Sergey StebakovSite Reliability Engineer

About

• RDS refused connections at 10% CPU: default connection pools times replicasLoad tests hit a flat plateau of ~420 database connections and the request was for a much bigger database. The real ceiling was max_connections versus Npgsql default pools.12 October 2026
• Calico was Ready with no errors, and every new pod was unreachable for half a minuteAfter a Calico upgrade, fresh pods were blackholed for 15–42 seconds. Felix was stuck in an XDP resync loop that only a cross-node, fresh-pod test could see.10 October 2026
• Kubernetes 1.32 to 1.37 in one day, five hops, without the kubespray that built the clusterAn end-of-life bare-metal cluster, a lost kubespray inventory and binaries outside any package manager. How five kubeadm hops went in one day, and the traps no plan listed.10 October 2026
• It worked for a minute, then timed out: MetalLB L2 with kube-proxy ipvs and no strictARPMoving hosts to a new LoadBalancer IP worked briefly, then an external load balancer saw Layer 4 timeouts. Every node was answering ARP for the same IP.10 October 2026
• The certificates expired on schedule. The alert fired for a week — into nowhereA kubeadm cluster lost its control plane exactly one year after install. The expiry alert had been firing for seven days, but Alertmanager only had a null receiver.9 October 2026

Experience

1. Jun 2026 — present

   Site Reliability Engineer (SRE) · Gambchamp · Tbilisi

   Site reliability for a multi-tenant product platform on AWS EKS: SLIs and SLOs, observability and alerting, incident response, split-horizon DNS and private networking, database operations.

   • Introduced SLOs, error budgets and multi-window burn-rate alerting on VictoriaMetrics, with a dedicated Alertmanager route and chronic-alert handling.
   • Moved production PostgreSQL from an RDS Multi-AZ instance to a Multi-AZ DB cluster with near-zero data loss, and migrated a managed PostgreSQL cluster to Amazon RDS.
   • Found that 27 Vault policies silently denied what they declared because of a mid-path glob, and fixed the ACL model.
   • Restored alerts that fired but lost their cluster label in aggregation, and replaced name-based alert routing that had caused three outages from one root cause.
   • Diagnosed RDS refusing connections at about 10% CPU (default client pools times replicas), per-route p99 latency regressions, and NotReady nodes that were memory thrashing rather than dead.
2. Nov 2025 — Jun 2026

   Senior DevOps Engineer · Gambchamp · Tbilisi

   Kubernetes automation, GitOps with Argo CD and AWS infrastructure for the product platform; groundwork for the SRE practice.

3. Aug 2024 — present

   DevOps / SRE Engineer · Optimacros · Remote

   Platform engineering for bare-metal and EKS Kubernetes: CI/CD, GitOps, DevSecOps and day-2 operations.

   • Migrated 27 Ingress resources from the retired ingress-nginx to Envoy Gateway (39 HTTPRoutes, 16 hosts) with zero downtime.
   • Upgraded a bare-metal Kubernetes cluster from 1.32 to 1.37 in one day — five hops — without the original kubespray inventory.
   • Moved production storage from Longhorn to LINSTOR (Piraeus) and Vault from Shamir to transit auto-unseal.
   • Exposed five days of a MySQL InnoDB Cluster running without HA behind a green CRD status, and moved alerting to ground-truth signals.
   • Rebuilt alert delivery after finding a certificate-expiry alert routed to a null receiver and a production TLS expiry hidden by an external front.
   • Fixed intermittent L4 timeouts behind an external load balancer: MetalLB L2 with kube-proxy in IPVS mode without strictARP.
   • DevSecOps in GitLab CI with SonarQube, Trivy and Suricata; Helm and Argo CD across environments; runbooks for upgrades, rolling node patching and storage migrations.
4. Feb 2023 — Apr 2025

   DevOps / Linux Engineer · Sberbank-Service · Moscow

   Infrastructure for an enterprise video-conferencing platform on Huawei, Dell and HPE hardware.

   • Built blue-green delivery on Docker and Kubernetes with Kafka, ClickHouse, Terraform and ELK.
   • GitLab CI pipelines, Zabbix and Prometheus monitoring, Proxmox and VMware virtualisation; mentored junior engineers.
5. Jun 2020 — Feb 2023

   Linux Engineer · Open Selection LLC · Moscow

   Linux and VMware operations with 24/7 incident response.

   • Bare metal end to end: sizing, procurement, racking servers and network gear.
   • Automation and internal bots in Python.

Focus

Stack

• Linux
• Kubernetes
• Argo CD
• GitLab CI
• Helm
• Terraform
• Terragrunt
• Ansible
• Docker
• Prometheus
• Grafana
• VictoriaMetrics
• Zabbix
• Python
• Golang
• Bash
• Nginx
• PostgreSQL
• ClickHouse
• Proxmox
• VMware
• DevSecOps
• SonarQube
• Trivy
• S3
• RabbitMQ
• Kafka
• Bare metal
• Cilium
• Gateway API
• AWS
• Vault
• OpenTelemetry
• VictoriaLogs
• CloudNativePG