Sindre Grytebust sindredg

Cloud platforms and the identity systems around them.
_{Build notes, architecture decisions, testing, and troubleshooting.}

_{Completed lab / Google Cloud + Kubernetes}

Kubernetes platform & AI security triage

A private GKE cluster serving public workloads. Keyless delivery, measured rollouts, failure drills, and an AI agent that triages security findings.

Explore the project · Decisions · Worklogs · Shutdown notes

_{Infrastructure retired in September 2026; code, worklogs, and validation notes remain.}

_{8 Pods · no failures}

_{Median deployment}

_{Rollout connection failures}

Terraform GKE GitHub Actions Cloud Armor Vertex AI Go

Under the hood: platform, delivery, and AI triage

Platform: private nodes, custom VPC, Cloud NAT, Gateway API, managed TLS, and autoscaling across three zones.
Delivery & operations: keyless federation, immutable images, gated rollouts, default-deny networking, Cloud Armor, and failure drills.
AI triage: Security Command Center findings flow through Pub/Sub to a worker with four scoped grants. Rules run before Vertex AI; verdicts go to an append-only ledger.

Entra ID → AWS Workforce identity across clouds. Federation, SCIM provisioning, and governed access to AWS. _{ENTRA ID / AWS / TERRAFORM}	Azure hybrid networking Hub-and-spoke networking with an encrypted cross-premises tunnel, private endpoints, and two-way DNS. _{AZURE / VPN / PRIVATE LINK}
Two-site hybrid identity A two-site Active Directory forest synced to Entra ID, with hybrid endpoints and policy-enforced security baselines. _{AD DS / ENTRA ID / POWERSHELL}	Azure Container Apps A public web tier and private API, with passwordless image pulls, scale-to-zero, and automated delivery. _{TERRAFORM / CONTAINERS / CI/CD}

Other projects

AI security triage: Rules, scoped model access, and an auditable verdict ledger for cloud security findings.
Identity governance: Conditional Access, just-in-time administration with PIM, and access reviews.
Grafana SSO & provisioning: OIDC sign-in, app-role mapping, and a custom SCIM bridge.
Sky: An application deployed on the Kubernetes platform.
OAuth 2.0 in .NET: API authorization through scopes, app roles, groups, and token claims.
Azure MCP & RBAC: Scoped, read-only Azure access for Claude, enforced through Azure RBAC.

_{Notes on building and testing cloud infrastructure.}