I run Kubernetes platforms that stay up — and pay for themselves.

Karpenter: a third off the compute bill

Chewy · fleet ~200 → ~140 nodes · scale-up ~5 min → ~45 sec

Node provisioning ran on Cluster Autoscaler: slow to react — around five minutes for capacity to arrive — and chronically over-provisioned, because node groups can't right-size to what pods actually request.

I migrated provisioning to Karpenter: just-in-time nodes sized to the pending pods, with workload consolidation packing the fleet tighter as demand moves. Workloads are split across NodePools — spot instances for general workloads, on-demand for critical cluster operations — enforced with taints and tolerations so nothing critical lands on capacity that can disappear.

The fleet went from roughly 200 nodes to 140 — about 30% off compute spend — and node scale-up dropped from ~5 minutes to ~45 seconds, which is the difference developers actually feel.

• Karpenter
• EKS
• Terraform
• EC2 Spot

Agent skills that gate infrastructure changes

Chewy · 15+ Claude Code skills · CI review gates at PR time

Review is where expensive mistakes get caught, and it's inconsistent — a careful reviewer catches a destructive Terraform change at 9am and misses it at 6pm. I built 15+ Claude Code agent skills for our infra and deployment work so the thorough version is the default. The three I go deepest on: a Terraform plan reviewer that risk-tiers every change and leads with an apply/don't-apply verdict, a Kubernetes manifest reviewer that checks limits, probes, image pinning and RBAC, and an incident-triage assistant that walks a firing alert change-first.

Each skill pairs the model's judgment with a deterministic Python script: the script parses the actual plan JSON or YAML and reports exactly what's there — every destroy, every IAM widening, every missing limit — and exits non-zero on critical findings so CI can block a bad apply. The model explains and prioritizes; it doesn't invent findings.

I validated them with an eval loop — every test case run with and without the skill, graded against fixed checks. The honest result: the base model is already strong, and the repeatable win is determinism plus safety discipline. The skills recommend rollbacks; they never run them.

• Claude Code
• Python
• GitHub Actions
• Terraform
• Kubernetes

GitOps with nothing hand-deployed

Chewy · 40+ apps · 7 EKS clusters

App delivery is declarative, pull-based GitOps with ArgoCD: Git is the source of truth, GitHub Actions runs the promotion pipeline that updates it, and ArgoCD reconciles the clusters to match — with automated drift detection and rollbacks that are just a revert.

The platform plumbing is automated to the same standard: cert-manager syncs TLS certificates with ACM, external-dns manages Route53 records, and secrets reach pods through the AWS Secrets Manager CSI driver over IRSA. No manual steps between a merged PR and a running, certificated, DNS-addressable service.

• ArgoCD
• Helm
• GitHub Actions
• cert-manager
• external-dns
• IRSA

A data layer with zero standing credentials

Chewy · Multi-AZ PostgreSQL on RDS · recovery drilled, not assumed

The databases run Multi-AZ PostgreSQL on RDS with no static credentials anywhere: pods mint short-lived tokens through IAM database authentication over IRSA, so there is nothing to rotate and nothing to leak.

Recovery is proved, not assumed — EventBridge-driven snapshot lifecycle, and point-in-time-recovery restore drills that actually run, because a backup you've never restored is a hope, not a plan.

• RDS
• IAM · IRSA
• EventBridge
• Lambda

Moving live infrastructure without downtime

Samsara · 150+ resources · 5 AWS accounts

I migrated live infrastructure from CloudFormation to Terraform — 150+ resources across 5 AWS accounts — with zero downtime, behind a documented runbook and rollback plan for every stage.

The same modernization took IAM with it: long-lived users and static access keys replaced with role-based access — 50+ roles scoped with permission boundaries, cross-account access via STS assume-role — and zero standing access keys in CI once the pipelines moved to GitHub Actions OIDC federation.

• Terraform
• CloudFormation
• IAM · STS
• GitHub Actions OIDC