Dvir Gross
DevOps Engineer
Builds the platform other engineers ship on: multi-cloud Kubernetes, self-service infrastructure with Terraform and Crossplane, and GitOps delivery with ArgoCD. 3+ years running production end to end.
Profile
Experience
IndependentDevOps & AI Agent Tooling
Tooling where infrastructure meets AI coding agents, and infrastructure for client teams.
Agent tooling
- Private agent-tooling platform: one source of curated skills, agents and commands, shipped to AI coding clients
- Go CLI that generates per-client plugins and configs and audits every install target
- Two Go MCP servers: a live agent session board and a session-history inspector
- Cross-harness AI review council, with a check that catches silently dropped findings
- Agent behaviour tested like software: CI, sandboxed install tests, graded evals
Client engagements
- Reusable AWS backend stack (ALB, ECS Fargate, NAT, EFS, GitHub OIDC deploys), deployed across AWS accounts
- EKS and Argo CD platforms for early-stage teams, with local kind parity and plan-checked CI
This site
- Rust on Cloudflare Workers, server-rendered, with a terminal CV; Terraform/Terragrunt infra with state in R2
Cyngular SecurityDevOps Engineer
Led DevOps in a 3-person team running multi-cloud production for a cloud-security platform.
Platform
- Designed a multi-cloud hub-and-spoke platform: GKE hub, EKS and GKE spokes, Istio ambient, Tailscale, Terragrunt stacks
- Grew and maintained a Terraform/Terragrunt estate across AWS, GCP and Azure
- Ran Karpenter spot capacity for CI runner clusters; fixed a node-bootstrap race and builder OOMs
- Modelled per-tenant cloud identity in Crossplane and enforced tenant isolation in the database
- Moved per-cloud serverless services to containerised, Airflow-run workloads on Kubernetes
Delivery
- Built and maintained a shared GitLab CI library
- CUE-generated GitOps: CI validates, renders and commits manifests for Argo CD
- Argo CD ApplicationSets placing apps by cluster role across management, site and runner clusters
- Tenant provisioning status fed back to the product through Argo CD Notifications and webhooks
Security & identity
- Security gates in every pipeline: secret scanning, SAST and image CVE checks
- Keyless CI and workload identity across GCP and AWS; SSO in front of internal tools
Reliability & cost
- Led the response and wrote the postmortem for a CI-runner rollout incident; shipped the hardening
- Ran cloud cost audits and a zero-failure cleanup of orphaned machine images and snapshots
Automation & AI
- Brought AI-assisted DevOps in: agent skills in the infra repos, agent-run cost audits
- Ran the DevOps decision log
Projects
- dviross.worklive
This site: server-rendered at the edge, with a CV for curl.
- Rust
- Cloudflare Workers
- R2
- Terragrunt
- Agent-tooling platformprivate
Write skills, agents and commands once; every AI coding client gets them.
- Go
- MCP
- Bash
- TypeScript
- AWS backend stackprivate
A client API on AWS in one scaffold, behind an account-readiness check.
- Terragrunt
- ECS Fargate
- ALB
- GitHub OIDC
- Hub-and-spoke platformemployer
One GitOps hub driving tenant workloads across GCP and AWS spokes.
- Terragrunt
- GKE
- EKS
- Istio
- CUE
- Argo CD
- Shared CI/CD libraryemployer
One include-able pipeline library instead of per-repo CI, with security gates built in.
- GitLab CI
- Bash
- Python
- Grype
- Gitleaks
Education
- DevOps Engineering BootcampDeveleap · Holon, Israel
Networking, cloud, Linux, Bash, Python, Git, Docker, Kubernetes, Helm, ArgoCD, Terraform, Jenkins.
