I am Usman Malik, a Kubernetes consultant and cloud native architect with 15+ years in Linux, platform engineering and DevSecOps. I design and build private cloud and sovereign cloud platforms on bare metal Kubernetes for critical infrastructure operators and cloud providers. Virtual machines run next to containers, with KubeVirt, Proxmox VE and Cloud Hypervisor as open source alternatives to VMware. When a component breaks on the way, I fix it upstream as an open source contributor to Kubernetes, Talos Linux, OVN-Kubernetes and Ceph. My work also covers supply chain security with Sigstore, SLSA and SBOM, compliance for KRITIS, NIS2 and ISO 27001, and AI inference infrastructure on Kubernetes with vLLM, llm-d and DRA. I am available for 1:1 consulting.

name: Usman Malik
role: Kubernetes consultant and cloud native architect
experience: 15+ years in Linux/UNIX, cloud native and security
now: Senior platform engineer for a sovereign European public cloud
before:
  - Lead core architect, compute and virtualization, European transmission system operator
  - Cloud native platform architect, edge cloud provider
  - Tech lead platform and tech lead IT security, fintech
focus:
  - Private and sovereign cloud on bare metal Kubernetes
  - Virtualization on Kubernetes and open source VMware alternatives
  - L3 data center networking with BGP to the host, EVPN-VXLAN and ECMP
  - Kubernetes operators and controllers that run at scale
  - Supply chain security and compliance for KRITIS, NIS2 and ISO 27001
  - Confidential computing with confidential VMs and confidential containers
  - AI inference infrastructure on Kubernetes
  - Upstream work in Kubernetes, Talos Linux, OVN-Kubernetes and Ceph
talks:
  - 10 minutes from bare metal to KubeVirt, ContainerDays 2023
education: MSc Digital Investigation and Forensic Computing, University College Dublin
certifications:
  - CKS
  - CKA
  - CKAD
  - LFCE
  - LFCS
  - RHCE
community:
  - Red Hat Accelerator, 2023 to now
  - OpenTofu manifesto signatory
fun_fact: "I read RFCs, kernel changelogs and CVE feeds for fun."

Open the diagram full size in light or dark mode.

• Product requirements and the roadmap come first, then the tools. A tool stays when it pays off for the business, the team can run it for years, and it fits the cost and energy budget. The stack in this README is what I use today, and it changes as the requirements change.
• Ownership runs from day 0 design through day 1 rollout to day 2 operations. Day 2 is where most of the work is, with upgrades, incidents, capacity planning and cost.
• Leading the architecture means writing the code for it too. That includes Kubernetes operators and controllers that run at scale, the pull requests that go with them, and the on-call rotation after the release.
• Inside the team, I write design docs with the engineers, agree on trade-offs with the product owners, and review code like any other team member.
• Security and observability go into the first design, because adding them later costs more. I have done bug bounty work and studied digital forensics, so I design with both the attacker and the incident responder in mind. Every component ships with its metrics, logs, traces and alerts.

The diagram is the platform I build. Each marker in it is a pull request in this table.

These are the tools I reach for today. The requirement picks the tool, so the list keeps moving.

