Lucas Barros lbarrosby

Lucas Barros

Platform engineer based in Rio de Janeiro. I design and operate Kubernetes platforms for teams that ship to production every day, mostly in financial services.

Over the last years that meant running a fleet of 330 clusters behind ArgoCD, Atlantis and Rancher, turning EKS provisioning from a two-day manual process into a 40-minute Terraform/Terragrunt pipeline, moving a 3,000 jobs/day Jenkins farm to immutable infrastructure, and treating cloud cost as an engineering metric rather than a finance report.

I care about boring, predictable infrastructure: everything in code, every change reviewed, upgrades that nobody notices.

Open source

Contributing upstream across the cloud native ecosystem: CNCF projects like Kubernetes, Envoy, Prometheus, Argo, Crossplane, Headlamp and CoreDNS, plus Terraform providers, Helm charts and AI infrastructure tooling (NVIDIA device plugin, Ray, deepwiki-open).

Merged

In review

Project	Pull requests
Kuadrant/mcp-gateway	fix(controller): keep HTTPRoute status.parents under the Gateway API limit
containers/kubernetes-mcp-server	fix(core): accept valid field selectors rejected by the schema pattern
k8sgpt-ai/k8sgpt	fix: require a namespace for namespaced kinds in MCP get-resource fix: declare the limit parameter on the MCP list-resources tool
Flux159/mcp-server-kubernetes	fix: pass the kubeconfig context to the helm tools
kagent-dev/tools	fix(logger): honor LOG_LEVEL
controlplaneio-fluxcd/flux-operator	mcp: keep cluster-scoped kinds out of the target namespace in diff
awslabs/mcp	fix(ecs-mcp-server): send valid CloudWatch Logs requests in fetch_task_logs
pab1it0/prometheus-mcp-server	fix: keep the Prometheus error message on 4xx responses
strowk/mcp-k8s-go	fix: mask secrets regardless of how kind and version are spelled
jenkinsci/mcp-server-plugin	Count open SSE and Streamable HTTP clients in /mcp-health activeConnections
jenkinsci/explain-error-plugin	fix: keep "-- " and "++ " lines in auto-fix diffs and end created files with a newline
headlamp-k8s/plugins	ai-assistant: security: Redact last-applied annotation on Secrets flux: HelmRelease: Show the chart name in the Chart field
awslabs/eks-node-viewer	ci: pin actions by SHA and scope release token to the job fix: update node usage when a bound pod's requests change
luthermonson/go-proxmox	ci: pin actions by SHA and set read-only token permissions fix(firewall): send force and digest when deleting guest ipsets
stern/stern	Harden GitHub Actions workflows fix: compile the highlight regexp once per tail
deliveryhero/helm-charts	[stable/no-chart] ci: pin actions by SHA and set read-only token permissions [stable/prometheus-cloudflare-exporter]: render podLabels on the pod template
fluent/fluent-plugin-kafka	ci: set least-privilege GITHUB_TOKEN permissions in workflows
argoproj/argo-workflows	fix(controller): apply retry backoff when retryStrategy has no limit
argoproj/argo-rollouts	fix(trafficrouting): skip ingress paths without a service backend in nginx
falcosecurity/falcoctl	fix(follower): release wait group when canceled during startup jitter
istio/istio	helm: allow network gateway ports in the gateway NetworkPolicy gateway: honor exportTo when resolving Hostname backendRefs
kedacore/http-add-on	fix(interceptor): fall back to shorter path when route headers do not match
falcosecurity/falco	fix(chart): use falcosidekick.listenPort in the Falcosidekick URL
zammad/zammad-helm	fix: render podDisruptionBudget minAvailable/maxUnavailable when set to 0 fix: set REDIS_USERNAME in sentinel mode when zammadConfig.redis.username is set
oliver006/redis_exporter	fix: don't report unknown stream group lag and entries-read as 0
falcosecurity/charts	fix(falco-talon): read the elasticsearch, loki url and aws access key values fix(falcosidekick): use notlsport for the http-notls container port
