MrGuato/mrguato

GitHub: MrGuato/mrguato

展示如何将基础设施与安全控制深度整合的实践指南，解决云原生环境下的合规与威胁响应难题。

Stars: 1 | Forks: 0

# Jonathan DeLeon 我在基础设施和安全领域工作，喜欢将这两者结合起来，而不是将安全视为事后才添加的东西。日常工作涉及 hypervisor、Kubernetes、IaC 流水线、身份识别以及将它们整合在一起的合规性工作。 [![LinkedIn](https://img.shields.io/badge/LinkedIn-0A66C2?style=flat-square&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/jonathan-deleon-cism/) [![Credly](https://img.shields.io/badge/Credly-F7931E?style=flat-square&logo=credly&logoColor=white)](https://www.credly.com/users/jonathan-deleon.bfdd720a) [![GitOps Notes](https://img.shields.io/badge/GitOps%20Notes-222222?style=flat-square&logo=githubpages&logoColor=white)](https://mrguato.github.io/gitops-notes/) [![Landing Site](https://img.shields.io/badge/Landing%20Site-%236A5ACD?style=flat-square&logo=amazonaws&logoColor=white)](https://cloud.mrcyberleon.org/) ## 活跃：homelab k3s 集群 [![Cluster](https://img.shields.io/website?url=https%3A%2F%2Fstatus.deleontech.net&up_message=healthy&up_color=brightgreen&down_message=degraded&down_color=red&label=status.deleontech.net&style=for-the-badge&logo=kubernetes&logoColor=white)](https://status.deleontech.net) 多架构 k3s 集群，运行在 Raspberry Pi 4 和一台二手的 Lenovo ThinkCentre 上。所有内容通过 FluxCD 从 [`MrGuato/pi-cluster`](https://github.com/MrGuato/pi-cluster) 声明式管理，密钥使用 SOPS 和 age 加密后直接提交到仓库。Traefik 处理路由，Cloudflare Tunnel 无需暴露端口即可接入流量，Longhorn 提供块存储，Velero 将所有数据备份到另一节点上的 MinIO 桶。上方的仪表盘从 kube-prometheus-stack 拉取数据。 ## 我正在从事的工作一个大致的路线图，展示我投入时间和使用的工具。 | 领域 | 说明 | |---|---| | Kubernetes | k3s、Helm、FluxCD、Kustomize、Longhorn、Velero。当前正在关注 Talos 和 Omni。 | | IaC | Terraform、Ansible 和 Packer。我通常用 Packer 构建黄金镜像，用 Terraform 启动它们，并用 Ansible 处理配置漂移。 | | CI/CD | GitLab CI 和 GitHub Actions，配合 Flux 实现 GitOps。我喜欢将扫描（SAST、SBOM、容器、IaC）作为流水线中的实际门禁，让问题快速失败。 | | 虚拟化 | vSphere 和 ProxMox。加固基础镜像并自动化打补丁。 | | 网络 | FortiGate、Palo Alto、Ubiquiti、Cisco。 | | 身份 | Entra ID 和条件访问。 | | 合规 | 主导 CMMC Level 2 项目。也熟悉 CIS v8、NIST CSF 2.0 和零信任工作。 | | 安全运维 | Sentinel、SentinelOne、Rapid7、Defender XDR 和 Tines 用于 SOAR。良好的遥测数据能让检测变得更容易。 | ## 项目 ### [pi-cluster](https://github.com/MrGuato/pi-cluster) 我的 homelab 集群，完全声明式。Flux 从 Git 协调应用和基础设施，声明存储在公共仓库中并使用 SOPS 加密，Renovate 保持镜像标签更新并自动创建 PR。Velero 将 restic 备份输出到另一节点上的 MinIO，Longhorn 在 ARM 和 x86 节点之间处理分布式块存储。顶部的实时仪表盘正运行在它上面。 ### [enshrouded-docker](https://github.com/MrGuato/enshrouded-docker) 为 Enshrouded 构建的容器化游戏服务器，从 scratch 基于 ubuntu:22.04 构建，并使用 WineHQ 和 SteamCMD。运行时不使用 root，采用语义化版本，并通过 GitHub Actions 流水线发布签名镜像到 GHCR。让 SteamCMD 符号链接和 Xvfb 锁文件在干净容器中正常工作比我预期的更有趣。 ### [Azure-Blob-Sync-Action](https://github.com/MrGuato/Azure-Blob-Sync-Action) 我编写的一个小型可复用 GitHub Action，用于将构建产物同步到 Azure Blob Storage。公开发布供他人使用。 ### [AWS-Cloud-Challenge](https://github.com/MrGuato/AWS-Cloud-Challenge) 一个基于 S3、CloudFront、Lambda、API Gateway 和 DynamoDB 的无服务器站点，全部通过 CloudFormation 配置，采用最小权限 IAM 和完整的部署流水线。 ## 技术栈 ### 平台 ![Kubernetes](https://img.shields.io/badge/Kubernetes-326CE5?style=for-the-badge&logo=kubernetes&logoColor=white) ![Helm](https://img.shields.io/badge/Helm-0F1689?style=for-the-badge&logo=helm&logoColor=white) ![FluxCD](https://img.shields.io/badge/FluxCD-5468FF?style=for-the-badge&logo=flux&logoColor=white) ![Docker](https://img.shields.io/badge/Docker-2496ED?style=for-the-badge&logo=docker&logoColor=white) ![Proxmox](https://img.shields.io/badge/Proxmox-E57000?style=for-the-badge&logo=proxmox&logoColor=white) ![vSphere](https://img.shields.io/badge/vSphere-607078?style=for-the-badge&logo=vmware&logoColor=white) ### 基础设施即代码 ![Terraform](https://img.shields.io/badge/Terraform-7B42BC?style=for-the-badge&logo=terraform&logoColor=white) ![Ansible](https://img.shields.io/badge/Ansible-EE0000?style=for-the-badge&logo=ansible&logoColor=white) ![Packer](https://img.shields.io/badge/Packer-02A8EF?style=for-the-badge&logo=packer&logoColor=white) ![CloudFormation](https://img.shields.io/badge/CloudFormation-FF4F8B?style=for-the-badge&logo=amazonaws&logoColor=white) ### 