Software Engineer, Core Platform Infrastructure
Alkira Inc.
Aug 2022 - Present
- Own multiple core platform subsystems end-to-end (secrets, service-mesh proxy, PKI, datastore) and drive production rollouts across 5 environments and 4 clouds.
- Led deprecation of the per-node AWS NLBs and Route53 records fronting 270+ production nodes, replacing them with a custom Envoy egress proxy that load-balances directly to gateway-node public IPs via Etcd, cutting recurring networking cost by thousands of dollars per month.
- Designed and shipped a phased mutual-TLS service mesh in which nodes publish services to Etcd as Protobuf and gateway Envoys build per-node filter chains and client mTLS routes, securing intra-cluster traffic and Prometheus metric scraping.
- Sole author of the global Vault secrets platform: per-environment certificate-auth roles bound to step-ca node certs, a Vault agent baked into node images, and a DR-capable multi-node cluster for secret storage and transit encryption.
- Extended the platform into the network-isolated AWS and Azure China partitions, injecting cross-partition S3/Route53 credentials into provisioning, log/stat shippers, and Helm charts as Kubernetes secrets; oversaw ICP licensing with the local partner.
- Maintain the multi-cloud machine-image build system (Packer and QEMU across AWS, Azure, and GCP) producing layered Debian images running the VPP, FRR, StrongSwan, and OpenVPN dataplane stack.
- Ran production on-call and Kubernetes/EKS lifecycle operations: staged control-plane upgrades with zero tunnel-health impact, Temporal upgrades, and goroutine/memory-leak debugging with Go Delve and pprof.