fluent/fluentd-kubernetes-daemonset	Fix opensearch https failing with ENOENT when client cert env vars are unset
huaweicloud/terraform-provider-huaweicloud	docs(CCE): explain how to use the add-on template spec with huaweicloud_cce_addon fix(OBS): remove bucket sub-resources from the state when the bucket is gone fix(OBS): leave connection retries to the OBS SDK so retries are signed again
kaito-project/kaito	fix: read max-model-len from inference_config.yaml with a YAML parser
kubeai-project/kubeai	fix: reject resource profile multiples below 1
kubermatic/machine-controller	KubeVirt: honor the instancetype kind set in the provider spec
fluent-plugins-nursery/fluent-plugin-cloudwatch-logs	Skip records whose log group or stream name is empty
fluent-plugins-nursery/fluent-plugin-remote_syslog	Parse IPv6 addresses in host_with_port
fluent/fluent-plugin-opensearch	Add client_chain to send intermediate certificates with excon
fluent-plugins-nursery/fluent-plugin-out-http	Send the intermediate certificates of client_cert_path
fluent-plugins-nursery/fluent-plugin-concat	Fix streams mixing when the tag or identity contains a colon
kubernetes-sigs/kubebuilder	🐛 (API): keep the target's line endings in UncommentCode and CommentCode
kubernetes-sigs/controller-tools	🐛 markers: parse bool-prefixed bare strings as strings
helm/chart-testing	fix(exec): stop RunProcess from hanging on large stderr output
velero-io/velero-plugin-for-gcp	Retry regional disk snapshots without labels when setLabels is missing
aws/karpenter-provider-aws	fix: render settings.vmMemoryOverheadPercent when it is 0
kyverno/policies	fix(best-practices-vpol): check only regular containers in require-ro-rootfs fix(psp-migration-mpol): mutate Pods only in add-apparmor, add-capabilities and add-runtimeClassName
kyverno/kyverno	fix(cel): select the highest-priority exception when priorities are negative fix(dpol): resolve wildcard apiGroups and apiVersions against discovery
kubernetes-sigs/external-dns	fix(cloudflare): ignore spaces and empty entries in custom hostnames
kubernetes/autoscaler	cluster-autoscaler/chart: keep PDB minAvailable/maxUnavailable with a custom selector hetzner: map initializing, off and deleting servers to an instance state
vmware-tanzu/helm-charts	[velero] Render skipImmediately: false on schedules
kubernetes-sigs/node-feature-discovery	fix(kernel): parse version components when the suffix starts with '+' fix(nodefeaturerule): evaluate each term with its own match result
kedacore/charts	fix: document nanos as the zap time encoding value
openobserve/o2-k8s-operator	fix: use group-qualified CRD names in deploy.sh --uninstall
kubernetes/cloud-provider-openstack	[occm] Rename listener when its pool already has the new cluster-name
kubernetes/kubernetes	cloud-provider: test route controller triggers and route_sync_total labels
proxmoxer/proxmoxer	Fix Tasks.decode_log for log pages that do not start at line 1
openbq-org/OpenBB	[BugFix] `openbb-core`: Build combined certificate path from the file name
losisin/helm-values-schema-json	fix: resolve YAML aliases and merge keys in values
sergelogvinov/helm-charts	fix(mongodb-backup): apply podLabels to job pods
containerd/nerdctl	fix(compose): honor deploy.restart_policy condition on-failure
DataDog/integrations-extras	Add Xinference integration Add LocalAI integration Add vLLM Production Stack integration Add Volcano integration Add Hugging Face TEI integration Add llama.cpp integration
bank-of-england/forecast_evaluation	Accept a single extra_ids string and name missing columns in validation errors
tiiuae/sbomnix	repology: treat infinity endpoints as open-ended in is_affected
bloomberg/memray	Fix stats histogram for degenerate sizes and bin edges
