Duy Mach Tien

DevOps Intern · Ho Chi Minh City

• Rolled out centralised secrets management for Kubernetes with HashiCorp Vault and External Secrets Operator, so applications pull secrets by reference instead of carrying them in config; Reloader restarts affected workloads on rotation and Vault Agent auto-renews Vault PKI TLS certificates before expiry.
• Wrote a Helm chart with a value-generator that builds application config and the matching ExternalSecrets straight from centrally-managed Vault paths, cutting onboarding time for a new workload by roughly 80%.
• Built an end-to-end GitLab CI pipeline: build image, scan dependencies, lint, push to registry, sign and vulnerability-scan with Trivy and Harbor, generate an SBOM, then hand off to Argo CD for the GitOps deploy.
• Set up certificate-based SSH access on Vault SSH CA with Keycloak as the OIDC provider: engineers authenticate through SSO and get short-lived signed certificates, with role-based access control so every login maps to a named role and expires on its own.
• Helped stand up internal platform services on-premise with Docker Compose, then integrated SigNoz and wrote the dashboards and alert rules the team now uses day to day.

Software Developer Intern · Ho Chi Minh City

• Built the GitLab CI delivery pipeline for a React + .NET product: multi-stage Dockerfiles (pinned base images, non-root users), tests, dependency and secrets scanning, push to Amazon ECR and rollout to Amazon ECS, with layer/NPM caching and per-branch preview environments. Multi-stage builds cut the SPA image from ~1.1 GB to ~60 MB and each .NET service from ~1 GB to ~230 MB.
• Owned the AWS side of the deployment: S3 + CloudFront for the React SPA, ECS/EC2 and RDS for the .NET services, least-privilege IAM roles per workload, and AWS Secrets Manager for runtime configuration — removing plaintext credentials from the repository entirely.
• Designed a centralised logging system: structured Serilog output shipped via Fluent Bit into OpenSearch, with correlation IDs propagated from the React client through to the backend for single-query request tracing.
• Implemented fingerprint-based error grouping: exceptions normalised and hashed by stack signature so recurring errors collapse into one issue with occurrence count and first/last seen — cutting ~200 raw error notifications a day down to about 15 grouped issues.