about / abhichandra
SRE / Platform Engineer. I take Kubernetes workloads from works-on-my-laptop to hardened, monitored, and shipping safely to production — available for scoped, fixed-price infrastructure work.
01 / about
I work at the seam between software and operations — the place where a good design decision quietly becomes someone else’s uneventful Tuesday.
That means designing platforms teams actually trust, shrinking the blast radius of change until deploys stop being events, and turning hard-won incident lessons into defaults nobody has to remember. My day-to-day lives in Kubernetes, Go, and Terraform — and, more than any of them, in the feedback loops wrapped around the three.
A platform that never surprises anyone is the hardest thing to build and the easiest thing to undervalue. I optimise for the shift where nothing happens.
Shipping fast is a consequence of being able to fail small. Progressive rollouts, real health signals, and a rollback that someone has actually rehearsed.
The postmortem is where architecture tells you the truth. The lesson only counts once it has become a default, a guardrail, or a deleted footgun.
toolchain
Ordered by where each tool sits in that path rather than by how much I like it. The goal at every stage is the same: make the next deploy safer than the last.
Small services with failure modes you can name out loud.
The image and the infrastructure both arrive as reviewable diffs.
Canary first, and a rollback someone has actually rehearsed.
Workloads that scale sideways and restart without an audience.
Signals tied to what users feel, not to what CPUs are doing.
02 / architecture
The shape most of my work takes: traffic in at the edge, one control plane, workloads that scale sideways, and state kept boring. Select a tier to see what it carries.
03 / operations
Real-time system health, metrics, and incident response. The calm before and after.
04 / selected work
A few problems I have helped make smaller, safer, and easier to operate. Commit data comes straight from the repositories.
CI/CD case study
Took a Go service from manual deploys and a root-running ~1GB image to an ~8MB non-root distroless image shipped by a tested, Trivy-scanned pipeline. Build → scan → push → deploy, with the vulnerability scan gating the release.
Security case study
Hardened a workload carrying the misconfigurations found in most un-reviewed clusters — root, privileged, Docker socket mounted, secrets in plaintext — down to zero critical findings. Verified: kube-score 9 criticals → 0, checkov 22 failures → 1.
05 / field notes
Short records of things that broke, what they taught me, and the defaults I changed after.
A widely-forked homelab manifest, scanned: 6 kube-score criticals and 16 checkov failures, and the five-line-each fixes that take it to zero.
A real cloudflare-ddns deployment with a live credential inlined in env — why it leaks, and the least-privilege rewrite around it.
The path from a cluster that looks healthy to the quorum arithmetic that says otherwise.
Tracing sidecar memory growth to its real cause instead of raising the limit again.
Cost controls that shrink the bill without quietly removing the feedback staging exists to give.
06 / contact
Available for scoped, fixed-price infrastructure work — container-security reviews, CI/CD pipelines, and GitOps rollouts. Also up for the conversations that start with “this is probably a bad idea, but…”