I build infrastructure that doesn't surprise you. That means cost gates before apply, policy enforcement as part of the pipeline, and drift detection that fires before oncall does.

Based in Nairobi. 5+ years working across AWS, Kubernetes, and Terraform at scale.

50% reduction in deployment cycle time by replacing a monolithic GitHub Actions pipeline with composite actions, reusable workflows, and parallel security scanning (tfsec, checkov, trivy).

40% reduction in infrastructure costs through automated Infracost + OPA gates: PRs with cost increases above threshold are blocked before they reach AWS.

87% reduction in surprise infrastructure costs across the infrastructure-modules project using real-time cost analysis, blast radius scoring, and semantic drift detection with per-environment risk thresholds.

Production-grade GitOps with ArgoCD on EKS, HashiCorp Vault for secrets, Terragrunt for environment promotion, and environment protection gates for Staging and Prod.

Keyless, zero-key-storage container signing end to end: GitHub OIDC → Fulcio → Rekor → Kubernetes admission control, with two independent enforcement engines (Kyverno and Gatekeeper+Ratify) implemented, tested, and compared. Found and fixed a real admission-control bypass (unsigned init containers slipping past signature verification) through systematic edge-case testing, not just happy-path demos.

Enterprise Terraform modules with a full governance layer built in:

• Blast radius scoring on every PR
• OPA cost gates blocking spend above threshold
• Semantic drift detection with risk-aware fingerprinting for high-risk resource types
• Parallel security scanning: tfsec, checkov, trivy
• terraform test + Terratest Go tests for VPC and EKS modules

Case study on Medium

Terragrunt-based multi-environment deployment repo:

• Composite actions for AWS OIDC auth, Terragrunt setup, EKS kubeconfig
• Destroy workflow with confirmation guards
• Environment protection gates enforced via GitHub environments (Staging, Prod)
• Manifest-as-contract pattern for verified deployments

Kubernetes-native AWS platform built on Crossplane, seven composable modules deployed through claims, not Terraform state:

• Nested Compositions for Network, IAM, EKS, Addons, RDS, ElastiCache, and Route53, each usable standalone or together
• Kyverno and OPA Gatekeeper enforcing tagging, naming convention, encryption, and prod-only deletion protection and node-count limits
• Custom cost estimator posting priced-out PR comments (EC2/EKS/RDS/ElastiCache/Route53) before anything is applied
• GitOps promotion pipeline (Dev → Staging → Prod) with OIDC-based EKS auth and manual approval gates on Staging and Prod

Terraform modules for a production GCP platform, the GCP counterpart to the AWS-based infrastructure-modules:

• Private GKE cluster with VPC-native networking
• Admission control via Kyverno and Gatekeeper
• Falco runtime security detection for anomalous workload behavior

A standalone, tested Kyverno policy pack for container image signing and attestation:

• Policies enforcing signature and attestation verification at admission
• Custom JMESPath condition test framework to validate policy logic before it ever reaches a cluster

Software supply chain security pipeline: every image that reaches Kubernetes is scanned, signed, attested, and verified before admission.

• Cosign keyless signing via GitHub OIDC -- no private keys stored anywhere, signatures anchored in the public Rekor transparency log
• SPDX SBOM and SLSA provenance generated and attached as Cosign attestations, verified at admission time
• Two enforcement engines implemented and documented side by side: Kyverno (native verification) and Gatekeeper + Ratify (delegated verification via external data provider)
• Full test matrix with raw evidence, not just policy YAML: signed/unsigned/tampered images, namespace exclusion boundaries, multi-container pods, and init containers
• A real bypass found and fixed during testing -- unsigned init containers initially skipped verification entirely; root-caused and closed with before/after proof committed to the repo
• Documented troubleshooting notes covering every non-obvious failure hit standing up Ratify (TLS cert rotation, stale CRD merges, field-name mismatches, a silent Rego bug that made violations under-report)

• IDP lab -- local-first Internal Developer Platform (Docker Compose, FastAPI, Backstage-compatible service catalog) exploring self-service infrastructure patterns
• Gumroad store -- DevOps tools and templates for engineers: makau5.gumroad.com

                   

Also: GitHub Actions, ArgoCD, HashiCorp Vault, Terragrunt, OPA/Gatekeeper, Ratify, Sigstore/Cosign, Infracost, tfsec, checkov, trivy, semgrep, Karpenter, Gitleaks, Crossplane

• Securing the Software Supply Chain: Signing, Attesting, and Enforcing Container Images -- Cosign keyless signing, SBOM/SLSA attestations, and Kubernetes admission control end to end
• Your CI Pipeline Has the Same Problems as Badly Written Software -- how I refactored a 300-line GitHub Actions monolith into reusable workflows and a thin orchestrator
• The Plan You Reviewed Is the Plan That Gets Applied -- manifest-as-contract pattern for verified Terraform deployments
• How We Eliminated Cloud Cost Overruns Using Terraform + Policy-as-Code -- OPA gates, Infracost, and automated governance in CI/CD

Open to DevOps roles and infrastructure consulting. Reach me on LinkedIn.