Fabien Duhamel

**Context**: 2 development teams, legacy infrastructure to migrate to the Cloud, multi-tenant, microservices

• Design and deployment of the new IT platform
• Centralized CI/CD (integrating an app to the stack in minutes instead of days), decoupling code/configuration (no build on configuration change): Time-to-Deploy divided by 10 via GitOps, intelligent builds via Docker stages and CI caching (generic Docker images, 3 times fewer builds)
• SecOps: sensitive data in code reduced to 0, automated updates with Renovate, massive use of service accounts and principle of least privilege applied
• Elimination of operational toil: automated rotation of certificates and tokens (and deletion via OIDC)
• FinOps: cost monitoring, monthly alerting and reporting to management; provisional budget met, cost projection in project scoping
• Transfer and adoption of CI/CD and GitOps tools to development teams

**Stack**: Terraform, Kubernetes, Swarm, GCP, GKE, GitLab, FluxCD, Prometheus, Grafana, Loki, Alertmanager, HashiCorp Vault, Renovate, OIDC

**Context**: multi-tenant platform, microservices, 15+ AWS services, millions of requests/day

• Orchestration of CI/CD workflows for 3 development teams: 30 deployments/day, reduction of deployment time by 3 via CI caching; generic Docker images: decrease in Docker builds for the front end by 3
• SecOps: access security via OIDC / short-lived token and service accounts (principle of least privilege), CI/CD authentication via OIDC (elimination of static secrets), strengthening of Kubernetes access controls
• FinOps: 60% reduction in Kubernetes bill via autoscaling (Karpenter), spot instances, and resource adaptation; 30% reduction in Cloud bill via optimization of managed resources and management of temporary resource lifecycles, reporting

**Stack**: Terraform, Kubernetes, AWS, EKS, Karpenter, Helm, GitHub Actions, OIDC, Python, Datadog, SignalFX, Splunk, Alertmanager

**Context**: Customer Reviews team (8-10 devs), 6 AWS services, millions of requests/day, 50+ countries

• Management of the progressive migration of legacy infrastructure (Rancher) to AWS EKS: 8 microservices migrated in 1 year, Kubernetes version upgrades maintenance reduced to 0, cluster failures reduced to ~0
• Private CI/CD runners with EC2 spot and autoscaling connected to a GitLab queue: elimination of waiting times, VM costs halved via night/weekend shutdowns; CI/Docker caching (build times reduced from 2x to 10x): 500 CI jobs/day, 5 to 10 deployments/day
• Centralization of monitoring and alerting, business/technical dashboards
• High availability: 99.9% SLA, target response time < 500ms on Decathlon front end (strong dependency), measured average time < 100ms
• FinOps: reduction of managed service bills via deployment of self-managed tools (Redis, Varnish, RabbitMQ, ELK)
• SRE: development of a PHP/Symfony bundle for tracking HTTP requests across microservices

**Stack**: Rancher, Kubernetes, AWS, EKS, Helm, Terraform, ELK, Prometheus, Grafana, GitLab, GitHub Actions, Varnish, Redis