nothing is stored, and the kubelet renews the token. Proven end to end: a test job updates one Route 53 record, and its role can't touch anything else. A first version on Zitadel tokens worked too, but needed a stored secret and couldn't renew, so it was replaced. (Identity)
AWS CLI through single sign-on The CLI on my laptop logs in through Identity Center and Zitadel, like the console, instead of with an IAM user's access key. The key and its user are deleted. People reach AWS only through a Zitadel role. (Identity)
Database backups on keyless roles Both Postgres clusters back up to S3 with their own IAM roles, each limited to its own backups. Proven with the old key turned off: WAL archiving, a base backup and a restore drill on each cluster, then the key and its IAM user were deleted. (Data platform)

Next

What Why
Crossplane: IAM, S3 and SQS AWS resources declared as Kubernetes objects and deployed by Argo CD, like everything else. Today they're made by re-runnable CLI scripts; those move to Crossplane first. SQS adds queues between services, instead of direct calls.
Alerts to chat A failed backup, sync or pod today shows up only if I look. Alerts and Argo CD sync failures go to a chat channel.

TODO: Slack or Discord for alerts.

After that

What Why
A 4th node Spare capacity, so a lost node's database instance has somewhere to rebuild.
EKS The same platform on managed Kubernetes, beside the home cluster.
ExternalDNS Route 53 records that follow the services, instead of records kept by hand.
AWS Load Balancer Controller AWS load balancers from Kubernetes Service and Ingress objects.
Reloader Workloads that restart when their config or secrets change.

TODO: for each item, a line on the cloud design it comes from (no employer internals).