civo/civo-cloud-controller-manager	fix: use the node InternalIP for load balancer backends and skip nodes without an address
vultr/vultr-cloud-controller-manager	Trim whitespace in https-ports and firewall-rules annotations
bytebase/terraform-provider-bytebase	fix: handle environments removed outside Terraform fix: drop archived or purged projects from state on read
fluent-plugins-nursery/fluent-plugin-kubernetes_metadata_filter	Point the container to the pod once a later lookup finds it
Telmate/terraform-provider-proxmox	fix: keep proxmox_pool in state when reading it fails
sergelogvinov/karpenter-provider-proxmox	fix: stop slaac from writing into net.IPv6zero
prometheus-community/helm-charts	[prometheus-yet-another-cloudwatch-exporter] Add dnsPolicy and dnsConfig [prometheus-sql-exporter] Fix indentation of serviceAccount annotations and networkPolicy labels [prometheus-adapter] Fix service annotations indentation [prometheus-systemd-exporter] Render env values in the DaemonSet [alertmanager-snmp-notifier] Honor namespaceOverride on all resources
rancher/wrangler	Do not panic on conditions without LastUpdateTime
ionos-cloud/cluster-api-provider-ionoscloud	🐛 Make FindLatestMachine independent of list order
syself/cluster-api-provider-hetzner	🐛 Return the actual error when deleting placement groups fails
ansible-collections/community.proxmox	fix(proxmox_vm_info): return network info without requiring config fix(proxmox): keep the MAC address when updating netif fix(proxmox_kvm): return newid when the clone target already exists
linode/terraform-provider-linode	Remove image share group resources from state on 404
opentelekomcloud/terraform-provider-opentelekomcloud	[Fix] Private NAT, ER: remove deleted resources from state on read
runatlantis/atlantis	fix: don't discard approvals for a plan with no projects fix: delete plan directories on unlock fix: stop Atlantis from replying to its own comments fix: keep the policy_check status when approve_policies finds no projects fix: keep successful plans when the disable automerge label is set docs: drop push events from the GitLab webhook setup fix: read pre-v0.44.0 pull records with int policy approvals fix: reject targeted plan for a missing dir before creating its status
ionos-cloud/terraform-provider-ionoscloud	fix: remove nsg, nfs and wireguard resources from state on 404
civo/terraform-provider-civo	fix(instances): drop reserved IP assignment from state when it drifts
latitudesh/agent	fix(firewall): parse IPv6-only UFW rules so removed ones get deleted fix(client): time out API requests so a stalled call can't freeze the sync loop
kubevirt/containerized-data-importer	importer: derive the S3 region from dual-stack and FIPS endpoints
goharbor/harbor-cli	fix(retention): create a policy when the project has none
aquasecurity/trivy	fix(helm): point the ingress at the service named by service.name
project-zot/helm-charts	fix(zot): select the service namespace in the ServiceMonitor
ansible-collections/community.grafana	fix(grafana_contact_point): ignore provenance when checking for changes
wal-g/wal-g	fix(mysql): don't pass --apply-log-only to mariadb-backup
ansible-collections/community.zabbix	zabbix_host: compare inventory_zabbix values as strings
prometheus/mysqld_exporter	collector/binlog: return scan and iteration errors
zilliztech/milvus-helm	[tei] fix: render labels, annotations, volumes and topologySpreadConstraints
latitudesh/terraform-provider-latitudesh	fix(project): read the project by ID instead of scanning the first page fix: remove server, ssh_key, user_data and firewall from state when deleted outside Terraform
prometheus-community/postgres_exporter	fix(stat_progress_vacuum): read dead tuple params by server version
ansible-collections/ansible.posix	at: do not schedule jobs from the module temporary directory
