`About
The projects below are built and tested in real environments and documented with implementation workflows, architecture overviews, design decisions, trade-offs, validation evidence and troubleshooting records.
| Project | What it is | Stack |
|---|
| Project | What it is | Stack |
|---|---|---|
| GKE Kubernetes Platform Live: sindrg.com |
Private Kubernetes cluster serving live traffic on a custom domain. Terraform provisions VPC, cluster, and reserved address in GCP. GitHub Actions builds non-root image and deploys it by digest using Workload Identity Federation. A Gateway API load balancer terminates managed TLS, redirects HTTP to HTTPS, and routes directly to pod IPs while the Service remains internal. The cluster enforces the restricted Pod Security standard and default-deny NetworkPolicies. | Terraform · GCP · GKE · Gateway API · Certificate Manager · Artifact Registry · Workload Identity Federation · GitHub Actions · OIDC |
| Cross-cloud identity: Entra ID to AWS | In progress: Entra ID as the identity source for AWS. SAML federation and SCIM provisioning connected to AWS IAM Identity Center, attribute-based groups built in Bicep, and lifecycle workflows deployed from version-controlled MS Graph JSONs. Terraform provisions an isolated VPC where Grafana runs on ECS in AWS on a private network, reached over Entra Private Access. Group memberships grants both AWS roles and private access to application. Next: assignment through an access package + Mover and Leaver validation. | Terraform · AWS IAM Identity Center · Entra ID Governance · Entra Private Access · Lifecycle Workflows · SAML · SCIM · Bicep · Microsoft Graph · ECS Fargate |
| Azure Hub-and-Spoke with Cross-Premises Connectivity | Hub-and-spoke network in Azure joined to a simulated on-premises datacenter in another region over an encrypted IPsec tunnel, built one mechanism at a time. Gateway transit, subnet NSGs, Bastion access, forced routing through Azure Firewall, Key Vault behind a private endpoint, and two-way DNS across the tunnel. | Terraform · Azure Networking · VPN Gateway · Hub-and-Spoke · CI/CD · GitHub Actions · OIDC · Azure RBAC |
| Azure Container Platform | A public web tier and an internal API on Azure Container Apps, deployed with Terraform. The API has no public address. Passwordless managed-identity image pulls, health probes, revisions, scale-to-zero, remote state with locking, centralised logging and automated delivery. | Terraform · Azure Container Apps · ACR · Managed Identity · CI/CD · Docker · Nginx · Python/FastAPI |
| Hybrid identity: AD DS synced to Entra ID | Two-site Active Directory forest in Azure, synchronized with Entra ID. Features hybrid-joined endpoints and users, per-machine LAPS credentials, policy-enforced tiered privileged access, and private networks. Built throughout with Terraform and idempotent PowerShell. | Terraform · Azure · Entra ID · Active Directory · Windows Server · Group Policy · Windows LAPS · PowerShell · Entra Connect Sync · GitHub Actions |
| Access Control & Identity Governance | Governs tenant-wide access and access to in-house applications with Entra ID: Conditional Access, just-in-time administration with PIM, entitlement management and access reviews. | Entra ID · Conditional Access · PIM · FIDO2 · Access Reviews · SSO · SCIM · Microsoft Graph PowerShell |
| SSO + SCIM for a Self-Hosted App | Implements the workforce identity lifecycle for self-hosted Grafana: Entra ID as the identity provider, OpenID Connect SSO with app-role mapping, and SCIM provisioning through a custom bridge. | OpenID Connect · SSO · SCIM · Grafana · App Roles · Azure IaaS · Docker |
| Securing AI with MCP Server and RBAC | Gives Claude scoped, read-only access to Azure through the Azure MCP Server, with Azure RBAC as the authoritative control and host/server hardening as defense in depth. | Azure MCP Server · Azure RBAC · Service Principal · Claude |
| Apps, APIs & Access Tokens: OAuth 2.0 in .NET 8 | Builds an Entra ID authorization chain with a protected API and web and daemon clients. Access is modeled through scopes, app roles and groups, then enforced from token claims in a .NET 8 API. | .NET 8 · OAuth 2.0 · OpenID Connect · App Roles · App Registrations · Application Permissions |