DevOps / SRE engineer · Kubernetes · HA databases

I break thingson purpose, soproduction doesn't.

I'm a DevOps/SRE engineer with 4+ years of building and running Kubernetes platforms, highly available databases and the DNS and TLS edge in front of them. I don't trust a system until I've broken it on purpose and watched it recover, so I rehearse failures and publish the drills. Open to remote or relocation.

Email Aryan Watch a database failover ▸ LinkedIn
scroll to fly through the system

The 30-second version

for recruiters
Role
DevOps / SRE Engineerplatform, reliability, delivery
Experience
4+ years in DevOpssince Jan 2022 · two of four roles part-time
Now
DevOps Engineermulti-tenant SaaS · since May 2025
Location
Tehran, Iran · UTC+3:30open to remote and relocation
Hands-on with
Kubernetes, replicated PostgreSQL and MongoDB, self-hosted DNS and TLS, monitoringmostly self-hosted, often on restricted networks
Contact
[email protected]email is fastest
Measure, don't assumeEvery claim on this page has a number behind it, and every number links to the repo that produced it.
Rehearse failureI kill primaries, restore backups and inject errors in drills, so the first time isn't during an outage.
Automate the boring pathInfrastructure as code, GitOps and CI that fails loudly. If I did it twice by hand, it becomes a script.
Write it downRunbooks, postmortems and READMEs that someone else can follow at 3 a.m.

Keywords: Kubernetes · Docker · Helm · Argo CD · GitOps · Terraform · Ansible · CI/CD (GitHub Actions, GitLab CI, Jenkins) · Prometheus · Grafana · Loki · ELK · PostgreSQL · Patroni · MongoDB · Valkey/Redis · Nginx · Caddy · PowerDNS · TLS/ACME · Linux · AWS (EC2, S3) · Python · Shell

00 / the request · browser to database and back

What happens between Enter and the first byte.

Follow one request through a stack I run, from the browser to the database and back. The timings are real: medians of 876 probes my own monitoring sent to a production site, through the CDN, over 12 hours.

https://site.example
total ~101 ms median · 876 probesDNS is 82% of it. Browsers cache it, so a returning visitor usually skips that step.

    The site's real hostname is hidden. Probes run every 15 s from my monitoring host through the public CDN path; numbers are 12-hour medians from Prometheus.

    01 / edge · DNS, CDN, TLS

    I run the front door: DNS, CDN and TLS.

    When customers bring their own domains, someone has to answer DNS for them and hand out certificates without opening the door to abuse. That's the part I build.

    0 vs 30certificate orders from a flood of made-up names, with my allowlist gate on vs off
    • at workSelf-hosted PowerDNS with API-driven automation, and certificates issued and renewed automatically for customer domains.
    • my labtls-edge-on-demand: Caddy on-demand TLS behind an allowlist service I wrote, with a drill that floods it with made-up names.
    LearnedRemoving a tenant from the allowlist does not revoke its certificate. It keeps being served from cache, so cutting someone off also means stopping their traffic.
    tls-edge-on-demand →
    02 / platform · Kubernetes, Docker

    Clusters that deploy even when the internet doesn't cooperate.

    Most public registries are blocked from Iran. I keep production shipping anyway.

    18/18app instances updated one at a time with no downtime: a rolling deploy, replayed in the 3D view
    • at workHarbor as an in-country registry, so deployments stop depending on blocked registries; mirrors and toolcaches for CI.
    • my labgitops-platform: Argo CD app-of-apps on kind, dev and staging from one set of manifests, default-deny network policy proven on a live cluster.
    Learned"Synced / Healthy" in Argo CD can be stale. The wait script checks that the synced revision equals the commit just pushed.
    gitops-platform →
    03 / data · PostgreSQL, MongoDB, Valkey

    Kill the primary database. Count what gets lost.

    This replays the failover drill from my Patroni lab: the main database dies while an app is writing to it. Watch how long writes stop, and whether any confirmed write disappears.

