dviross.work

Dvir Gross

DevOps Engineer

Builds the platform other engineers ship on: multi-cloud Kubernetes, self-service infrastructure with Terraform and Crossplane, and GitOps delivery with ArgoCD. 3+ years running production end to end.

View CVhi@dviross.workcurl -L dviross.work

Profile

Experience

  1. IndependentDevOps & AI Agent ToolingJul 2026 — Present

    Tooling where infrastructure meets AI coding agents, and infrastructure for client teams.

    • Agent tooling5
      • Private agent-tooling platform: one source of curated skills, agents and commands, shipped to AI coding clients
      • Go CLI that generates per-client plugins and configs and audits every install target
      • Two Go MCP servers: a live agent session board and a session-history inspector
      • Cross-harness AI review council, with a check that catches silently dropped findings
      • Agent behaviour tested like software: CI, sandboxed install tests, graded evals
    • Client engagements2
      • Reusable AWS backend stack (ALB, ECS Fargate, NAT, EFS, GitHub OIDC deploys), deployed across AWS accounts
      • EKS and Argo CD platforms for early-stage teams, with local kind parity and plan-checked CI
    • This site1
      • Rust on Cloudflare Workers, server-rendered, with a terminal CV; Terraform/Terragrunt infra with state in R2
  2. Cyngular SecurityDevOps EngineerAug 2023 — Jul 2026

    Led DevOps in a 3-person team running multi-cloud production for a cloud-security platform.

    • Platform5
      • Designed a multi-cloud hub-and-spoke platform: GKE hub, EKS and GKE spokes, Istio ambient, Tailscale, Terragrunt stacks
      • Grew and maintained a Terraform/Terragrunt estate across AWS, GCP and Azure
      • Ran Karpenter spot capacity for CI runner clusters; fixed a node-bootstrap race and builder OOMs
      • Modelled per-tenant cloud identity in Crossplane and enforced tenant isolation in the database
      • Moved per-cloud serverless services to containerised, Airflow-run workloads on Kubernetes
    • Delivery4
      • Built and maintained a shared GitLab CI library
      • CUE-generated GitOps: CI validates, renders and commits manifests for Argo CD
      • Argo CD ApplicationSets placing apps by cluster role across management, site and runner clusters
      • Tenant provisioning status fed back to the product through Argo CD Notifications and webhooks
    • Security & identity2
      • Security gates in every pipeline: secret scanning, SAST and image CVE checks
      • Keyless CI and workload identity across GCP and AWS; SSO in front of internal tools
    • Reliability & cost2
      • Led the response and wrote the postmortem for a CI-runner rollout incident; shipped the hardening
      • Ran cloud cost audits and a zero-failure cleanup of orphaned machine images and snapshots
    • Automation & AI2
      • Brought AI-assisted DevOps in: agent skills in the infra repos, agent-run cost audits
      • Ran the DevOps decision log

Projects

  • dviross.worklive

    This site: server-rendered at the edge, with a CV for curl.

    • Rust
    • Cloudflare Workers
    • R2
    • Terragrunt
  • Agent-tooling platformprivate

    Write skills, agents and commands once; every AI coding client gets them.

    • Go
    • MCP
    • Bash
    • TypeScript
  • AWS backend stackprivate

    A client API on AWS in one scaffold, behind an account-readiness check.

    • Terragrunt
    • ECS Fargate
    • ALB
    • GitHub OIDC
  • Hub-and-spoke platformemployer

    One GitOps hub driving tenant workloads across GCP and AWS spokes.

    • Terragrunt
    • GKE
    • EKS
    • Istio
    • CUE
    • Argo CD
  • Shared CI/CD libraryemployer

    One include-able pipeline library instead of per-repo CI, with security gates built in.

    • GitLab CI
    • Bash
    • Python
    • Grype
    • Gitleaks

Education

  1. DevOps Engineering BootcampDeveleap · Holon, IsraelMar 2022 — Jan 2023

    Networking, cloud, Linux, Bash, Python, Git, Docker, Kubernetes, Helm, ArgoCD, Terraform, Jenkins.

