Senior DevOps / Platform engineer, 10+ years running production infrastructure: AWS and on-prem, Kubernetes, CI/CD, observability, incident response. I work across the whole delivery path, from the application code through the pipelines that ship it to the infrastructure it runs on, and I treat security as part of the job rather than a separate stage.
Member of the kubernetes-sigs and etcd-io GitHub organizations. Maintainer of netbox-sync.
Contact: sannikov.dev · sergey@sannikov.dev · Georgia (UTC+4), remote
- Platform: AWS (EKS, IAM, RDS, Route 53, CloudFront), Kubernetes, Helm, Argo CD, Flux, Docker, Proxmox
- Delivery and IaC: Terraform, Terragrunt, Ansible, GitHub Actions, GitLab CI, TeamCity, Jenkins
- Observability and security: Prometheus, Grafana, Loki, OpenTelemetry, OPA/Gatekeeper, Vault, FreeIPA
- Languages: Go, Python, Bash, PHP; PostgreSQL, MySQL, Redis
I fix bugs in the tools I run in production. Each change starts from a reproduction, ships with a regression test, and explains the root cause in the pull request.
| Project | ★ | Language | Merged | |
|---|---|---|---|---|
| bb-Ricardo/netbox-sync · maintainer | 417 | Python | 41 | |
| ccremer/kubernetes-zfs-provisioner | 95 | Go | 5 | |
| kubernetes/kubernetes | 128.8k | Go | 4 | |
| nodejs/node | 123.2k | JavaScript | 1 | |
| ansible/ansible | 71.2k | Python | 2 | |
| laravel/framework | 35k | PHP | 1 | |
| symfony/symfony | 31.2k | PHP | 6 | |
| argoproj/argo-cd | 24.5k | Go | 1 | |
| gnachman/iTerm2 | 18.2k | Swift | 3 | |
| argoproj/argo-workflows | 17.1k | Go | 3 | |
| goreleaser/goreleaser | 16.1k | Go | 1 | |
| PHP-CS-Fixer/PHP-CS-Fixer | 13.6k | PHP | 1 | |
| spinnaker/spinnaker | 9.8k | Java | 2 | |
| kubernetes/autoscaler | 9k | Go | 4 | |
| predis/predis | 7.8k | PHP | 2 | |
| sigstore/cosign | 6.4k | Go | 1 | |
| kubernetes-sigs/cluster-api | 4.3k | Go | 1 | |
| google/go-containerregistry | 4.1k | Go | 1 | |
| argoproj/argo-rollouts | 3.6k | Go | 1 | |
| mydumper/mydumper | 3.2k | C | 1 | |
| schmittjoh/serializer | 2.3k | PHP | 1 |
Smaller projects: python-humanize/humanize 1 · pallets-eco/croniter 1 · gnachman/iTerm2-shell-integration 1 · Senora-dev/aquifer-ai 1
Merged pull requests to repositories I don't own, from the GitHub search API; refreshed weekly by .github/workflows/contributions.yml, last run 2026-11-02.
Highlights
- Kubernetes — skipping unchanged pod resources on in-place resize in the LimitRanger admission plugin (#142171),
resource.Quantitycorrectness fixes (#140459, #141169), a Cluster API controller fix (#14303); removed the reachable CVEs fromautoscaler/addon-resizer, fixedgo vetand added its first CI workflow (#10112–#10114). - netbox-sync (VMware vCenter and Redfish to NetBox) — maintainer: releases, and review of incoming contributions against a vcsim test bench built from real vCenter captures.
- Symfony — security hardening of the weak-secret guard in
Uuid47Transformer, released in v8.1.4 (#65105). - kubernetes-zfs-provisioner — with the maintainer: leader election on coordination Leases, a native Go SSH runner in place of shell wrappers, in-process volume expansion.
- Argo — a
ParseProgresspanic in Workflows with release-branch backports (#16537), theSuspendedcondition for suspended Jobs in Argo CD (#28738). - Supply chain and release tooling — case-insensitive checksum comparison in
cosign(#5036), anchoredgoarm64validation in goreleaser (#6727), single-character repository paths in go-containerregistry (#2407).
- helmtide — maintained fork of helmwave on Helm v4: current dependencies, no known reachable CVEs with available fixes, hermetic tests and a kind-based integration suite.
- ansible-secops-linter — static checks for Ansible: hardcoded secrets, disabled TLS and host-key verification, missing
no_log, world-writable modes. - mr-rca-toolkit — utilities for infrastructure merge review and incident root-cause analysis.