Anil Kumar
Tangirala

Architecture and infrastructure as code

Develop Terraform, Python and Bash automation using OCI Resource Manager for multi-tenant platform provisioning and OKE lifecycle operations.

• Review provider and environment assumptions, IAM boundaries and promotion criteria.
• Use reusable modules, remote-state practices and configuration-drift checks.
• Coordinate schema and architecture integrations with the relevant engineering owners.

Migration and workload evolution

Led EC2-to-EKS migration at Mobile Programming and an e-commerce VM-to-GKE migration at Artisto.

• Standardize deployment configuration and workload management.
• Work with developers on monolith-to-microservices deployment changes.
• Operate Docker, ECS, bare-metal Kubernetes, AKS and OKE environments.

Security and cost controls

Infrastructure guardrails include IAM, Vault, AWS Secrets Manager, Azure Key Vault, AWS Config, Security Hub and WAF.

• Implemented AWS Config-driven remediation for unused EC2 instances and unintended public network access at Artisto.
• Use tagging and cost allocation to improve resource accountability.
• Build Streamlit cloud-cost visibility alongside operational health.

Design decisions

• Review the blast radius of replacement, network and IAM changes before execution.
• Protect infrastructure state and secrets throughout the delivery lifecycle.
• Cloud architecture decisions include operations access, recovery paths and ownership.

Infrastructure engineering across provisioning, migration, access controls and operational readiness.

Reusable delivery systems

Build shared GitLab CI/CD templates with security scans, linting and compliance checks. Review infrastructure and pipeline code before production promotion.

• OCI DevOps and Shepherd deployment and upgrade ownership.
• Custom promotion gates validate integrations and configuration drift.
• Prometheus and OpenTelemetry health signals validate releases and inform rollback.

Qualification and execution

Build Playwright Release Qualification automation for integrations and schema changes, coordinating defect resolution within approved change windows.

• Review MOPs, SOPs, pipeline inputs and environment-specific assumptions.
• Coordinate engineering, QA, infrastructure, security and support.
• Preserve release evidence and distinguish qualification failures from infrastructure failures.

Earlier delivery engineering

Modernized Jenkins with containerized Kubernetes agents; integrated Maven, SonarQube, Nexus and JFrog Artifactory.

• Kubernetes-hosted Jenkins agents cut pipeline execution time by 40% at Artisto.
• GitHub Actions pipelines reduced deployment errors by 35% at Artisto.
• Docker/Jenkins automation cut deployment time by 40% at Mobile Programming.

Design decisions

• Separate read-only diagnosis from promotion, abort and retry operations.
• An analysis-provider error is not the same as an observed application failure.
• A rollback does not automatically undo schema or external-system side effects.

Release engineering across pipeline design, qualification, promotion and recovery.

Detection and investigation

Build Grafana SLO/SLI views, Streamlit uptime dashboards, OpenSearch/Kibana monitors and Slack-webhook notifications.

• Correlate logs, service health, deployment context and database signals.
• OpenSearch threshold monitoring reduced detection time by 45% within that alerting workflow; overall MTTD improved by 50%.
• Lead incident, change and problem management with cross-stack root-cause investigation.

Resilience and real-time services

Standardize multi-region DR runbooks and failover tests for OCI storage and Oracle AI Autonomous Databases.

• Validate replication, application recovery and operational procedures.
• Deploy LiveKit and troubleshoot WebRTC; automate jitter and packet-loss analysis.
• Investigate IoT and real-time connectivity across carrier and satellite networks.

Operational judgment

Missing telemetry is unknown—not healthy. Temporal correlation is a hypothesis—not proof of root cause.

• Record scope, observation time, owner and next falsification check.
• Keep generated explanations separate from observed facts.
• Verify recovery through application behavior, not backup status alone.

Design decisions

• Paired SLO windows distinguish persistent burn from a short spike.
• Use evidence and known failure signatures to narrow investigation.
• Document unknown impact and missing evidence explicitly.

Oracle outcomes: incident SLA compliance, detection and resolution are separate measures, not availability guarantees. The interactive SLO example uses synthetic counters.

Incident intelligence

Evidence preflight, known-issue matching, incident triage, SLO analysis, UTC timelines and log-pattern grouping.

• Missing history is not treated as no known issue; closed issue matches are retained.
• Paired 5m/1h and 30m/6h windows calculate request-based burn rates.
• Deployment timing is reported as correlation without inferring causation.