Toolbox

Tools

Sort
  • Languages7
    • Python2022
    • Bash2022
    • Go2026
    • Rust2026
    • TypeScript2026
    • CUE2025
    • Swift2026
  • IaC & GitOps7
    • Terraform2022
    • Terragrunt2023
    • Argo CD2022
    • Helm2022
    • CloudFormation2023
    • Crossplane2025
    • Terratest2025
  • CI/CD5
    • GitLab CI2023
    • GitHub Actions2022
    • Docker / BuildKit2022
    • Renovate2025
    • Dagger2026
  • Kubernetes13
    • EKS2023
    • GKE2024
    • Karpenter2024
    • External Secrets2023
    • cert-manager2023
    • ExternalDNS2023
    • Istio ambient2026
    • Gateway API2025
    • Tailscale2026
    • kind2026
    • AKS2024
    • KEDA2025
    • Kueue / Volcano2026
  • Cloud7
    • AWS2022
    • GCP2024
    • Azure2023
    • Lambda2023
    • ECS Fargate2026
    • Azure Functions2023
    • Bedrock2026
  • Edge7
    • Cloudflare Workers2026
    • R22026
    • Cloudflare DNS & Email Routing2026
    • Durable Objects2026
    • Cloudflare Tunnel2026
    • D12026
    • Fly.io2026
  • Observability10
    • Prometheus2023
    • Grafana2023
    • Loki2023
    • Grafana Alloy2026
    • Mimir2026
    • Tempo2026
    • OpenTelemetry2026
    • Arize Phoenix2026
    • Coroot2025
    • OpenCost2025
  • Security & secrets12
    • IRSA / Pod Identity / OIDC2023
    • Infisical2025
    • Secrets Manager / KMS2023
    • Azure Key Vault2023
    • Falco2024
    • Trivy2026
    • Gitleaks2025
    • Grype / Syft2026
    • Semgrep / Bandit2025
    • tflint2026
    • Kyverno2026
    • SPIFFE / SPIRE2026
  • Data & messaging8
    • Redis2023
    • Airflow2026
    • gRPC / ConnectRPC2026
    • SQLite2026
    • PostgreSQL2024
    • MongoDB2026
    • Superset / Metabase2024
    • Temporal / Restate2026
  • AI & agents10
    • Claude Code / Codex / Pi2025
    • MCP2025
    • Agent Skills2025
    • Strands Agents2026
    • LangGraph2026
    • BAML2026
    • OpenRouter2026
    • mem02026
    • kagent2026
    • agentgateway2026
  • Developer tooling5
    • uv / ruff2025
    • Tauri2026
    • just2026
    • gh / glab2025
    • Backstage2026

Research

Evaluations and deep-dives, newest first.

Sort
  • Agents & AI tooling7
    • ongoingSource-pinned teardowns of open-source coding-agent tools2026-10
    • adoptedMulti-harness delegation and a cross-model review council2026-10
    • adoptedMCP servers and browser automation for agents2026-10
    • referenceContext engineering: prompt-cache economics and code mode2026-10
    • referenceKubernetes-native agent runtimes and MCP/A2A gateways2026-09
    • adoptedTyped guardrails for agents running infrastructure CLIs2026-07
    • adoptedRAG stores: MongoDB vector search vs Qdrant2026-06
  • Infra & platform6
    • referenceKubernetes batch and GPU scheduling: Kueue, Volcano, gang scheduling2026-09
    • adoptedTerraform module distribution: pinned tags vs registries2026-09
    • adoptedCUE vs ApplicationSet overlays, Timoni, Holos, KubeVela2026-09
    • referenceCI runner providers (10 compared) and Dagger2026-09
    • adoptedVPC CNI warm-IP tuning for Karpenter runner clusters2026-06
    • adoptedTerragrunt explicit stacks for multi-region hub and spoke2026-05
  • Observability2
    • adoptedGenAI tracing: OTel GenAI conventions, Phoenix vs Laminar2026-06
    • referencePrometheus stack vs Alloy + Mimir + Loki, with eBPF via Coroot2026-03
  • Security4
    • plannedIstio ambient with SPIRE for workload identity2026-08
    • adoptedPrivileged-access failure modes mapped to SOC 2, ISO 27002, PCI, NIST2026-08
    • adoptedDatabase-enforced tenant isolation with per-tenant IAM2026-06
    • ongoingKyverno ClusterPolicy to CEL ValidatingPolicy2026-06
  • Developer experience2
    • referenceAPI SDK generators: Fern, Speakeasy, Stainless2026-08
    • referenceBackstage: adopt, borrow or skip2026-07