    17.0s without writes
    17.0 s · 0 writes lost

      In plain terms: the main database died, saving paused for 17 seconds, then a standby took over and not one saved record was lost.

      Lab replay at 3× speed. Measured run: largest gap between two acknowledged writes 17,045 ms; 0 acknowledged writes lost; old primary rejoined as a replica.

      • at workPatroni PostgreSQL, MongoDB replica sets and Valkey with Sentinel: failovers, replica rebuilds and backups I handle in production.
      • my labWhy 17 s: nobody is promoted until the dead leader's lock expires (ttl 15 s) and HAProxy notices (2 × 1 s checks). Why 0 lost: synchronous replication acknowledges a commit only once a standby has it.
      LearnedThe first restore from backup failed: Patroni writes absolute paths into postgresql.conf. You only find that out by restoring.
      patroni-ha-lab →
      04 / observability · metrics, logs, alerts

      Monitoring that I monitor too.

      I built the monitoring for a production server from scratch with Terraform, then ran it under synthetic traffic overnight.

      0failed of 243,360 requests in a 9-hour synthetic soak (~7.5 req/s, p95 9 ms)
      • my buildinfra-observability: Prometheus, Alertmanager, Grafana, Loki and Alloy deployed by Terraform; nginx logs turned into per-site error and latency metrics; 22 alert rules.
      • my labsre-observability: multi-window burn-rate SLO alerts, unit-tested with promtool. The page fires about 20 s after injecting 30% errors and clears about 14 s after the fix.
      Incident · 5–6 Oct 2026 · my own monitoring stack
      1. Host load jumps to 12 right after deploy. cAdvisor hit its 256 MB limit and was swapping; disk I/O at 100%.
      2. Fixed: every container gets memory_swap = memory; cAdvisor's disk metric disabled. Load back under 1.
      3. Grafana 13 tries to update its own Prometheus and Loki plugins. The plugin CDN answers 403 to Iranian IPs and leaves them unregistered: every dashboard silently shows "No data".
      4. Found from a screenshot, fixed by disabling plugin auto-install. Prometheus kept every sample, so no data was lost.
      5. I now verify dashboards through Grafana's own query API, not only against Prometheus.
      infra-observability →sre-observability →
      05 / delivery · CI/CD, GitOps, IaC

      Pipelines that tell the truth.

      Every change reaches production through git, and through a pipeline that fails loudly instead of quietly.

      • at workJenkins, Argo CD, GitLab CI and Gitea Actions across development, staging and production; SonarQube code inspection.
      • my labci-cd-reference: toolchain preflight, secret scanning, matrix builds with SBOMs, one required gate, and a watchdog that opens an issue when the newest commit on main was never tested.
      • my labsre-runbooks: on-call runbooks that each state how they were verified; CI rejects one with a missing section.
      LearnedCancelling in-progress CI runs keeps main fast but can leave the newest commit untested. That is why the watchdog exists.
      ci-cd-reference →sre-runbooks →
      06 / career

      Four stages passed. The next one is yours to approve.

      ✓Jan 2022 – Jul 2023ClassehKubernetes clusters, CI/CD, BigBlueButton live classesfull-time
      ✓Aug 2023 – May 2025VItechKubernetes, Jenkins + Argo CD, AWS EC2/S3, DR planspart-time
      ✓Jul – Sep 2024ShopFAShared hosting to own servers, Prometheus + Grafanapart-time project
      ✓May 2025 – nowClassehRejoined to own HA data, the PowerDNS edge, observabilityfull-time
      07 / public labs

      Seven repos you can run yourself.

      Published in October 2026. Each rebuilds, in public and in miniature, something I run at work. Five of the seven ship a drill that proves their claim in CI.

      08 / contact

      Let's talk.

      Remote or relocation. Email is the fastest way to reach me.

      Email me LinkedIn GitHub aryankasraee.ir