Sergey StebakovSite Reliability Engineer

About

• RDS refused connections at 10% CPU: default connection pools times replicasLoad tests hit a flat plateau of ~420 database connections and the request was for a much bigger database. The real ceiling was max_connections versus Npgsql default pools.12 October 2026
• Calico was Ready with no errors, and every new pod was unreachable for half a minuteAfter a Calico upgrade, fresh pods were blackholed for 15–42 seconds. Felix was stuck in an XDP resync loop that only a cross-node, fresh-pod test could see.10 October 2026
• Kubernetes 1.32 to 1.37 in one day, five hops, without the kubespray that built the clusterAn end-of-life bare-metal cluster, a lost kubespray inventory and binaries outside any package manager. How five kubeadm hops went in one day, and the traps no plan listed.10 October 2026
• It worked for a minute, then timed out: MetalLB L2 with kube-proxy ipvs and no strictARPMoving hosts to a new LoadBalancer IP worked briefly, then an external load balancer saw Layer 4 timeouts. Every node was answering ARP for the same IP.10 October 2026
• The certificates expired on schedule. The alert fired for a week — into nowhereA kubeadm cluster lost its control plane exactly one year after install. The expiry alert had been firing for seven days, but Alertmanager only had a null receiver.9 October 2026

Experience

1. Jun 2026 — present

   Site Reliability Engineer (SRE) · Gambchamp · Tbilisi

   Site reliability for a multi-tenant product platform on AWS EKS: SLIs and SLOs, observability and alerting, incident response and on-call duty, split-horizon DNS and private networking, database operations.

   • Co-built from scratch in Terraform the AWS (sa-east-1) production platform for a new online-casino product in LatAm: EKS, RDS PostgreSQL, a VPC with internet-facing and internal NLBs behind Cloudflare, VPN-only private hosts and a from-zero DR runbook. My part: the Terraform import, RDS safeguards and the cutover from a Multi-AZ instance to a Multi-AZ DB cluster with near-zero data loss.
   • Introduced SLOs, error budgets and multi-window burn-rate alerting on VictoriaMetrics, and built the platform SRE dashboard: RED and USE, route-level latency, time-to-OOM and time-to-full forecasts, RDS/PostgreSQL and Kafka health.
   • Extended OpenCost to AWS: a spot pricing feed and Cloud Costs from the AWS Cost and Usage Report via Athena and Glue; Trivy Operator image scanning in production.
   • Prepared, with the team, the move of an 8-node dev cluster from OpenStack-based managed Kubernetes to AWS EKS on the same Terraform blueprint; wrote the data migration runbook, the RDS and Redis monitoring and a dedicated Alertmanager with its own Slack workspace.
   • Found that 27 Vault policies silently denied what they declared because of a mid-path glob, and fixed the ACL model.
   • Restored alerts that fired but lost their cluster label in aggregation, and replaced name-based alert routing that had caused three outages from one root cause.
   • Diagnosed RDS refusing connections at about 10% CPU (default client pools times replicas), per-route p99 latency regressions, and NotReady nodes that were memory thrashing rather than dead.
2. Nov 2025 — Jun 2026

   Senior DevOps Engineer · Gambchamp · Tbilisi

   Kubernetes automation, GitOps with Argo CD and cloud infrastructure for the product platform; groundwork for the SRE practice.

   • One of the two main contributors to the team Argo CD app-of-apps for about ten clusters and environments (213 commits in a year); onboarded new client environments.
   • Introduced cost visibility with OpenCost, including the Servercore billing integration and a Grafana PostgreSQL datasource.
   • Stood up Harbor on S3 storage, Vaultwarden, and blackbox monitoring of backend health and public availability.
3. Aug 2024 — present

   DevOps / SRE Engineer · Optimacros · Remote

   Platform engineering for bare-metal and EKS Kubernetes: CI/CD, GitOps, DevSecOps and day-2 operations.