How this site runs

Request path

  1. Youbrowser or curl
  2. CloudflareCMH edge
  3. Rust WorkerWebAssembly · HTML or text
  4. R2content · cv.pdf
  • Every page is rendered per request by Rust compiled to WebAssembly. No client framework; the page works with JavaScript off.
  • Content and CV live in R2, so updating them needs no redeploy.
  • curl -L dviross.work gets the same CV as text from the same Worker.

Infra

  • Cloudflare4
    • Worker on the dviross.work custom domain; www redirects to the apex
    • R2 bucket for the page content and the CV
    • R2 bucket for Terraform state, with lockfile locking
    • Email Routing for hi@ with SPF and DMARC
  • Infra as code3
    • Terragrunt layer over the Cloudflare v5 Terraform provider
    • Zone settings, DNS, redirect rules, email routing and storage all in code
    • Secrets injected from Infisical at plan and apply time
  • Build & deploy3
    • Rust compiled to WebAssembly with worker-build; static assets beside it
    • Changes are previewed on a separate URL before they ship
    • The footer shows the serving Cloudflare location and the build commit

Security

  • Headers on every response4
    • Content-Security-Policy with no inline scripts; one allow-listed origin for analytics
    • Strict-Transport-Security
    • X-Content-Type-Options, Referrer-Policy, Permissions-Policy
    • Cross-Origin-Opener-Policy and frame-ancestors 'none'
  • Everything else4
    • Self-hosted fonts: the only third-party request is Cloudflare's cookieless analytics
    • Theme kept in a cookie and rendered on the server
    • security.txt with a rolling expiry
    • Contact address forwards; the inbox behind it stays private

Background

  • The maze3
    • A perfect maze kept as a tree of parent pointers: exactly one path between any two cells
    • Origin shift rewires it one wall at a time, so it changes constantly and never breaks
    • Round labyrinths are generated the same way on a polar grid; their rings turn
  • Interaction3
    • Walkers drift across the grid, rewiring the maze as they pass
    • The cursor lights up the walls near it
    • Click empty space to break a patch; it rebuilds bottom-up as a new maze
  • Manners3
    • Fades around text, measured live as you scroll
    • Pauses in background tabs; holds still with reduced motion
    • One canvas, no libraries

  1. FastPaste

    A macOS desktop app and fp CLI that turn a pasted path fragment into the right file, read local coding-agent sessions, and dispatch cloud agent runs.

    A macOS utility for developers running many coding agents across many repos. Paste a path fragment — or any text containing one — and FastPaste opens the file it refers to, even from an agent transcript, a GitHub link, or a branch that isn't checked out. A companion CLI, fp, resolves the same way from a terminal. It is a Tauri v2 desktop app summoned by a global hotkey that opens a black-and-white reader, plus a bundled fp command-line tool; both surfaces link one Rust engine, fp-core, which resolves a query over roughly 120k files in under 4 ms at p95.

    Key capabilities

    • Files — resolve path fragments and pasted references, rank ambiguous matches, read markdown and other file kinds, navigate folders.
    • Sessions — read local Claude Code, Codex, Pi, omp, fx, and DeepSeek Harness transcripts read-only; inspect conversation projections, tool calls, subagents, and context windows.
    • Dispatch — start, steer, interrupt, and stop cloud agent runs, answering the agent's questions from cards in the pane.
    • CLI — fp resolve, fp find (content search), fp sessions (index/list/show/drift), fp pin, fp bench.