qdrant/qdrant-helm	Fix readiness probe path for non-semver image tags
ansible-collections/community.aws	elasticache - do not report changes for wildcard engine versions
goreleaser/goreleaser	fix(aur): install every binary of the archive in the default package
ansible-collections/kubernetes.core	fix(k8s): match set-based label selectors on prefixed keys
terraform-aws-modules/terraform-aws-eks	fix: Remove unused cluster_primary_security_group_id from eks_managed_node_groups type
knative/eventing	fix(apiserversource): drop deleted ApiServerSources from the tracker
lima-vm/lima	downloader: don't leave a partial file at the local path limatmpl: strip native arch aliases from image-derived instance names guestagent: don't run kubectl when no kubeconfig is found
kubernetes-sigs/cluster-api-provider-aws	🐛 fix(eks): resolve sourceSecurityGroupRoles in additional control plane ingress rules 🐛 fix(eks): handle nil taint key and value in TaintsFromSDK
fluent/fluent-operator	fix(helm): honor buffer.enable in the Fluentd outputs fix(helm): use the buffer scope in the Fluentd OpenSearch output fix(helm): honor logstashFormat: false in the Fluentd ES and OpenSearch outputs
terraform-aws-modules/terraform-aws-ecs	fix: Pass `cluster_capacity_providers_wait_duration` through the root module
stackrox/kube-linter	fix(pdb-min-available): match deployments with matchExpressions selectors
kubernetes-sigs/kustomize	Make sure ResetOpenAPI() is called in tests, even if the tests failed
kubecolor/kubecolor	fix: honor =false on --no-headers, --watch, --follow and --interactive
external-secrets/external-secrets	fix(bitwarden): honor name.regexp in GetAllSecrets find
kubernetes-sigs/aws-load-balancer-controller	feat: add opt-in --leader-election-lease-duration flag feat(helm): make failurePolicy configurable for TargetGroupBinding, IngressClassParams and pod server id webhooks fix(helm): quote default-tags and aws-vpc-tags args
kubernetes-sigs/dra-example-driver	Remove the temp checkpoint file when writing the checkpoint fails
karmada-io/karmada	fix(resourceinterpreter): skip Ingress TLS entries without secretName in dependencies
etcd-io/auger	Skip tombstone revisions when listing key summaries
dapr/components-contrib	fix(state/redis): return empty results instead of an error when a query matches nothing
projectcontour/contour	Set alt_stat_name for DNS name clusters
kubernetes-sigs/aws-ebs-csi-driver	Honor leaderElection values for csi-resizer and allow lease tuning in the chart schema
argoproj/argo-helm	fix(argo-cd): render server.service.externalIPs as a list
sergelogvinov/proxmox-csi-plugin	docs: explain why volume snapshots need the root@pam password
goharbor/terraform-provider-harbor	fix(#650): retention policy replaced on every plan when scope is a plain project ID
tsuru/terraform-provider-tsuru	fix: reject malformed import IDs for tsuru_cluster_pool and tsuru_pool_constraint fix: report non-API errors from retried tsuru calls feat: add tsuru_pool data source fix: drop tsuru_app_cname and tsuru_app_router from state when removed outside terraform
tsuru/nginx-operator	fix: don't panic updating an ingress when nginx sets no ingress annotations
scaleway/terraform-provider-scaleway	fix: #4587 accept offer-specific private network options on baremetal servers
tsuru/deploy-agent	fix: return an error instead of panicking on a truncated build context archive
tsuru/charts	fix(tsuru-prometheus-pool): select pods by the release's Prometheus name
coredns/coredns	plugin/acl: only add the EDE OPT record when the request has EDNS plugin/header: keep rules from every header block
openebs/lvm-localpv	fix(chart): render lvmNode and lvmController labels
openobserve/openobserve-helm-chart	fix(openobserve,openobserve-standalone): pass group, kind and port to HTTPRoute parentRefs fix(openobserve): honor postgres.spec.enableSuperuserAccess
