I'm a DevOps & Platform Engineer on enterprise projects: CI/CD, Kubernetes, Terraform, cloud cost.
I wrote application code before I ran the infrastructure that hosts it, which pays off mostly when a build breaks and someone has to know where to look.
The open-source work here comes from the same place. Something misbehaves in a real deployment, I go read the source, and the fix goes upstream rather than into a patch I keep to myself.
role: DevOps & Platform Engineerplatform: [Azure, Kubernetes, GitOps, Terraform, Azure DevOps, GitHub Actions]also: [FinOps, Agentic DevOps, .NET backend]languages: [C#, TypeScript, Go, Rust, Python, Bash, PowerShell]into: [correctness bugs, observability gaps, release plumbing, cloud cost]based_in: Turin, Italy
Pipelines Azure DevOps · GitHub Actions · templates | Kubernetes AKS · k3d · Helm · Helmfile | Infrastructure Terraform · scale sets · golden images | Containers Docker · Helm charts · OCI on ACR/GHCR | Cloud & cost Azure · reservations · FinOps | Backend .NET 8/9 · CQRS · DDD |
Platform & CI/CD | Cloud & infrastructure |
Backend & architecture | Identity, storage & AI |
46 pull requests across 37 projects I run or depend on. 8 merged so far, 33 still in review.
Merged
| Project | Change | PR | |
|---|---|---|---|
 | dotnet/runtime | Fix CompareInfo.IsPrefix/IsSuffix with CompareOptions.IgnoreSymbols not ignoring leading/trailing symbols | #132397 |
 | kubernetes-sigs/apiserver-network-proxy | Add connection_duration_seconds histogram for post-dial connection lifespan | #899 |
 | StackExchange/StackExchange.Redis | Add NOMKSTREAM support to XADD | #3186 |
| DapperLib/DapperAOT | Fix false-positive DAP214 for {=XXX} literal-replacement syntax | #191 |
| nunit/nunit-console | Add AssemblyTargetFramework to IExtensionNode | #1867 |
| nunit/nunit-console | Fix --list-extensions showing wrong target framework for extensions | #1861 |
| Azure/azure-powershell | Fix Get-AzSubscription silently ignoring mismatched -TenantId under MSI auth | #29994 | |
| quartznet/quartznet | Add job type exclusion filter to trigger acquisition | #3282 |
In review (33 open pull requests)
| Project | Change | PR | |
|---|---|---|---|
 | moby/moby | Bridge: repair stale WSL2Mirrored loopback0 drop rules | #53458 |
| moby/moby | Reuse per-host authorizers across a pull in the c8d resolver | #53457 |
| kubernetes/kube-openapi | Fix duplicate map keys when a type embeds two structs sharing a field | #631 |
| kubernetes-sigs/krew-index | Add safe-rollout plugin | #6213 |
| kubernetes/perf-tests | Add unit tests for clusterloader2/pkg/errors | #4261 |
| docker/cli | Normalize the registry server address to lowercase for credential lookup | #7184 |
 | containerd/runwasi | Gate ctr image import --local by detected ctr version | #1177 |
 | argoproj/argo-cd | Add ignoreDraft filter to ApplicationSet Pull Request generator | #29265 |
| argoproj/argo-rollouts | Stop degraded stable RS from permanently blocking subset DestinationRule switch | #4990 |
| argoproj/argo-workflows | Scope RemoveFromQueue to the calling controller | #16739 |
 | open-policy-agent/opa | Make allow_net restrict file:// refs in JSON schemas | #9044 |
| spiffe/spire | Fix inaccurate expiring/outdated SVID sync metrics | #7230 |
 | thanos-io/objstore | Support a custom GCS API endpoint through the endpoint config option | #270 |
 | saltstack/salt | Fix file.managed omitting mode from changes when creating a file | #70084 |
 | BurntSushi/ripgrep | Detect compressed files by magic number in search-zip, not just by extension | #3516 |
| BurntSushi/ripgrep | Fix the dangling backslash error for an escaped trailing space | #3515 |
| tokio-rs/tracing | Add an opt-in field value truncation wrapper to the subscriber | #3600 |
| dtolnay/cxx | Strip r# prefix from raw identifiers in generated C++ names | #1749 |
| rust-embedded/heapless | Add shift_remove family to IndexMap/IndexSet | #685 |
| dotnet/runtime | Return empty string instead of throwing when getpwuid_r fails unexpectedly | #132396 |
| dotnet/msbuild | Disable nullable analysis for net4x leg of multi-targeted projects | #14738 |
| StackExchange/StackExchange.Redis | Fix Sentinel connection leak and AbortOnConnectFail=false handling | #3187 |
| StackExchange/StackExchange.Redis | Make fallback discovery and keep-alive probes cluster-slot aware | #3185 |
| NLog/NLog | Change the DateLayoutRenderer default format to yyyy-MM-dd HH:mm:ss.ffff | #6252 |
| nsubstitute/NSubstitute | Document that Received.InOrder does not track property getters | #998 |
 | dotnet-outdated/dotnet-outdated | Report packages whose source repository is archived or deleted | #781 |
 | ansible/terraform-provider-aap | Remove aap_host from state on 404 during Read | #194 |
 | traefik/traefik-helm-chart | Restore secretResourceNames for namespaced Role | #1972 |
| HangfireIO/Hangfire | Don't disable recurring jobs on transient storage errors | #2589 | |
| argoproj/argo-events | Close NATS connection when trigger connection init fails | #4158 |
| temporalio/temporal | Fail batch operations when Visibility queries time out repeatedly | #11753 | |
| tikv/tikv | Tikv_util: fix undefined behavior in RangeLatchGuard's Drop impl | #20022 | |
| zed-industries/zed | Retain worktrees with uncommitted changes when archiving agent threads | #63163 |
| Project | What it is | Stack | ||
|---|---|---|---|---|
| kubectl-safe-rollout | A kubectl plugin that tells you why a rollout failed or stalled. Deterministic classification, no LLM, and it never writes to the cluster | Goclient-go | v0.3.0 | |
| github-actions-recipes | The workflows behind my CI/CD and FinOps posts, one variable isolated per recipe | GitHub Actions | live | |
| token-optimization | Cuts token usage when working with LLM coding agents. Re-running the setup is a no-op | PowerShell | live |
kubectl-safe-rollout is submitted to krew-index, so it will be installable with kubectl krew install safe-rollout.
I write on LinkedIn about platform details that usually pass unchecked: how Azure DevOps resolves its three expression syntaxes, the compliance rules for self-hosted runners, what Copilot code review does and does not decide, and whether an Azure reservation discount is still applying to anything.
