I build infrastructure an agent can work on and touch safely.

30+ agent skills the platform team runs

Chewy · Claude Code & Codex · provisioning, change management, troubleshooting

Platform work is repeated judgment — provisioning new infrastructure, changing what's already running, and troubleshooting it when it breaks. I built 30+ Claude Code and Codex agent skills covering that whole lifecycle, and they've been adopted by the platform engineers as part of the daily workflow: scaffolding new infra to our conventions, reviewing changes before they merge, and walking incidents change-first.

The three I go deepest on: a Terraform plan reviewer that risk-tiers every change and leads with an apply/don't-apply verdict, a Kubernetes manifest reviewer that checks limits, probes, image pinning and RBAC, and an incident-triage assistant that walks a firing alert change-first. Each pairs the model's judgment with a deterministic Python script that parses the actual plan JSON or YAML — every destroy, every IAM widening, every missing limit — and exits non-zero on critical findings so CI can block a bad apply. The model explains and prioritizes; it doesn't invent findings.

I validated them with an eval loop — every test case run with and without the skill, graded against fixed checks. The honest result: the base model is already strong, and the repeatable win is determinism plus safety discipline. The skills recommend rollbacks; they never run them.

• Claude Code
• Codex
• Python
• GitHub Actions
• Terraform
• Kubernetes

Karpenter: a third off the compute bill

Chewy · fleet ~200 → ~140 nodes · scale-up ~5 min → ~45 sec

Node provisioning ran on Cluster Autoscaler: slow to react — around five minutes for capacity to arrive — and chronically over-provisioned, because node groups can't right-size to what pods actually request.

I migrated provisioning to Karpenter: just-in-time nodes sized to the pending pods, with workload consolidation packing the fleet tighter as demand moves. Workloads are split across NodePools — spot instances for general workloads, on-demand for critical cluster operations — enforced with taints and tolerations so nothing critical lands on capacity that can disappear.

The fleet went from roughly 200 nodes to 140 — about 30% off compute spend — and node scale-up dropped from ~5 minutes to ~45 seconds, which is the difference developers actually feel.

• Karpenter
• EKS
• Terraform
• EC2 Spot

GitOps with nothing hand-deployed

Chewy · 40+ apps · 7 EKS clusters

App delivery is declarative, pull-based GitOps with ArgoCD: Git is the source of truth, GitHub Actions runs the promotion pipeline that updates it, and ArgoCD reconciles the clusters to match — with automated drift detection and rollbacks that are just a revert.

The platform plumbing is automated to the same standard: cert-manager syncs TLS certificates with ACM, external-dns manages Route53 records, and secrets reach pods through the AWS Secrets Manager CSI driver over IRSA. No manual steps between a merged PR and a running, certificated, DNS-addressable service.

• ArgoCD
• Helm
• GitHub Actions
• cert-manager
• external-dns
• IRSA

A traffic plane cut over live, zero downtime

Chewy · ingress-nginx → Gateway API · shared dual-stack ALBs

North-south traffic ran on ingress-nginx. I migrated the traffic plane to Gateway API on the AWS Load Balancer Controller: shared dual-stack ALBs in front of the clusters, with routing declared as HTTPRoutes instead of annotation-heavy Ingress objects.

The cutover — Ingress to HTTPRoute — happened on live clusters with zero downtime, because a traffic plane is exactly the layer you don't get to take down to replace.

• Gateway API
• AWS Load Balancer Controller
• ALB
• EKS

Moving live infrastructure without downtime

Samsara · 200+ resources · 5 AWS accounts

I migrated live infrastructure from CloudFormation to Terraform — 200+ resources across 5 AWS accounts — with zero downtime, behind a documented runbook and rollback plan for every stage.

The same modernization took IAM with it: long-lived users and static access keys replaced with role-based access — 50+ roles scoped with permission boundaries, cross-account access via STS assume-role — and zero standing access keys in CI once the pipelines moved to GitHub Actions OIDC federation.

• Terraform
• CloudFormation
• IAM · STS
• GitHub Actions OIDC