anoobis bhaskaran
Cloud infrastructure engineer,
Azure-native, closing the AWS gap.
14+ years in IT, the last 8 years running cloud operations at LiSEC Austria — hybrid AKS and on-prem infrastructure across multiple regions. Currently a Cloud Specialist, working toward a cloud architecture role.
case study — multi-cloud terraform
One module interface, two clouds.
A private showcase repo implementing the same infrastructure design — network, Kubernetes cluster, workload identity, container registry — separately on Azure and AWS, against one shared variable/output interface. The point isn't that both clouds do the same thing; it's naming exactly where they don't.
- Subnet model. Azure spreads a subnet across availability zones automatically; AWS needs one subnet per AZ. The shared interface takes one CIDR per role either way — the AWS module carves it into per-AZ blocks internally.
- Workload identity. AKS auto-exposes an OIDC issuer the moment workload identity is enabled. EKS exposes one too, but AWS doesn't register it as a trusted identity provider automatically — that's a separate resource and a live certificate-thumbprint fetch.
- Registry pull scope. ACR pull access is a role assignment scoped to one registry. ECR pull comes from a managed policy already on the node role — free, but broader than it needs to be. Flagged in the ADR rather than quietly fixed.
case study — opentelemetry observability
Agent, gateway, backend — on-prem and in two clusters.
The same collector pattern used in production at LiSEC, rebuilt from scratch on open-source backends: an agent tier close to the workload, a gateway tier doing the expensive work once, tail sampling that never drops an errored trace.
- Tail sampling, not head sampling. Deciding per-trace before you know if it errored means you can throw away exactly the traces worth keeping. The gateway waits, sees the whole trace, always keeps errors.
- The multi-replica bug this creates. Two gateway replicas for availability means one trace's spans can land on different pods — neither sees the whole trace. Fixed with a load-balancing exporter that hashes by trace ID, so every span of one trace reaches the same replica.
- Same design, two clusters. The AKS and EKS manifests are identical except for one environment variable identifying which cluster the telemetry came from — verified with a diff, not just claimed.
certifications
- Microsoft Certified: Azure Kubernetes Service (AKS) held
- Microsoft Certified: Azure Administrator Associate (AZ-104) held
- Microsoft Certified: DevOps Engineer Expert (AZ-400) held
- OpenTelemetry Certified Associate (OTCA) in progress
contact
Open to cloud architecture and infrastructure leadership roles. Based in the UAE.