~/jwright

Platform & Infrastructure Engineer

Jonathon Wright

Building secure Kubernetes platforms, automated infrastructure fleets, and GPU-backed edge systems.

RHELKubernetesGitOpsAnsibleObservabilityEdge AI

View Projects →Download CVContact
~/jwright ▸6 single-node Talos clusters / 0 SSH daemons / every node rebuilt from committed config
cavealfredrobinkatewgirlelfastcnvidia computeintel computecore / services

01About

Reliability you can reason about.

I'm an infrastructure and platform engineer. I spend most of my time on the automation people usually leave in runbooks: store-edge Kubernetes running GPU-backed AI workloads, the GitOps pipelines that deploy them, and the network policy that keeps a fleet behaving the same way on every node. Before that I worked across larger enterprise estates - around a thousand VMs, multi-region migrations, segmented networks. I like infrastructure that can be rebuilt and explained from the repo. If a deployment still depends on someone remembering the right sequence of clicks, there's usually another piece worth automating.

Based
Sydney, Australia
Focus
Edge Kubernetes · GPU/AI · IaC & GitOps

# education

  • Advanced Diploma in IT Networking and Security
  • Diploma in IT Networking
  • Certificate IV in IT Networking

Download full CV (PDF)

  1. Infrastructure / DevOps Engineer

    Aug 2025 - Present

    Woolworths

    Core DevOps infrastructure engineer for store-edge solutions - turning high-level designs into single-touch deployments and CD pipelines.

    • Single-touch deployment of an edge AI solution running on Kubernetes at the store edge
    • GPU brought online as code - passthrough via ESXi, end-state manifests / Helm charts
    • Ansible playbook builds wired through a single source-of-truth pipeline with per-store vars
    • Removed manual practices across infra and ops - IaC throughout, spec-driven and documented as code

  2. Infrastructure Systems Engineer

    Aug 2022 - Aug 2025

    Virtus Health

    Global IT - optimisation, implementation and projects across an enterprise estate.

    • Managed ~1,000 VMs across a global VMware estate
    • Re-segmented flat sites into isolated VLAN ranges; SD-WAN and Aruba ClearPass onboarding
    • Migrated workloads to Azure (Blob, AVS); upgraded Palo Alto / FortiGate firewalls
    • Led a new major-site build - end-to-end services implementation

  3. Global IT Infrastructure Engineer

    Sep 2019 - Aug 2022

    Linde Asia Pacific

    Maintained and modernised global infrastructure to enterprise standards across the region.

    • Global VMware / Dell hosting; PowerShell automation of manual project tasks
    • Migrated company infrastructure off Google Cloud and Google Workspace to Microsoft: Linux domain controllers replaced with Windows Active Directory, users onto Microsoft 365 and Azure; AWS-hosted ERP access
    • ERP hardware refresh onto new mainframe plus DR solution - including daily COBOL green-screen operations; PBX → VoIP across AU/NZ

+ 2 earlier roles (ELGAS, Darktime) - see the CV.

02Capabilities

What I work with, grouped by what it's for.

FLAGSHIP

Edge AI & GPU

Serving vision and language models on real hardware at the edge.

  • Fail-closed computer vision on single-node OpenShift - probes that catch a silently dead model, not just a dead pod.
  • One GPU, two workloads - a single card time-sliced between LLM serving and video transcode instead of reserving separate hardware.
  • Vendor video-analytics stacks re-platformed as first-class Kubernetes workloads, not appliances.
  • Local models behind an OpenAI-compatible gateway - swap the backend, keep every client.
  • NVIDIA GPU Operator
  • GPU passthrough (ESXi, as code)
  • GPU readiness probing & watchdogs
  • Pod lifecycle management
  • YOLO / computer-vision inference
  • Local LLM serving (llama.cpp)
  • Edge Kubernetes

Platform & Virtualization

Kubernetes platforms designed to be reasoned about and recovered.

  • Kubernetes
  • OpenShift
  • Talos Linux
  • vSphere / VMware ESXi
  • Proxmox
  • containerd
  • Argo CD / GitOps
  • Helm & Kustomize

Automation & IaC

Single-touch deployments - removing the manual step, not documenting it.

  • Ansible / AWX
  • PowerShell (PowerCLI)
  • Python
  • Bash / Shell
  • Terraform
  • Image pre-pull & air-gapped registries (ACR / NVCR)
  • Secrets management

Networking & Security

Default-deny, segmentation, and a small attack surface.