Toolbox
Tools
Languages
- Python2022
- Bash2022
- Go2026
- Rust2026
- TypeScript2026
- CUE2025
- Swift2026
IaC & GitOps
- Terraform2022
- Terragrunt2023
- Argo CD2022
- Helm2022
- CloudFormation2023
- Crossplane2025
- Terratest2025
CI/CD
- GitLab CI2023
- GitHub Actions2022
- Docker / BuildKit2022
- Renovate2025
- Dagger2026
Kubernetes
- EKS2023
- GKE2024
- Karpenter2024
- External Secrets2023
- cert-manager2023
- ExternalDNS2023
- Istio ambient2026
- Gateway API2025
- Tailscale2026
- kind2026
- AKS2024
- KEDA2025
- Kueue / Volcano2026
Cloud
- AWS2022
- GCP2024
- Azure2023
- Lambda2023
- ECS Fargate2026
- Azure Functions2023
- Bedrock2026
Edge
- Cloudflare Workers2026
- R22026
- Cloudflare DNS & Email Routing2026
- Durable Objects2026
- Cloudflare Tunnel2026
- D12026
- Fly.io2026
Observability
- Prometheus2023
- Grafana2023
- Loki2023
- Grafana Alloy2026
- Mimir2026
- Tempo2026
- OpenTelemetry2026
- Arize Phoenix2026
- Coroot2025
- OpenCost2025
Security & secrets
- IRSA / Pod Identity / OIDC2023
- Infisical2025
- Secrets Manager / KMS2023
- Azure Key Vault2023
- Falco2024
- Trivy2026
- Gitleaks2025
- Grype / Syft2026
- Semgrep / Bandit2025
- tflint2026
- Kyverno2026
- SPIFFE / SPIRE2026
Data & messaging
- Redis2023
- Airflow2026
- gRPC / ConnectRPC2026
- SQLite2026
- PostgreSQL2024
- MongoDB2026
- Superset / Metabase2024
- Temporal / Restate2026
AI & agents
- Claude Code / Codex / Pi2025
- MCP2025
- Agent Skills2025
- Strands Agents2026
- LangGraph2026
- BAML2026
- OpenRouter2026
- mem02026
- kagent2026
- agentgateway2026
Developer tooling
- uv / ruff2025
- Tauri2026
- just2026
- gh / glab2025
- Backstage2026
Research
Agents & AI tooling
- ongoingSource-pinned teardowns of open-source coding-agent tools2026-10
- adoptedMulti-harness delegation and a cross-model review council2026-10
- adoptedMCP servers and browser automation for agents2026-10
- referenceContext engineering: prompt-cache economics and code mode2026-10
- referenceKubernetes-native agent runtimes and MCP/A2A gateways2026-09
- adoptedTyped guardrails for agents running infrastructure CLIs2026-07
- adoptedRAG stores: MongoDB vector search vs Qdrant2026-06
Infra & platform
- referenceKubernetes batch and GPU scheduling: Kueue, Volcano, gang scheduling2026-09
- adoptedTerraform module distribution: pinned tags vs registries2026-09
- adoptedCUE vs ApplicationSet overlays, Timoni, Holos, KubeVela2026-09
- referenceCI runner providers (10 compared) and Dagger2026-09
- adoptedVPC CNI warm-IP tuning for Karpenter runner clusters2026-06
- adoptedTerragrunt explicit stacks for multi-region hub and spoke2026-05
Observability
- adoptedGenAI tracing: OTel GenAI conventions, Phoenix vs Laminar2026-06
- referencePrometheus stack vs Alloy + Mimir + Loki, with eBPF via Coroot2026-03
Security
- plannedIstio ambient with SPIRE for workload identity2026-08
- adoptedPrivileged-access failure modes mapped to SOC 2, ISO 27002, PCI, NIST2026-08
- adoptedDatabase-enforced tenant isolation with per-tenant IAM2026-06
- ongoingKyverno ClusterPolicy to CEL ValidatingPolicy2026-06
Developer experience
- referenceAPI SDK generators: Fern, Speakeasy, Stainless2026-08
- referenceBackstage: adopt, borrow or skip2026-07
How this site runs
Request path
- Youbrowser or curl
- CloudflareCMH edge
- Rust WorkerWebAssembly · HTML or text
- R2content · cv.pdf
- Every page is rendered per request by Rust compiled to WebAssembly. No client framework; the page works with JavaScript off.
- Content and CV live in R2, so updating them needs no redeploy.
curl -L dviross.workgets the same CV as text from the same Worker.
Infra
Cloudflare
- Worker on the dviross.work custom domain; www redirects to the apex
- R2 bucket for the page content and the CV
- R2 bucket for Terraform state, with lockfile locking
- Email Routing for hi@ with SPF and DMARC
Infra as code
- Terragrunt layer over the Cloudflare v5 Terraform provider
- Zone settings, DNS, redirect rules, email routing and storage all in code
- Secrets injected from Infisical at plan and apply time
Build & deploy
- Rust compiled to WebAssembly with worker-build; static assets beside it
- Changes are previewed on a separate URL before they ship
- The footer shows the serving Cloudflare location and the build commit
Security
Headers on every response
- Content-Security-Policy with no inline scripts; one allow-listed origin for analytics
- Strict-Transport-Security
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- Cross-Origin-Opener-Policy and frame-ancestors 'none'
Everything else
- Self-hosted fonts: the only third-party request is Cloudflare's cookieless analytics
- Theme kept in a cookie and rendered on the server
- security.txt with a rolling expiry
- Contact address forwards; the inbox behind it stays private
Background
The maze
- A perfect maze kept as a tree of parent pointers: exactly one path between any two cells
- Origin shift rewires it one wall at a time, so it changes constantly and never breaks
- Round labyrinths are generated the same way on a polar grid; their rings turn
Interaction
- Walkers drift across the grid, rewiring the maze as they pass
- The cursor lights up the walls near it
- Click empty space to break a patch; it rebuilds bottom-up as a new maze
Manners
- Fades around text, measured live as you scroll
- Pauses in background tabs; holds still with reduced motion
- One canvas, no libraries
FastPaste
A macOS desktop app and fp CLI that turn a pasted path fragment into the right file, read local coding-agent sessions, and dispatch cloud agent runs.
