Skip to content
View sindredg's full-sized avatar
4 followers · 5 following

Achievements

Achievement: Pair Extraordinairex3Achievement: Pull Sharkx3Achievement: QuickdrawAchievement: YOLO

Achievements

Achievement: Pair Extraordinairex3Achievement: Pull Sharkx3Achievement: QuickdrawAchievement: YOLO

Block or report sindredg

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
sindredg/README.md

Sindre Grytebust

All repositories

Selected work

AI Security Platform

Self-hosted AI workers that investigate security findings and propose fixes. Isolated platform and target networks, no public addresses, and a single egress point. Actively building.

Azure, Terraform, K3s, self-hosted LLM

Automated Regional Disaster Recovery

Automated outage detection, infrastructure rebuilds, backup restoration, and DNS cutover for Gitea and PostgreSQL on self-managed Kubernetes. Validated in two consecutive unattended drills: recovery within 36 minutes, with under 11 minutes of data loss.

Google Cloud, Terraform, Ansible, Flux, GitHub Actions

Private GKE Cluster

A private GKE cluster that served public workloads, built with Terraform and deployed from GitHub Actions without a stored key. An AI agent triaged its security findings.

GKE, Terraform, GitHub Actions

Entra ID to AWS

Workforce access to AWS managed from Entra ID: SAML sign-in, SCIM provisioning, access packages with approval and expiry, and joiner, mover, and leaver workflows.

Entra ID, AWS, Terraform

Azure Hybrid Network

A hub-and-spoke network joined to an external network by an IPsec tunnel, with a hub firewall, private endpoints, and DNS that resolves in both directions.

Azure, VPN, Private Link

Access Governance

Conditional Access and risk-based policies, just-in-time administration with PIM, and recurring access reviews for a self-hosted Grafana.

Entra ID, Conditional Access, PIM
Other projects
  • Azure Container Apps: A public web tier and an internal API, built with Terraform. Images are pulled with a managed identity, so no registry password exists.
  • Two-Site Hybrid Identity: An Active Directory forest across two Azure regions, synced to Entra ID, with hybrid join, Windows LAPS, security baselines, and tiered administration.
  • Entra ID SSO and SCIM for Grafana: Entra ID as the identity provider for a self-hosted Grafana: OIDC sign-in, groups mapped to Grafana roles through app roles, and SCIM provisioning through a custom bridge.

Notes on building and testing cloud infrastructure.

Pinned Loading

  1. cross-cloud-entra-aws cross-cloud-entra-aws Public archive

    Cross-cloud workforce identity from Entra ID to AWS IAM Identity Center using SAML, SCIM, access packages, JML workflows and Terraform-managed permission sets.

    HCL

  2. gke-lab gke-lab Public archive

    A private kubernetes cluster in GKE, a couple of workloads, and an AI agent that handles security findings.

    HCL

  3. k8s-dr k8s-dr Public archive

    Automated regional disaster recovery for self-managed Kubernetes. When the primary region fails, a watchdog starts a GitHub Actions workflow that rebuilds a kubeadm cluster in a second region from …

    Python

  4. ai-security-platform ai-security-platform Public

    Self-hosted AI agent that investigates security findings on a service it cannot reach, and proposes fixes rehearsed before human approval. Azure, K3s, open-weight model on CPU.

    Python