Hugo Reis | Cloud Architecture & Kubernetes Cockpit

☸️ Kubernetes Cockpit & Chaos Engineering

Live resilience and self-healing simulation of production replicas.

hugoreis-app-7d9f8-node1 Running

OCI Node: 10.0.2.23 (Ampere A1) IP Address: 10.244.0.14 Ready: 1/1 Restarts: Total: 14 | Session: 0 Uptime: 17h 42m

Traffic Load: 50% (Normal)

hugoreis-app-3c2e1-node2 Running

OCI Node: 10.0.2.89 (Ampere A1) IP Address: 10.244.1.09 Ready: 1/1 Restarts: Total: 9 | Session: 0 Uptime: 17h 42m

Traffic Load: 50% (Normal)

📋 Cluster Event Stream Console

[ok] OKE cluster connected in us-chicago-1. Active ingress via Cloudflare.

[k8s] Deployment hugoreis-app in healthy state (2 active replicas).

Explore the Zero Trust network topology, security audit, and CI/CD pipeline on GitHub.

Origin IP masked by Cloudflare. Port 443 strictly restricted to official Cloudflare CIDR blocks.

Worker nodes isolated without public IPs. Egress securely routed via NAT & Service Gateways.

GitHub Actions automated ARM64 native build and zero-downtime rolling updates.

Sustainable cloud infrastructure fully operated under Oracle Cloud Always Free allowances.

Automated Let's Encrypt certificate issuance using DNS-01 challenges via Cloudflare API.

Container images pulled privately through Oracle backbone network without touching the internet.

High compute density powered by ARM architecture with native multi-arch Docker image builds.

Automated CI/CD security validation gates enforcing industry-standard DevSecOps controls across source code and runtime workloads:

🔑 Secret Scanning 0 Leaks

Gitleaks: Full git commit history inspection actively blocking private keys, API tokens, and credentials.

🔍 SAST (Code) OWASP Top 10

Semgrep: Static analysis of application code and manifests preventing injection flaws and strict CSP bypasses.

📦 Container & SCA 0 CVEs

Trivy: ARM64 image package auditing and Software Composition Analysis with surgical patching in Dockerfile.

☸️ Pod Hardening Restricted

K8s PSS: Non-root runtime, allowPrivilegeEscalation: false, and complete kernel capability dropping (drop: ALL).