Golden Platform
NAWEX Platform: one template for enterprise modernization
NAWEX is my golden platform: the patterns I use across regulated, multi-cloud engagements, packaged so a team can clone it, choose a cloud, and run one command. It covers landing zones, migration, IAM modernization, governed AI, and day-2 operations, built for environments where compliance and uptime both matter.
4
Clouds: AWS, Azure, GCP, OpenShift
5
Business domains
1
Config file to adopt it
v2.0
Released October 2026
What you get
Multi-cloud landing zones
EKS, AKS, GKE, or OpenShift with matching registries, ingress, storage, and workload identity, plus an optional GPU node pool. Deploys use keyless OIDC, so no cloud keys are stored in CI.
VMware to OpenShift migration factory
Takes an RVTools inventory and produces a per-VM readiness assessment, dependency-aware migration waves, and Migration Toolkit for Virtualization manifests applied by Argo CD, with cutover and rollback runbooks.
AWS IAM modernization
Persona-based workforce access through IAM Identity Center, AD groups provisioned via PingFederate, SCPs and RCPs, a mandatory permission boundary, an OPA gate on every Terraform plan, and a Wiz gap assessment.
Governed AI engine
LSTM and TCN forecasters, explainable risk scoring, and AIOps remediation that runs observe, analyze, plan, execute. GPU-accelerated training is built in, with CUDA, MPS, or CPU selected automatically.
AI security at every layer
Every autonomous action passes an action governor: allowlists, rate and blast-radius caps, autonomy modes, mandatory human approval for critical actions, a kill switch, model integrity checks, and a hash-chained audit trail.
Day-2 operations
Prometheus, Grafana, Loki, and Tempo, with SLOs, alert rules, runbooks, and chaos scripts. CI runs linting, type checks, tests, container scanning, SBOMs, and IaC validation on every change.
Adopt it in four steps
- 1
make init SLUG=acmeRename the package, CLI, images, env vars, and metrics for your engagement.
- 2
$EDITOR platform.yamlChoose cloud, region, environment, domains, and AI-safety mode in one file.
- 3
make upRun the whole platform locally in Docker Compose, with API docs and an executive console.
- 4
make deploy CLOUD=awsProvision the landing zone and registry, then Helm-install the platform.
Runs on your cloud
| Cloud | Cluster | Registry | Workload identity |
|---|---|---|---|
| AWS | EKS | ECR | IRSA |
| Azure | AKS | ACR | Entra workload identity |
| GCP | GKE | Artifact Registry | GKE workload identity |
| OpenShift | OCP, ROSA, ARO | Any | Service accounts + SCC |
Production-shaped domains
Each domain ships as FastAPI services with health, readiness, and Prometheus metrics endpoints, running as non-root on a read-only filesystem. Disable any domain you don't need in platform.yaml.
Healthcare
EHR ingestion, clinical decision support, and a patient gateway: FHIR R4, NEWS2 scoring, HIPAA audit, and consent.
Financial services
Transaction engine, fraud detection, and a payment gateway built for PCI-DSS and SOX controls.
GPU optimization
Fleet analysis from nvidia-smi or DCGM: throttling, ECC and XID faults, idle GPUs, power caps, and estimated savings.
Migration
VMware to OpenShift assessment, wave planning, and MTV manifest generation as a service.
Identity governance
AWS access-model linting, IAM role cleanup and consolidation, and Wiz control gap assessment.
Learn it in eight weeks
The way I recommend learning the platform, and the path I use to prepare for senior platform, SRE, and cloud architecture interviews: one layer a week. Read the code, run it, break it, then explain it in your own words.
Week 1
Golden path
Platform engineering, developer experience, monorepo design
make bootstrap && make check && make upWeek 2
Landing zones
Terraform, Helm, workload identity, keyless OIDC in CI
make validate-infra && make plan CLOUD=awsWeek 3
Observability & SRE
SLOs and error budgets, alerting, chaos, incident response
make up-observabilityWeek 4
AI security
Guardrails, rate limits, kill switch, tamper-evident audit
make security-statusWeek 5
AI engine & AIOps
Forecasting, anomaly detection, human-in-the-loop remediation
make train && make orchestrateWeek 6
VMware to OpenShift
Readiness assessment, wave planning, OpenShift Virtualization
make migrate-assess migrate-plan migrate-manifestsWeek 7
IAM modernization
Identity Center, SCPs and RCPs, permission boundaries, OPA
make iam-model iam-roles iam-gaps iam-policy-testWeek 8
Real cloud deploy
Deploy time, cost, latency under load, recovery after failure
make deploy CLOUD=aws ENV=dev
A 10-minute interview demo
Senior interviews test judgment, not just features. This demo shows reliability, security, and governance working together on a running system, and every step leads back to real code.
- 1Walk the architecture and the one config file
- 2Start the whole platform with make up
- 3Inject a failure and watch the alert fire
- 4Let governed remediation plan a fix in dry-run mode
- 5Approve it as a named human and show the audit trail
- 6Confirm recovery on the dashboards
Consulting & contract engagements
Each part of the platform maps to a fixed-scope engagement with working deliverables, not a slide deck.
2 to 3 weeks
VMware exit assessment
Send an RVTools export; get a per-VM readiness report, dependency-aware migration waves, and an OpenShift Virtualization plan.
2 to 4 weeks
AWS IAM modernization assessment
Role cleanup and consolidation plan, an Identity Center persona model, and a control gap register built from your Wiz findings.
About 30 days
Platform jumpstart
A landing zone and the platform deployed in your own cloud account, with observability, runbooks, and CI/CD security scanning.
2 weeks
AI governance review
Apply guardrails, autonomy modes, human approval, and audit controls to your AIOps automation or AI agents.
Bring a golden platform to your organization
I use NAWEX to stand up modernization programs for healthcare, financial services, and government teams. If you want a hardened, governed starting point instead of a blank repo, let's talk.