   • Built and run, nearly single-handedly (about 95% of the commits), the GitOps repository behind the company marketing platform: Argo CD app-of-apps with an ApplicationSet per WordPress site, Vault and VSO, Kyverno, a MySQL operator, blackbox monitoring and Ansible for the hosts.
   • Migrated 27 Ingress resources from the retired ingress-nginx to Envoy Gateway (39 HTTPRoutes, 16 hosts) with zero downtime.
   • Upgraded a bare-metal Kubernetes cluster from 1.32 to 1.37 in one day — five hops — without the original kubespray inventory.
   • Moved production storage from Longhorn to LINSTOR (Piraeus) and Vault from Shamir to transit auto-unseal.
   • Moved alerting to ground-truth signals after a green CRD status hid five days of a MySQL InnoDB Cluster without HA, and rebuilt alert delivery after a certificate-expiry alert went to a null receiver.
   • Fixed intermittent L4 timeouts behind an external load balancer: MetalLB L2 with kube-proxy in IPVS mode without strictARP.
   • DevSecOps in GitLab CI with SonarQube, Trivy and Suricata; a PHP CVE fix rolled out to every landing site canary-first; runbooks for upgrades, rolling node patching and storage migrations.
4. Feb 2023 — Apr 2025

   DevOps / Linux Engineer · Sberbank-Service · Moscow

   Infrastructure for an enterprise video-conferencing platform on Huawei, Dell and HPE hardware.

   • Built blue-green delivery on Docker and Kubernetes with Kafka, ClickHouse, Terraform and ELK.
   • GitLab CI pipelines, Zabbix and Prometheus monitoring, Proxmox and VMware virtualisation; mentored junior engineers.
5. Jun 2020 — Feb 2023

   Linux Engineer · Open Selection LLC · Moscow

   Linux and VMware operations with 24/7 incident response.

   • Bare metal end to end: sizing, procurement, racking servers and network gear.
   • Automation and internal bots in Python.

Projects

1. 2024 — present

   Home lab — a small production-grade platform · Owner, everything from hardware to GitOps

   Where risky changes get rehearsed before they reach anyone else's production: a Proxmox host, a seven-node kubeadm cluster and a multi-site MikroTik network.

   • Kubernetes 1.37 on kubeadm: Cilium without kube-proxy and Gateway API, LINSTOR (Piraeus) storage, Vault HA with transit auto-unseal, Argo CD app-of-apps; self-hosted GitLab, Harbor, SonarQube and CI runners.
   • Observability: Prometheus, Grafana, Loki and Alloy, plus RouterOS metrics; certificates from cert-manager (DNS-01) pushed to the routers over the RouterOS REST API by a CronJob.
   • MikroTik network: RB5009 and hEX S gateways, CAPsMAN-managed Wi-Fi, WireGuard between three sites and for road warriors, DNS-as-code with BIND9 in a RouterOS container deployed from GitLab CI.
   • Hardware: Proxmox VE upgrades across major versions, GPU passthrough for hardware video transcoding, PCIe and NVMe passthrough, OpenWrt flashing; publishing through Cloudflare Tunnel behind an ISP that blocks inbound ports.
2. Jul — Oct 2026

   Partetura (StudioFlow) — SaaS for video production · Platform and DevOps, side project with a co-founder

   Two-sided platform for video studios and freelancers (EN/RU/KA). I owned the infrastructure and the move off Supabase Cloud to self-hosted Kubernetes.

   • Migrated the stack from Supabase Cloud to Kubernetes via Argo CD: CloudNativePG with schema migrations as a PreSync hook, Zitadel for OIDC, MinIO for storage, Redis and BullMQ workers, Vault with the Secrets Operator.
   • Built the delivery path: GitLab CI builds to Harbor, GitOps deploys, a typecheck gate before every image; public access through Cloudflare.

Focus

Stack

• Linux
• Kubernetes
• Argo CD
• GitLab CI
• Helm
• Terraform
• Terragrunt
• Ansible
• Docker
• Prometheus
• Grafana
• VictoriaMetrics
• Zabbix
• Python
• Golang
• Bash
• Nginx
• PostgreSQL
• ClickHouse
• Proxmox
• VMware
• DevSecOps
• SonarQube
• Trivy
• S3
• RabbitMQ
• Kafka
• Bare metal
• Cilium
• Gateway API
• AWS
• Vault
• OpenTelemetry
• VictoriaLogs
• CloudNativePG
• MikroTik RouterOS
• WireGuard
• BIND9
• Cloudflare