Team context and engineering tools

Ownership resolution, dependency impact, runbook Q&A, RCA hypotheses, code review, code-fix proposals, test plans and postmortem scaffolding.

• Dependency traversal protects against cycles and reports unknown ownership.
• Python AST checks identify illustrative reliability patterns such as missing request timeouts.
• Code-fix output is an unexecuted diff; it does not change source files.

Retrieval and transport architecture

Validate JSON → curated facts → bounded knowledge loading → BM25 retrieval → optional model → citation-ID validation.

• 220-word chunks with 40-word overlap; optional embedding retrieval uses reciprocal-rank fusion.
• Remote model transport requires HTTPS, rejects URL credentials and redirects, and bounds response size.
• Offline operation makes no model call; hosted synthesis requires explicit configuration.

Design decisions

• Rules calculate; retrieval supplies context; the model explains.
• Citation-ID validity does not prove the source supports the model interpretation.
• 14 workflows are bounded tools, not 14 autonomous agents.

Reference implementation using synthetic data. No production deployment, live-model evaluation, SSO or multi-tenant access-control claim.

What the reviewer inspects

Deployment, StatefulSet, DaemonSet and Pod exports. Resource identifiers stay attached to individual findings.

• Replica count, CPU/memory requests and limits, readiness and liveness probes.
• Missing, implicit-latest or explicit-latest image tags.
• Privileged execution, non-root settings, privilege escalation and host network/PID access.

Scope and data handling

The reviewer lists skipped resource kinds and never mistakes unsupported objects for passed checks.

• Container environment values are omitted from curated model facts.
• Pod security defaults and container overrides are resolved explicitly.
• No kubectl command or admission-policy change is performed.

Design tradeoffs

Deterministic starter checks provide resource-level evidence; optional RAG explains the relevant platform policy.

• CPU-limit and probe exceptions still require workload-specific engineering judgment.
• HPA, PDB, NetworkPolicy, Jobs and init-container coverage are outside v0.1.
• A passing starter check is not production-readiness certification.

Design decisions

• Report findings at the exact workload/container, not as a generic checklist.
• Treat unsupported scope as a limitation visible to the reviewer.
• Keep runtime health separate from manifest quality.

Reference implementation using static exports and synthetic fixtures; no live-cluster access or admission enforcement.

Risk signals

Recognize both Terraform replacement orders, deletion, forget actions and stateful-resource risks.

• Stateful replacement or removal of deletion protection triggers critical review.
• Detect newly introduced IPv4/IPv6 world-wide ingress in supported AWS shapes.
• Report nested unknown values, errored plans and incomplete plans explicitly.

Data minimization by design

Reports contain resource addresses, action lists and curated findings—not raw before/after values, variables or outputs.

• No-op and data-source reads do not inflate the change count.
• Public egress is not mislabeled as new ingress.
• The CLI only reads a local plan export; it never runs Terraform plan or apply.

Review, not prediction

Retrieved rollout and recovery guidance helps a reviewer decide what evidence is required before promotion.

• Risk rating is a documented heuristic, not a failure probability.
• Provider-specific checks are limited; arbitrary IAM semantics are not fully modeled.
• Human approval remains necessary even when no rules trigger.

Design decisions

• Reduce data exposure before invoking a model.
• Surface unknown values instead of interpreting them as safe defaults.
• Separate backup/rollback prerequisites from the authority to apply a change.

Reference implementation with synthetic fixtures; provider coverage is limited and the heuristic does not prove a change safe.

K8sGPT: analysis before explanation

Verify context, namespace and RBAC; inspect deterministic findings before requesting an LLM explanation. Treat no findings as a scope question, not a health guarantee.

EKS: module change review

Separate local validation from cloud-backed planning. Review endpoint access, IAM, node draining, networking, add-on compatibility and state recovery.

Argo Rollouts: classify the pause

Distinguish manual pause, failed/errored/inconclusive analysis and workload readiness. Inspect traffic routing before promoting or aborting.

Velero: recovery evidence

A completed backup is not restore proof. Review resource/storage coverage, consistency, encryption, dependencies and retention; verify recovery through application behavior.

Design decisions

• Read-only diagnostic access is not authority to mutate production.
• Keep upstream implementation credit separate from original operational guidance.
• Avoid invented recovery objectives or promises of autonomous remediation.

Upstream software with my operations documentation additions. Upstream authorship and licenses are retained.