  • SD-WAN
  • 802.1Q VLAN segmentation
  • ACLs / IPSec / RADIUS
  • Aruba ClearPass
  • Palo Alto / FortiGate
  • Firewall policy governance
  • RBAC · 2FA / SSO

Cloud & Identity

Hybrid estates across the major clouds, with identity done properly.

  • Azure
  • Entra ID
  • Intune
  • AWS
  • GCP
  • Microsoft 365
  • Azure Blob / S3

Observability & Ops

Knowing the system is healthy - and the GPUs with it.

  • Fleet metrics by remote-write - every cluster ships to one Prometheus, GPUs included (DCGM / Intel Xe).
  • Alerts that reach a phone and mean it - tuned until silence means healthy, not unmonitored.
  • A backup is a rumour until a restore drill proves it - drills are scheduled, not aspirational.
  • Prometheus
  • Grafana
  • DCGM Exporter
  • PRTG / LibreNMS
  • AWX job reporting
  • Veeam backup
  • ITIL processes

03Selected work

Platforms built to keep working unattended.

DOSSIER / 001

Single-Touch Edge AI Platform

Outcome Turned a high-level edge-AI design into a single-touch deployment running on Kubernetes at the store edge.

  • Kubernetes
  • Edge
  • NVIDIA GPU
  • CD pipelines
  • Helm
  • Python

Infrastructure / DevOps Engineer · Woolworths · 2025 - Present

DOSSIER / 002

Self-Hosted AI & Homelab Platform

Outcome A homelab - GitOps from bare metal to local AI, and the platform that serves this very site.

  • Talos
  • OpenShift
  • Argo CD
  • Proxmox
  • Local LLM
  • Cloudflare Tunnel

Owner / Operator · Ongoing

DOSSIER / 003

IaC Fleet Automation

Outcome Stood up identical edge sites from code - every store comes up the same way, every time.

  • Ansible
  • AWX
  • GitOps
  • ACR / NVCR
  • Image pre-pull
  • Secrets mgmt

Automation Engineer · 2025 - Present

DOSSIER / 004

The Exploded Cluster

Outcome A scroll-driven teaching site that takes container platforms apart one machine at a time.

  • Dependency-free static build
  • GSAP ScrollTrigger
  • Strict CSP
  • Cloudflare Tunnel
  • Argo CD
  • zot mirror

Author / Engineer · 2026

DOSSIER / 005

The Mirror: A Pull-Through Registry

Outcome Ended anonymous registry rate-limits across a six-node fleet, then published the failure modes the deployment revealed - including the one that contradicted my own first write-up.

  • zot v2.1.17
  • Talos Linux
  • containerd
  • OCI distribution
  • Argo CD
  • External Secrets

Author / Engineer · 2026

All projects →

04Writing

Notes from the build.

Lessons from edge Kubernetes, GPUs, and running infrastructure like it matters - written up as I go.

  1. SECURITY SERIES · 07·3 min read

    Untrusted code belongs in a VM, not a namespace

    A container isn't a security boundary - it's a process sharing the host kernel, wearing namespaces. For code you genuinely don't trust, that's not enough. Kata Containers give each pod its own microVM and guest kernel, with the kubectl ergonomics intact. Here's why, and what it costs.

    • security
    • kata
    • kubernetes
    • isolation
    • ai-agents
  2. AUTOMATION SERIES · 01·2 min read

    Consistency by construction beats consistency by discipline

    One address had to appear in the application config, the network attachment and two policy objects - four artefacts, four update paths. Rendering every one of them from a single required value made divergence something the tooling can no longer express.

    • automation
    • helm
    • iac
    • openshift
    • fleet
  3. EDGE AI SERIES · 01·7 min read

    A new model is a new hire, not a new file

    A model pulled from the hub is not just weights - it ships tokeniser code, an executable chat template, loaders gated by trust_remote_code, sometimes its own runtime, and the ecosystem's default is to run all of it beside your credentials. So every new model starts on probation: a hardware-isolated microVM with its own guest kernel, a default-deny network, zero credentials, and promotion to the standard serving tier only when the observed record earns it.

    • ai
    • security
    • kata
    • isolation
    • homelab

Read the blog →

05Get in touch

Let's talk infrastructure.

Open to conversations about platform engineering, edge infrastructure, and GPU/AI systems. Based in Sydney, Australia - for a low-ms reply, ping me on LinkedIn or email; everything else is best-effort delivery.

[email protected]Download CV (PDF)