    Architecture

    fp-core owns indexing, git resolution, permissions, and ranking; the Tauri app serves its warm engine over a local socket while the fp CLI links the same library. Provider adapters (fp-sessions) normalize agent transcripts into one shared model; fp-dispatch gates every outbound request behind an explicit network switch. Sessions index on demand, never at launch.

    Tech stack

    • Tauri v2 (Rust shell)
    • React + TypeScript (TanStack)
    • Rust workspace (fp-core, fp-sessions, fp-dispatch, fp)
    • local-first with a network off switch

    Experience

    Dvir built FastPaste end-to-end as its sole author — git history attributes over six thousand commits to him, against a handful from bots. He wrote the product and design briefs (PRODUCT.md, DESIGN.md), defined the shared fp-core resolver and its ranking, the provider-agnostic session model behind fp-sessions, and the explicit network switch that gates every fp-dispatch outbound request.

    Management

    Work is tracked through a Keep-a-Changelog / SemVer changelog, a large dated research-and-tasks corpus (docs/research, docs/tasks), and postmortems for lessons learned. CI is the executable contract: just ci plus GitHub Actions run Clippy with warnings denied, deny.toml dependency advisory and licence gates, and the Rust and frontend test suites.

  2. Navada Platform

    An AI agent orchestration platform: a Tauri desktop control surface, a Go API daemon, an execution controller, and a terminal client.

    Navada is an AI agent orchestration platform. Operators create and configure agents, dispatch work, watch iterations and tool calls stream in, and reconstruct runs afterwards. Agents are data (MongoDB documents, not code); pluggable runtimes execute them behind one operator surface. Four cooperating services: Navada Desktop (Frontend, Tauri v2 + React) is the operator control surface; the Daemon (Go, Gin + Huma) owns the canonical agent/session/execution API; harness-controller (Go, ConnectRPC) runs the iteration loop around pluggable harness adapters; nvd-cli is a single-binary Go terminal client (Bubble Tea) driving the Daemon's remote API for multi-agent, multi-session work.

    Key capabilities

    • Agent create/monitor/execute, with SSE streaming of iterations and tool calls as they happen.
    • Session and execution history with search, status/recency filters, and persisted run/trace viewing.
    • Pluggable harness adapters (C4mula, Jarvis, Reacher, Revi, Zhu-Li) behind one Harness contract.
    • Keyboard-first, multi-tenant (Stytch B2B) UI, a loopback-only local coding-agent session inspector, and a terminal workflow via nvd-cli.

    Architecture

    The Frontend calls the Daemon over HTTPS; the Daemon reaches harness-controller over ConnectRPC/h2c, which iterates over registered harness adapters toward LLM providers (OpenRouter, Anthropic). Streaming follows a canonical SSE event schema, and execution IDs are stable and retry-safe. Tenant scoping is enforced in the data layer through scoped repositories.

    Tech stack

    • Tauri v2 + React + TypeScript + Vite (Frontend)
    • Go, Gin + Huma, MongoDB, Stytch, OTel (Daemon)
    • Go + ConnectRPC (harness-controller)
    • Go, Bubble Tea + Lipgloss + Cobra (nvd-cli)

    Experience

    Dvir authored the platform's four services — Frontend, Daemon, harness-controller, and nvd-cli — as their primary committer; git history across all four repos shows the work under his own accounts. He defined the Harness adapter contract, the canonical SSE streaming event schema, and the scoped-repository tenant model, and made the binding decisions recorded as owner rulings in the workspace register.

    Management

    Navada is run through a formal decision register: workspace-level D-records in the Atlas decisions register, per-project registers, and ADRs, alongside roadmap and adoption notes per service. Each service carries its own CI workflow, and internal RPC contracts are distributed by publication plus local generation.