I'm a DevOps & Platform Engineer on enterprise projects: CI/CD, Kubernetes, Terraform, cloud cost.
I wrote application code before I ran the infrastructure that hosts it, which pays off mostly when a build breaks and someone has to know where to look.
The open-source work here comes from the same place. Something misbehaves in a real deployment, I go read the source, and the fix goes upstream rather than into a patch I keep to myself.
role: DevOps & Platform Engineer
platform: [Azure, Kubernetes, GitOps, Terraform, Azure DevOps, GitHub Actions]
also: [FinOps, Agentic DevOps, .NET backend]
languages: [C#, TypeScript, Go, Rust, Python, Bash, PowerShell]
into: [correctness bugs, observability gaps, release plumbing, cloud cost]
based_in: Turin, Italy
Pipelines Azure DevOps · GitHub Actions · templates |
Kubernetes AKS · k3d · Helm · Helmfile |
Infrastructure Terraform · scale sets · golden images |
Containers Docker · Helm charts · OCI on ACR/GHCR |
Cloud & cost Azure · reservations · FinOps |
Backend .NET 8/9 · CQRS · DDD |
|
Platform & CI/CD |
Cloud & infrastructure |
|
Backend & architecture |
Identity, storage & AI |
46 pull requests across 37 projects I run or depend on. 6 merged so far, 36 still in review.
Merged
| Project | Change | PR | |
|---|---|---|---|
 |
dotnet/runtime | Fix CompareInfo.IsPrefix/IsSuffix with CompareOptions.IgnoreSymbols not ignoring leading/trailing symbols | #132397 |
 |
kubernetes-sigs/apiserver-network-proxy | Add connection_duration_seconds histogram for post-dial connection lifespan | #899 |
 |
StackExchange/StackExchange.Redis | Add NOMKSTREAM support to XADD | #3186 |
|
DapperLib/DapperAOT | Fix false-positive DAP214 for {=XXX} literal-replacement syntax | #191 |
|
nunit/nunit-console | Add AssemblyTargetFramework to IExtensionNode | #1867 |
|
nunit/nunit-console | Fix --list-extensions showing wrong target framework for extensions | #1861 |
In review (36 open pull requests)
| Project | Change | PR | |
|---|---|---|---|
 |
moby/moby | Bridge: repair stale WSL2Mirrored loopback0 drop rules | #53458 |
|
moby/moby | Reuse per-host authorizers across a pull in the c8d resolver | #53457 |
|
kubernetes/kube-openapi | Fix duplicate map keys when a type embeds two structs sharing a field | #631 |
|
kubernetes-sigs/krew-index | Add safe-rollout plugin | #6213 |
|
kubernetes/perf-tests | Add unit tests for clusterloader2/pkg/errors | #4261 |
|
docker/cli | Normalize the registry server address to lowercase for credential lookup | #7184 |
 |
containerd/runwasi | Gate ctr image import --local by detected ctr version | #1177 |
 |
argoproj/argo-cd | Add ignoreDraft filter to ApplicationSet Pull Request generator | #29265 |
|
argoproj/argo-rollouts | Stop degraded stable RS from permanently blocking subset DestinationRule switch | #4990 |
|
argoproj/argo-workflows | Scope RemoveFromQueue to the calling controller | #16739 |
 |
open-policy-agent/opa | Make allow_net restrict file:// refs in JSON schemas | #9044 |
|
spiffe/spire | Fix inaccurate expiring/outdated SVID sync metrics | #7230 |
 |
thanos-io/objstore | Support a custom GCS API endpoint through the endpoint config option | #270 |
 |
saltstack/salt | Fix file.managed omitting mode from changes when creating a file | #70084 |
|
saltstack/salt | Fix module.run: positional arg for defaulted param raises 'multiple values' | #70083 |
 |
BurntSushi/ripgrep | Detect compressed files by magic number in search-zip, not just by extension | #3516 |
|
BurntSushi/ripgrep | Fix the dangling backslash error for an escaped trailing space | #3515 |
|
tokio-rs/tracing | Add an opt-in field value truncation wrapper to the subscriber | #3600 |
|
dtolnay/cxx | Strip r# prefix from raw identifiers in generated C++ names | #1749 |
|
rust-embedded/heapless | Add shift_remove family to IndexMap/IndexSet | #685 |
|
dotnet/runtime | Return empty string instead of throwing when getpwuid_r fails unexpectedly | #132396 |
|
dotnet/msbuild | Disable nullable analysis for net4x leg of multi-targeted projects | #14738 |
|
StackExchange/StackExchange.Redis | Fix Sentinel connection leak and AbortOnConnectFail=false handling | #3187 |
|
StackExchange/StackExchange.Redis | Make fallback discovery and keep-alive probes cluster-slot aware | #3185 |
|
quartznet/quartznet | Add job type exclusion filter to trigger acquisition | #3282 |
|
NLog/NLog | Change the DateLayoutRenderer default format to yyyy-MM-dd HH:mm:ss.ffff | #6252 |
|
nsubstitute/NSubstitute | Document that Received.InOrder does not track property getters | #998 |
 |
dotnet-outdated/dotnet-outdated | Report packages whose source repository is archived or deleted | #781 |
 |
ansible/terraform-provider-aap | Remove aap_host from state on 404 during Read | #194 |
 |
traefik/traefik-helm-chart | Restore secretResourceNames for namespaced Role | #1972 |
| Azure/azure-powershell | Fix Get-AzSubscription silently ignoring mismatched -TenantId under MSI auth | #29994 |
|
| HangfireIO/Hangfire | Don't disable recurring jobs on transient storage errors | #2589 |
|
|
argoproj/argo-events | Close NATS connection when trigger connection init fails | #4158 |
| temporalio/temporal | Fail batch operations when Visibility queries time out repeatedly | #11753 |
|
| tikv/tikv | Tikv_util: fix undefined behavior in RangeLatchGuard's Drop impl | #20022 |
|
| zed-industries/zed | Retain worktrees with uncommitted changes when archiving agent threads | #63163 |
| Project | What it is | Stack | ||
|---|---|---|---|---|
| kubectl-safe-rollout | A kubectl plugin that tells you why a rollout failed or stalled. Deterministic classification, no LLM, and it never writes to the cluster | Go client-go |
v0.3.0 |
|
| github-actions-recipes | The workflows behind my CI/CD and FinOps posts, one variable isolated per recipe | GitHub Actions |
live |
|
| token-optimization | Cuts token usage when working with LLM coding agents. Re-running the setup is a no-op | PowerShell |
live |
kubectl-safe-rollout is submitted to krew-index, so it will be installable with kubectl krew install safe-rollout.
I write on LinkedIn about platform details that usually pass unchecked: how Azure DevOps resolves its three expression syntaxes, the compliance rules for self-hosted runners, what Copilot code review does and does not decide, and whether an Azure reservation discount is still applying to anything.
