Singapore

Benjamin Lee

Platform Engineer · OpenShift / Kubernetes · DevOps & SRE

I build and run production container platforms: two air-gapped OpenShift clusters serving an LLM application with zero unplanned downtime since go-live. The work spans disconnected installs, supply-chain mirroring, hardening, observability and GPU-backed model serving. Good systems are boring in production because they were designed carefully.

Email me LinkedIn GitHub

2 clusters · 19 nodesproduction OpenShift 4

0 unplanned downtimesince July 2026 go-live

Air-gappedCIS-hardened & audited

NVIDIA DGXLLM / RAG model serving

01 About

I'm a platform engineer who designs, builds and operates production Red Hat OpenShift clusters in secure, disconnected environments for a government client. My work spans the whole stack: infrastructure provisioning and installation, private registries and image mirroring, load balancing and ingress, storage, security hardening, logging, and AI/ML model serving on GPUs.

Operational clarity matters most to me. That means runbooks people can actually follow, fixing root causes instead of patching symptoms, and working closely with network, security and application teams to ship changes safely.

02 Experience

Platform Engineer

ST Engineering · Singapore

Present

Delivered and operate a two-cluster, air-gapped OpenShift platform (19 nodes) that runs a production LLM application for a government client, with zero unplanned downtime since its July 2026 go-live.

Platform delivery. Built 2 production OpenShift 4 clusters: a 12-node application cluster (3 control-plane, 3 worker, 3 OpenShift Data Foundation, 3 infra) installed with user-provisioned infrastructure and a bootstrap node, and a 7-node bare-metal AI cluster (3 control-plane, 3 infra, NVIDIA DGX GPU worker) installed with the Agent-based Installer.
Application platform. Run a production RAG / LLM chat service of 15 workloads across both clusters, including the web frontend and API, Keycloak SSO, MongoDB, a Weaviate vector database and GPU-backed retrieval-augmented inference, with zero unplanned downtime since July 2026.
Disconnected supply chain. Built a private Red Hat Quay mirror registry and automated oc-mirror image sets covering 4 operator catalogs (platform, Red Hat, certified and OpenShift AI) and 150+ images, served through a disconnected OperatorHub.
Traffic & networking. Implemented two-tier load balancing for the API and wildcard ingress across both clusters, and troubleshoot connectivity end to end with the network team.
Security & compliance. Hardened OpenShift and RHEL 9 hosts to the CIS Benchmark, remediated 100+ vulnerability-scan findings, documented the justified deviations, and rolled out Advanced Cluster Security and the Compliance Operator.
Observability. Built metrics and distributed tracing with the OpenTelemetry Collector, Prometheus, Grafana and Grafana Tempo, and designed centralized logging with Vector to LokiStack and Splunk HEC, moving it from unauthenticated syslog to token-based, TLS-verified forwarding.
Storage & AI/ML. Provisioned OpenShift Data Foundation (Ceph block/file and S3) and enabled OpenShift AI, serving LLMs with KServe and vLLM on the DGX node with model weights on in-cluster object storage.
Day-2 operations. Automated daily etcd backups with 7-day retention, wrote 15+ upgrade, patching and disaster-recovery runbooks (restore drills completed in under 1 hour), and operate the GitOps, Pipelines, MetalLB, logging and observability operators.

03 Skills

Containers & Orchestration

OpenShift 4
Kubernetes
CRI-O
Operators / OLM
Helm
Kustomize
oc / kubectl

GitOps & CI/CD

Argo CD
Tekton
Git
GitHub

Infrastructure & Networking

RHEL 9
RHCOS
Proxmox VE
OpenTofu
Ansible
HAProxy
MetalLB
OVN-Kubernetes
Cilium
DNS
Ingress / Routes

Registries & Air-gap

Red Hat Quay
oc-mirror
IDMS / ICSP
CatalogSource
Podman

Storage

OpenShift Data Foundation
Ceph RBD / CephFS
S3 object storage
CSI

Observability

Vector
LokiStack
Splunk HEC
Prometheus
Cluster Observability

Security & Compliance

Advanced Cluster Security
Compliance Operator
CIS Benchmarks
RBAC
TLS / PKI
SELinux
firewalld

AI / ML Platform

OpenShift AI
KServe
vLLM
LLM inference
NVIDIA GPU Operator

Scripting & Tools

Bash
Python
YAML
jq
systemd
Linux administration

04 Projects

Homelab

Highly available Kubernetes on Proxmox

This is a 9-node upstream Kubernetes cluster running on my own Proxmox hypervisor. It has three control-plane, three worker and three infra nodes, and I build it from code, from the VMs up to the running cluster.

OpenTofu provisions the VMs from a cloud-init template, and Ansible configures the nodes and bootstraps the cluster.
Cilium provides the CNI, MetalLB the load balancer, Traefik the ingress, and local-path provisioner the storage.
A highly available API endpoint, plus dedicated infra nodes that keep platform services away from workloads.

Kubernetes
Proxmox
OpenTofu
Ansible
Cilium
MetalLB
Traefik

This website

Self-hosted behind a Cloudflare Tunnel

benbambae.com is served from a small Fedora VM on the same Proxmox host. The VM opens an outbound tunnel to Cloudflare, so no inbound ports are open on the home network and the origin IP is never exposed.

The VM is cloned from a cloud-init template, with a static address and key-only SSH.
nginx serves the static site with hardened security headers and no third-party requests.
GitOps-style, pull-based deploys. A systemd timer tracks this GitHub repo and releases each new commit atomically through a symlink swap, which makes rollback instant.
Cloudflare handles TLS and DNS. Everything starts automatically after a reboot.

Proxmox
Fedora
nginx
Cloudflare Tunnel
systemd
Git

05 Education

Bachelor of Engineering, Electrical & Electronic Engineering

Nanyang Technological University · Singapore

2021 – 2025

Let's talk

I'm open to conversations about platform engineering, Kubernetes and OpenShift, and running infrastructure well.

[email protected] LinkedIn GitHub