tsuru/tsuru-client	fix(metadata): accept the -t type in any case chore(docker): bump runtime image to alpine 3.24.3 fix: print an empty JSON array for empty lists with --json
tsuru/tsuru	fix(api): return 400 when creating a team token with an invalid token_id ci: pin third-party actions to commit SHAs and restrict token permissions fix(api): return 409 when creating a team token with an existing token_id
Mongey/terraform-provider-kafka	Support importing kafka_quota
vultr/terraform-provider-vultr	Mark credential attributes as sensitive Remove database sub-resources from state when the database is gone
digitalocean/terraform-provider-digitalocean	spaces: remove bucket CORS configuration from state when it is gone
exoscale/terraform-provider-exoscale	fix(block_storage_volume_snapshot): remove from state when deleted outside of Terraform
kubernetes-sigs/e2e-framework	conditions: wait for observed generation in DaemonSetReady utils: use go env to find the go install directory watcher: stop the event loop when the watch ends
cert-manager/cert-manager	fix(pki): accept lowercase attribute type names in literalSubject
metallb/metallb	config: detect duplicate BGPPeers that only differ by name
stakater/Reloader	fix(handler): treat non-2xx --webhook-url responses as failures
aws/aws-cli	Write JSON file cache entries atomically
cloudflare/cfssl	signer: trim spaces and skip empty entries in SplitHosts
bitnami/sealed-secrets	fix(kubeseal): fail on malformed documents instead of skipping them fix(helm): use the container ports in the NetworkPolicy ingress rule
otwld/ollama-helm	fix: keep service ipFamilies inside the non-Knative Service fix: allow revisionHistoryLimit to be set to 0
kubernetes-sigs/kwok	heap: update the key when pushing an existing item
open-webui/helm-charts	fix(terminals): match operator labels in default terminalPodSelector
aziontech/lib	fix(utils): keep '=' in cookie values in parseRequest fix(utils): treat paths with a dot in a parent segment as routes fix(cookies): emit Max-Age=0 when maxAge is 0 fix(cookies): keep '=' in cookie values when parsing
MagaluCloud/mgc-sdk-go	fix(client): let errors.Is/As see the error wrapped by RetryError fix(http): always send the request when MaxAttempts is zero or negative
MagaluCloud/terraform-provider-mgc	fix(blockstorage): remove volume from state when it no longer exists fix(vm): remove instance from state when it no longer exists
bpg/terraform-provider-proxmox	fix(acme): remove dns plugin from state when deleted outside terraform fix(vm): read back usb4 and higher host USB devices
hetznercloud/hcloud-go	fix(exp): escape backslashes in TXT records and keep escapes in one chunk
hetznercloud/terraform-provider-hcloud	fix(server): do not delete primary ip already assigned to the server
aws-ia/terraform-aws-eks-blueprints-addons	fix: Keep nested prefixes in the Velero backup location
kubernetes-sigs/descheduler	fix(helm): allow setting serviceMonitor.honorLabels to false
NVIDIA/k8s-device-plugin	Inspect embedded config.map entries before adding SYS_ADMIN
terraform-aws-modules/terraform-aws-iam	fix: Keep IRSA policy count known when policy documents are not read fix: Add `ec2:DescribeVpcPeeringConnections` to the LBC TargetGroupBinding only policy
github-aws-runners/terraform-aws-github-runner	fix(termination-watcher): keep retry queue visibility timeout at or above the Lambda timeout
kubernetes-sigs/jobset	helm: default the ServiceMonitor client cert to the release's metrics secret
equinix/terraform-provider-equinix	fix: remove equinix_fabric_connection from state when it no longer exists fix: mark Fabric credential attributes as sensitive fix: stop mutating the shared Network Edge client user agent
terrakube-io/terrakube-helm-chart	fix(otel): quote defaulted values in the otel ConfigMaps fix(api): render automountServiceAccountToken when it is false