A macOS utility for developers running many coding agents across many repos. Paste a path fragment — or any text containing one — and FastPaste opens the file it refers to, even from an agent transcript, a GitHub link, or a branch that isn't checked out. A companion CLI, fp, resolves the same way from a terminal. It is a Tauri v2 desktop app summoned by a global hotkey that opens a black-and-white reader, plus a bundled fp command-line tool; both surfaces link one Rust engine, fp-core, which resolves a query over roughly 120k files in under 4 ms at p95.
Key capabilities
- Files — resolve path fragments and pasted references, rank ambiguous matches, read markdown and other file kinds, navigate folders.
- Sessions — read local Claude Code, Codex, Pi, omp, fx, and DeepSeek Harness transcripts read-only; inspect conversation projections, tool calls, subagents, and context windows.
- Dispatch — start, steer, interrupt, and stop cloud agent runs, answering the agent's questions from cards in the pane.
- CLI — fp resolve, fp find (content search), fp sessions (index/list/show/drift), fp pin, fp bench.
Architecture
fp-core owns indexing, git resolution, permissions, and ranking; the Tauri app serves its warm engine over a local socket while the fp CLI links the same library. Provider adapters (fp-sessions) normalize agent transcripts into one shared model; fp-dispatch gates every outbound request behind an explicit network switch. Sessions index on demand, never at launch.
Tech stack
- Tauri v2 (Rust shell)
- React + TypeScript (TanStack)
- Rust workspace (fp-core, fp-sessions, fp-dispatch, fp)
- local-first with a network off switch
Experience
Dvir built FastPaste end-to-end as its sole author — git history attributes over six thousand commits to him, against a handful from bots. He wrote the product and design briefs (PRODUCT.md, DESIGN.md), defined the shared fp-core resolver and its ranking, the provider-agnostic session model behind fp-sessions, and the explicit network switch that gates every fp-dispatch outbound request.
Management
Work is tracked through a Keep-a-Changelog / SemVer changelog, a large dated research-and-tasks corpus (docs/research, docs/tasks), and postmortems for lessons learned. CI is the executable contract: just ci plus GitHub Actions run Clippy with warnings denied, deny.toml dependency advisory and licence gates, and the Rust and frontend test suites.
Navada Platform
An AI agent orchestration platform: a Tauri desktop control surface, a Go API daemon, an execution controller, and a terminal client.
Navada is an AI agent orchestration platform. Operators create and configure agents, dispatch work, watch iterations and tool calls stream in, and reconstruct runs afterwards. Agents are data (MongoDB documents, not code); pluggable runtimes execute them behind one operator surface. Four cooperating services: Navada Desktop (Frontend, Tauri v2 + React) is the operator control surface; the Daemon (Go, Gin + Huma) owns the canonical agent/session/execution API; harness-controller (Go, ConnectRPC) runs the iteration loop around pluggable harness adapters; nvd-cli is a single-binary Go terminal client (Bubble Tea) driving the Daemon's remote API for multi-agent, multi-session work.
Key capabilities
- Agent create/monitor/execute, with SSE streaming of iterations and tool calls as they happen.
- Session and execution history with search, status/recency filters, and persisted run/trace viewing.
- Pluggable harness adapters (C4mula, Jarvis, Reacher, Revi, Zhu-Li) behind one Harness contract.
- Keyboard-first, multi-tenant (Stytch B2B) UI, a loopback-only local coding-agent session inspector, and a terminal workflow via nvd-cli.
Architecture
The Frontend calls the Daemon over HTTPS; the Daemon reaches harness-controller over ConnectRPC/h2c, which iterates over registered harness adapters toward LLM providers (OpenRouter, Anthropic). Streaming follows a canonical SSE event schema, and execution IDs are stable and retry-safe. Tenant scoping is enforced in the data layer through scoped repositories.
Tech stack
- Tauri v2 + React + TypeScript + Vite (Frontend)
- Go, Gin + Huma, MongoDB, Stytch, OTel (Daemon)
- Go + ConnectRPC (harness-controller)
- Go, Bubble Tea + Lipgloss + Cobra (nvd-cli)
Experience
Dvir authored the platform's four services — Frontend, Daemon, harness-controller, and nvd-cli — as their primary committer; git history across all four repos shows the work under his own accounts. He defined the Harness adapter contract, the canonical SSE streaming event schema, and the scoped-repository tenant model, and made the binding decisions recorded as owner rulings in the workspace register.
Management
Navada is run through a formal decision register: workspace-level D-records in the Atlas decisions register, per-project registers, and ADRs, alongside roadmap and adoption notes per service. Each service carries its own CI workflow, and internal RPC contracts are distributed by publication plus local generation.