Gregory Bulgare

This project's goal was to establish a company-wide AWS environment with multiple AWS accounts, and it was applied at Infobam and CoinFLEX.

The aim was to isolate each infrastructure environment into separate AWS accounts and provide distinct AWS accounts for the operation stack, observability stack, and logging stack. This change enables the application of the least privilege access model, allows for budget resizing per environment, and facilitates easier implementation of features across all environments with reduced effort.

To advocate for this change, I created comprehensive documentation and presented it to the company. I also developed Terraform modules to automate the management of AWS accounts and services, such as virtual private cloud (VPC), Amazon S3, and Amazon EKS. These Terraform scripts were executed using GitLab CI and Atlantis. Basic services were automatically deployed in each environment via ArgoCD or FluxCD.

This implementation enabled us to refactor each environment based on the production environment while maintaining cost-efficiency in non-production environments. As a result, we achieved a 37% cost reduction in infrastructure for Infobam and around 12% for CoinFLEX.

In this project, I implemented a federated monitoring stack using Prometheus and Thanos, with a bucket for storing the monitoring metrics.

This was done to simplify the access application and infrastructure of monitoring by providing a single entry point. It also improved the reliability, scalability, and long-term storage of your metrics data, providing a robust monitoring solution for your Kubernetes environment and reducing the cost of the metrics storage. The implementation was carried out for Beamery's multiregion-based infrastructure.

I proposed this project and subsequently wrote and presented the documentation. I conducted the proof of concept (POC), which enabled me to prepare the implementation for non-production and production environments. Additionally, I updated the Grafana dashboard.

This project increased the complexity of the monitoring stack but allowed us to refactor all the dashboards, thereby reducing maintenance efforts. It also enabled long-term observation at a lower cost. As a result, monitoring costs were reduced by approximately 33%, and dashboard performance improved by 17%.

In this project, I implemented a multi-cluster Vault service via the HashiCorp Vault community version, shell script, and GitLab CI/CD pipeline.

This was done to isolate secret management for the application per Kubernetes cluster and infrastructure environment, including development, staging, and production. This allows applications that will pull or push secrets from Vault to continue to work if the global Vault cluster is not accessible.

I conducted the proof of concept (POC), which enabled me to prepare the implementation for the non-production environments. Additionally, I have improved the identification process of the company members on the global Vault cluster.

This project prevents us from deploying unnecessary secrets or configurations in the targeted infrastructure Kubernetes cluster, improves the turnover of secrets, and implements a standardized generation and promotion workflow for the application secret.