Skip to content
felicity.lois// Cloud & devops
Back to Portfolio

Enterprise Vendor Platform

AKS Kubernetes Platform with GitOps

Project Overview

Designed and implemented a Kubernetes-based application platform on Azure Kubernetes Service (AKS) for a large US IT solutions provider with multi‑billion‑dollar annual revenue and a nationwide enterprise customer base. The platform underpins the company's enterprise vendor commerce ecosystem, which manages roughly $1B+ in annual recurring revenue (ARR) and thousands of partner transactions. The solution standardizes how services for the vendor platform are deployed, secured, and observed, using Terraform for infrastructure as code, Argo CD for GitOps-driven continuous delivery, and Istio Ambient for zero‑trust service mesh capabilities. Policy enforcement is handled through Kyverno, secrets are managed with SOPS and Azure Key Vault, and cert-manager automates SSL/TLS. Containers are built with Docker and deployed to AKS, while Datadog provides end‑to‑end monitoring across applications and infrastructure, enabling proactive detection and rapid remediation of issues in a high‑revenue environment.

Problems

  • The existing enterprise vendor platform suffered from inconsistent, manual deployment processes, leading to configuration drift, longer release cycles, and higher operational risk.
  • Uptime and reliability were difficult to guarantee due to limited observability, fragmented monitoring, and reactive incident response.
  • Secrets and configuration were managed in an ad‑hoc way across environments, increasing the risk of misconfigurations and security exposure.
  • Scaling infrastructure and services to support a high‑revenue, mission‑critical platform required stronger standardization, guardrails, and automation to meet business continuity expectations.

Goals

  • Establish a repeatable, GitOps-based deployment model so all application and infrastructure changes flow through version control, review, and automated rollout to AKS, reducing manual intervention and drift.
  • Improve reliability and uptime of the vendor platform by adopting Kubernetes, service mesh, and Datadog-based observability, enabling faster detection, alerting, and troubleshooting of issues that impact revenue.
  • Implement policy as code and secure secrets management (Kyverno, SOPS, Azure Key Vault, cert-manager) to enforce security and compliance across clusters and environments.
  • Create a scalable, cloud-native foundation that supports future growth in vendor integrations and transaction volume, while giving the engineering and operations teams a consistent, automated platform to build on.

Role & Responsibilities

  • Led the design and implementation of the AKS-based platform, including Terraform IaC, Argo CD GitOps workflows, and cluster baseline configuration.
  • Defined Kubernetes multi-environment strategy (dev/stage/prod), RBAC, and namespace layout to support multiple vendor-facing services.
  • Implemented policy as code with Kyverno and secrets management with SOPS + Azure Key Vault, integrating them into the GitOps pipeline.
  • Built Datadog dashboards and alerts to monitor cluster health, application SLIs, and deployment quality.

Architecture & Deployment Flow

  • Terraform provisions AKS, node pools, networking, Azure Key Vault, and Datadog integrations.
  • Application and infrastructure definitions live in Git (Bitbucket) and are deployed via Argo CD using a GitOps 'app of apps' pattern.
  • Istio Ambient secures and manages traffic between services; Kyverno enforces security and configuration policies at admission time.
  • SOPS-encrypted Kubernetes manifests pull secrets from Azure Key Vault at deploy time, keeping Git history safe.
  • Datadog ingests logs, metrics, and traces from AKS and workloads to power dashboards and alerts.

Results & Impact

  • Reduced manual changes to the vendor platform by moving deployments to a fully GitOps-driven model, cutting configuration drift and deployment errors.
  • Improved reliability and incident response through Datadog dashboards and alerts, enabling faster detection of issues affecting high-value vendor transactions.
  • Standardized policies and secrets management across environments, strengthening security posture and making compliance audits easier.

Technology Stack

Cloud & Orchestration

  • Kubernetes
  • Azure Kubernetes Service (AKS)

Infrastructure & Policy

  • Terraform
  • Kyverno

Containers

  • Docker
  • Azure Kubernetes Service (AKS)

Secrets & Security

  • SOPS
  • Azure Key Vault
  • cert-manager

Service Mesh

  • Istio Ambient

GitOps & Continuous Delivery

  • ArgoCD
  • Bitbucket

Monitoring & Observability

  • Datadog