Hamza ROUINEB

- Spearheaded the development of a platform engineering CLI, empowering developers to rapidly provision isolated VMs with production-parity Kubernetes, Docker Machine for remote OCI container building, and scaffold deployment with custom annotations. Implemented OIDC (Keycloak) for secure authentication/authorization via JWT claims. The CLI also features cookie-cutter scaffolds for various backends and full stack deployment capabilities across multiple cloud providers (OVH, SCW, Azure, and AWS). - Led the migration of all clusters from Traefik to Istio Service Mesh, enabling design patterns like traffic shifting, failure injection, circuit breaking, advanced retries, and connection pooling. Strategically employed Istio's Primary-Remote architecture to facilitate a gradual migration of different workloads, ensuring no disruption to end-users during the transition. Implemented our internal Identity Provider (IDP) with Istio acting as the central gateway for all incoming traffic. By defining custom rules leveraging JWT and mTLS, we enhanced the security posture of our applications, leading to an improved overall experience. Simplified service security using Istio's AuthorizationPolicy and RequestAuthentication (OIDC), and secured workload communication with SPIFFE-based mTLS. Optimized Istio's control plane for swift configuration application, with monitoring via Grafana and AlertManager, and enriched metrics through Istio's proxy sidecar. - Architected a data platform utilizing Kafka (Strimzi operator) for cross-environment data synchronization via Debezium CDC. Managed data ingestion into Vertica database, enabling the data team to extract key metrics using Vertica's DSL. Deployed JupyterHub and Superset with OIDC authentication for data visualization. - Championed a culture of knowledge sharing and technical excellence through documentation, providing coding scaffolds (OIDC, circuit breaker, exponential backoff, retries, etc.) and reusable modules/APIs.

- Leveraged Zalando's PostgreSQL operator for seamless PostgreSQL version migrations and automated backups via WAL streaming (wal-g) to an external S3 store, enabling real-time replication for non-production load testing. Implemented a high-availability setup with three instances per database (master/slave) to ensure continuous operation and prevent data loss. - Developed a Kubernetes operator for Hasura (using Kubebuilder) to simplify tasks like database management, connection configurations, and OLTP/database/OIDC setup via Custom Resources, providing developers with an out-of-the-box provisioning experience. - Scaled the device management platform to oversee over 1153552 devices, with over 100,000 managed in real-time via MQTT. Facilitated real-time configuration dispatch, administrative instructions (locking, debugging data retrieval, live UI streaming, package installation) across a diverse fleet of Android tablets and Windows PCs. - Developed a Fluent-bit platform processing over one million facts per hour from the device fleet, enabling filtering, transformation, and storage for backend processing and data mining with Vertica. - Deployed, configured, and managed Hasura, integrating it with Keycloak's OIDC and Dex Oauth2 for different clients. Notably, the Dex setup utilized an authentication webhook that whitelisted specific mutations, queries, and subscriptions executed against various databases. - Developed an authentication plugin for EMQX (using Erlang) to enhance its basic authentication capabilities. This involved creating a custom authorization rule engine based on YAML configuration to validate JWT claims (ensuring specific claims were present) as well as verifying the issuer and audience against our internal IDP. - Led observability implementation: Thanos for metrics (annotation-based scraping), Loki for logs (Promtail), and Tempo for traces (OpenTelemetry/mTLS).