AsyncFuncAI/deepwiki-open	fix(docker): actually install certificates from CUSTOM_CERT_DIR fix: use the shared WebSocket URL helper in slides and workshop pages
tsuru/kubernetes-router	ci: pin third-party actions to commit SHAs and restrict token permissions fix(ingress): remove certificate without panicking when ingress has multiple TLS entries
tsuru/go-tsuruclient	fix(config): keep token files readable only by the owner
tsuru/rpaas-operator	fix: return the get error before using the rpaas instance in reconcile
tsuru/acl-operator	fix: stop requeueing deleted tsuru apps and cronjobs
goharbor/harbor-helm	feat(core): add core.existingSecretKey for the core secret
memcached/memcached	contrib: add a Helm chart
flant/shell-operator	[shell-operator] feat: add a generic Helm chart
gruntwork-io/terragrunt	fix: include init in get_terraform_commands_that_need_vars for OpenTofu >= 1.8
ray-project/ray	[Java] Bump log4j to 2.25.5 and jackson-databind to 2.18.11
argoproj-labs/terraform-provider-argocd	feat(account_token): add optional token_id attribute
goharbor/harbor	fix: return 404 for role ids outside the int32 range
argoproj/argo-cd	feat(health): add health checks for Strimzi KafkaMirrorMaker and KafkaMirrorMaker2 (#5048) fix(cli): include argocd-cmd-params-cm in admin export/import (#9506) fix(cli): report server version as unavailable in core mode (#9747)
kubernetes-sigs/headlamp	frontend: resourceMap: Use targetRefs for backend policy relations
litmuschaos/litmus	fix(authentication): check the stored role before letting an owner leave
openkruise/charts	fix(kruise): point CRD conversion webhooks at the chart webhook service
openebs/dynamic-localpv-provisioner	fix(helm): render localpv.securityContext on the provisioner container
kube-logging/fluent-plugin-label-router	Add worker_id label to router metrics with multiple workers
submariner-io/submariner-charts	Omit ceIPSecPSK when no IPsec PSK is set
carvel-dev/vendir	Explain when a github release has no assets to fetch
kube-vip/kube-vip	fix(services): do not treat DHCP placeholder VIPs as shared
konveyor/tackle2-hub	🐛 Validate shared api.Document fields against their schema
crossplane/crossplane	test(e2e): cover CRD hand-off for control planes upgraded from v1.20
open-policy-agent/java-opa-sdk	fix(cli): print counters and histograms in the metrics table
kubernetes/website	[pt-br] Add tasks/configure-pod-container/configure-projected-volume-storage.md [pt-br] Add tasks/configure-pod-container/attach-handler-lifecycle-event.md [pt-br] Add tasks/configure-pod-container/configure-pod-initialization.md [pt-br] Add tasks/configure-pod-container/pull-image-private-registry.md [pt-br] Add tasks/configure-pod-container/assign-cpu-resource.md [pt-br] Add tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md [pt-br] Add tasks/configure-pod-container/assign-memory-resource.md [pt-br] Add concepts/architecture/leases.md
prometheus/alertmanager	ui: stop building a Brotli variant of index.html
envoyproxy/gateway	fix(status): merge policy ancestor status across controllers docs: move Gateway Exported Metrics from Tasks to Concepts
prometheus/node_exporter	fix(diskstats): drop sector metrics on darwin

Projects

helm-charts: production-ready Helm charts with secure defaults, Gateway API, HPA/KEDA and schema-validated values, tested and released from CI
terraform-aws-platform: opinionated Terraform modules for EKS platforms (VPC, EKS with access entries and Pod Identity, Karpenter), tested with mock providers and laid out for Terragrunt

Certifications

Platform

Delivery

Observability

Cloud & code

Navigation Menu

Lucas Barros lbarrosby

Achievements

Achievements

Block or report lbarrosby

Lucas Barros

Popular repositories Loading

Uh oh!