• Bare metal cloud with Metal3, Ironic, Cluster API, MAAS, Tinkerbell and Redfish.
• Sovereign cloud building blocks from NeoNephos, including the IronCore metal-operator, and Cozystack for European digital sovereignty.
• Host operating systems such as Talos Linux, Kairos, Flatcar, bootc, Red Hat Enterprise Linux, Ubuntu and SUSE, down to the Linux kernel with eBPF, nftables and IPsec/XFRM.
• Virtualization, microVMs and VMware alternatives with KubeVirt, Proxmox VE, Incus, Cloud Hypervisor, Firecracker, Flintlock, KVM, Kata Containers and Forklift.
• Data center networking with BGP to the host, unnumbered BGP, ECMP, EVPN/VXLAN, BIRD and FRR, from underlay to overlay design.
• Load balancers and API gateways, from HAProxy, Envoy, LoxiLB, MetalLB and Katran to Gateway API with Envoy Gateway, kgateway, Kong, Traefik, APISIX and Emissary-ingress.
• Kubernetes and operators with DRA, Kueue, kubebuilder, controller-runtime, OVN-Kubernetes, kube-ovn, Cilium and Multus.
• Multi-cluster and fleets with Karmada, Clusternet, k0smotron, k0rdent, Kamaji, Rancher, Fleet and Cluster API.
• Zero trust networking with Istio, Linkerd, Cilium service mesh, Kuma and Kmesh, using mTLS and SPIFFE/SPIRE workload identity.
• Identity and access through Keycloak, Authentik, Authelia, Teleport, OpenZiti and SpiceDB.
• Storage and databases on Ceph, Rook, LINSTOR, Garage, SeaweedFS, CloudNativePG, TimescaleDB, Redis, Valkey and Velero.
• Streaming and messaging on Kafka, NATS, Redpanda, Pulsar and RabbitMQ.
• GitOps and platform engineering with Argo CD, Flux, kro, Carvel, Crossplane, OpenTofu and Backstage, fed by Git and OCI registry mirrors such as GitLab and Harbor.
• CI/CD pipelines in GitHub Actions, GitLab CI, Jenkins, Tekton and Earthly.
• Supply chain security with Sigstore, Cosign, SLSA, in-toto attestations, SBOMs from Syft, Trivy, Kyverno, OPA Gatekeeper, SOPS and OWASP practices.
• Runtime security and confidential computing with Falco, Tetragon, eBPF profiling and gVisor, confidential VMs on AMD SEV-SNP and Intel TDX, Confidential Containers, Kata Containers and Constellation, plus secrets in HashiCorp Vault and OpenBao.
• Compliance work for KRITIS, NIS2, ISO 27001 and BSI IT-Grundschutz.
• Observability with OpenTelemetry, Prometheus, VictoriaMetrics, Mimir, Grafana, Loki, Tempo, Jaeger, Pyroscope, Fluent Bit, Fluentd, Vector and Perses.
• Chaos engineering and resilience tests with Chaos Mesh, LitmusChaos and Chaos Toolkit.
• AI inference infrastructure with vLLM, llm-d, KServe, the Gateway API Inference Extension, the NVIDIA GPU Operator, DRA for GPUs on Kubernetes and MCP.
• Public cloud on AWS, Azure, GCP, OVHcloud, Hetzner and Equinix Metal, next to private cloud.

I write Go, Rust, Python and Bash.

I hold an MSc in Digital Investigation and Forensic Computing and the CKS certification. I have done bug bounty work, penetration tests and threat modeling, and I was tech lead IT security at a fintech.

$ whoami --security

Architect            # private cloud and platforms for critical infrastructure
Bug Bounty Hunter    # responsible disclosure across web and infra targets
Pentester            # network, host, cloud, container and Kubernetes hardening
Digital Forensics    # incident response, container and host forensics, eDiscovery
Threat Modeling      # STRIDE, attack surface mapping, zero trust architectures
DevSecOps Engineer   # shift-left CI/CD with SAST, DAST, secret and IaC scanning,
                     # image signing (Sigstore, Cosign), SLSA provenance, SBOM (CycloneDX, SPDX),
                     # admission control (Kyverno, OPA Gatekeeper), runtime (Falco, Tetragon)
Compliance           # ISO 27001, VDS 3473, BSI IT-Grundschutz, NIS2, KRITIS,
                     # ISMS lead, audit prep, risk assessments, SoA, control mapping

I take 1:1 consulting on bare metal Kubernetes, KubeVirt and VMware exits, sovereign cloud architecture and platform security under NIS2 and KRITIS. Send the problem in two lines through immalik.com or LinkedIn.

If my open source work helps you, you can sponsor it on GitHub.