Vincent De Smet

Building CDKTF GPL 3.0 construct library (Typescript + Golang) for fun
https://github.com/envtio/base

• Ported AWS CDK L2 constructs to CDKTF
• Implemented integration testing of all core library components leveraging Terratest and OpenTofu for maximum test coverage
• Library includes L2 constructs for
• AWS IAM Roles, Policies, Policy attachments and conversion between Terraform PolicyDocument and AWS IAM Policy strings.
• Full Aws StepFunctions State Machine support (including strongly typed Tasks for SQS, S3, EventBridge, Lambda, Http, …)
• Conversion between Construct tree dependencies into Terraform Resource dependencies
• Design and implement parts of CLI for CDKTF automation as part of a group of open source collaborators.. CLI provides orchestration to pull and deploy this construct library.

Rolled out Terraform automation with Atlantis, AMI builds with Hashicorp Packer, e2e testing with Terratest. Drove adoption of CDK, CDK Pipelines, Projen + IaC integration patterns. Defined GitHub Actions tooling & best practices for custom Actions (TS + Jest Unit testing) & private package hosting using GitHub Packages. Drove migration to gitOps (ArgoCD) + CDK8s. Managed full Zero Trust solution roll out.

• Joined as 3rd SRE to support multiple product teams with their existing AWS and k8s infrastructure.
• Implemented first iteration of AWS SSO, deprecating shared IAM Roles and long lived Access Keys
• Implemented Hashicorp Packer AWS AMI build pipelines & Terratest for e2e.
• Rolled out secure host access with AWS SSM Session Manager
• Iterated on AWS CDK adoption, implementing first constructs for CDK Pipelines.
• Implemented first iteration of internal CDK8s Chart with CSI support for secret management and
• Developed internal projen.io Project types for the team to ensure maintainable and consistent AWS CDK + CDK8s codebase for all microservices. providing golden path for linting, package management and CI/CD with automated upgrade flows for long term maintenance.
• Benchmarked and rolled out Zero Trust solution within less than 1.5 Months. Provided PoC zero trust access for RDS, ElastiCache, Atlas Hosted Mongodb as well as EKS control planes. Delivered User guides for all product engineers for successful Zero Trust trial. Ensuring DevX, Audit and Break Glass requirements were met. Designed and implemented full IaC automated goteleport SaaS configuration. Rolled out agents across all AWS Org accounts and regions by leveraging KMS encrypted AMIs built with packer, validated with Terratest and deployed through internal Terraform module. Rolled out goteleport agents for all EKS clusters using CDK8s and GitOps.

Introduced IaC (TF) management with Terragrunt. Built & maintained Golang cli for ArgoCD (GitOps) adoption (Helm + last-mile customizations with Kustomize). Provided CI/CD PoC with Tekton. Guided migration from BitBucket to GitHub + GHA. Defined AWS VPCs (3-tier subnets+NACLs). Drove SSO adoption (AWS SSO & Okta) + OIDC integration to ALBs and migrated (shadow IT) self-hosted Nexus Repository to scalable AWS CodeArtifact.

• Joined an existing team of engineers at early stage IaC and GitOps adoption for a new Java Spring based microservices backend
• Introduced Terragrunt to handle Terraform configuration sprawl across 15+ AWS Accounts (scaled this up to 40+ AWS Accounts managing large scale refactorings with cross account Migrations)
• Deployed Atlantis to resolve IaC drift caused by lack of IaC Automation
• Introduced strong TF Module versioning and publishing to help manage propagation of IaC across environments
• Migrated EOL kops managed k8s clusters to TF Managed EKS clusters
• Introduced secret management for GitOps workflows using AWS KMS
• Rreplaced ArgoCD Helm plugin driven k8s deployments with an in-house Golang CLI. This CLI automated the git heavy processes required for GitOps. Iterated on the functionality by adding convenience methods for last mile customizations. (for example: adopted json-patching libraries from Kustomize for direct support into the cli).
• Supported data team with Airflow adoption, designing k8s and AWS native Airflow Helm chart (making use of the new Airflow k8s schedulers and task runners).
• Iterated on Zero Trust solutions away from Pritunl+Bastion configurations, building Pritunl Zero AMIs with Packer, managing ALB OIDC listener rules with Terraform and ultimately after helping to hire DevSecOps team members and collaborating on the engineering team adoption of goteleport for Zero trust.