流水线与供应链 ![GitLab CI](https://img.shields.io/badge/GitLab%20CI-FC6D26?style=for-the-badge&logo=gitlab&logoColor=white) ![GitHub Actions](https://img.shields.io/badge/GitHub%20Actions-2088FF?style=for-the-badge&logo=githubactions&logoColor=white) ![Snyk](https://img.shields.io/badge/Snyk-4C4A73?style=for-the-badge&logo=snyk&logoColor=white) ![Trivy](https://img.shields.io/badge/Trivy-1904DA?style=for-the-badge&logo=aqua&logoColor=white) ![SOPS](https://img.shields.io/badge/SOPS%2Fage-000000?style=for-the-badge) ![Renovate](https://img.shields.io/badge/Renovate-1A1F6C?style=for-the-badge&logo=renovatebot&logoColor=white) ### 云与边缘 ![Azure](https://img.shields.io/badge/Azure-0078D4?style=for-the-badge&logo=microsoftazure&logoColor=white) ![AWS](https://img.shields.io/badge/AWS-232F3E?style=for-the-badge&logo=amazonaws&logoColor=white) ![Cloudflare](https://img.shields.io/badge/Cloudflare-F38020?style=for-the-badge&logo=cloudflare&logoColor=white) ![Traefik](https://img.shields.io/badge/Traefik-24A1C1?style=for-the-badge&logo=traefikproxy&logoColor=white) ### 网络 ![Fortinet](https://img.shields.io/badge/FortiGate-EE2E24?style=for-the-badge&logo=fortinet&logoColor=white) ![Palo Alto](https://img.shields.io/badge/Palo%20Alto-172A6B?style=for-the-badge&logo=paloaltonetworks&logoColor=white) ![Ubiquiti](https://img.shields.io/badge/Ubiquiti-0559C9?style=for-the-badge&logo=ubiquiti&logoColor=white) ### 监控 ![Prometheus](https://img.shields.io/badge/Prometheus-E6522C?style=for-the-badge&=prometheus&logoColor=white) ![Grafana](https://img.shields.io/badge/Grafana-F46800?style=for-the-badge&logo=grafana&logoColor=white) ![Loki](https://img.shields.io/badge/Loki-F5A800?style=for-the-badge&logo=grafana&logoColor=white) ### 安全运维 ![Sentinel](https://img.shields.io/badge/Sentinel-0078D4?style=for-the-badge&logo=microsoft&logoColor=white) ![SentinelOne](https://img.shields.io/badge/SentinelOne-5B2E91?style=for-the-badge&logo=sentinelone&logoColor=white) ![Rapid7](https://img.shields.io/badge/Rapid7-D02F2F?style=for-the-badge&logo=rapid7&logoColor=white) ![Defender XDR](https://img.shields.io/badge/Defender%20XDR-00A4EF?style=for-the-badge&logo=microsoft&logoColor=white) ![Tines](https://img.shields.io/badge/Tines-5A67D8?style=for-the-badge) ![Nessus](https://img.shields.io/badge/Nessus-00B3E3?style=for-the-badge&logo=tenable&logoColor=white) ### 合规 ![CMMC L2](https://img.shields.io/badge/CMMC%20L2-006400?style=for-the-badge&logo=none&logoColor=white) ![NIST 800-171](https://img.shields.io/badge/NIST%20800--171-4CAF50?style=for-the-badge&logo=none&logoColor=white) ![NIST CSF 2.0](https://img.shields.io/badge/NIST%20CSF%202.0-4CAF50?style=for-the-badge&logo=none&logoColor=white) ![CIS v8](https://img.shields.io/badge/CIS%20v8-E91E63?style=for-the-badge&logo=none&logoColor=white) ![Zero Trust](https://img.shields.io/badge/Zero%20Trust-FF6F00?style=for-the-badge&logo=none&logoColor=white) ## 资质证书 CISM

## 教育背景

WGU Graduate - Network Engineering & Cybersecurity

## 正在努力的目标

Microsoft Security Engineer Kubernetes and Cloud Native Security Associate (KCSA)

[![MrGuato's GitHub stats - Dark](https://github-readme-stats.vercel.app/api?username=mrguato&show_icons=true&theme=dark&bg_color=0d1117&icon_color=58a6ff&title_color=58a6ff&text_color=c9d1d9#gh-dark-mode-only)](https://github.com/mrguato/github-readme-stats#gh-dark-mode-only) [![MrGuato's GitHub stats - Light](https://github-readme-stats.vercel.app/api?username=mrguato&show_icons=true&theme=light&bg_color=f6f8fa&icon_color=1b1f23&title_color=0366d6&text_color=24292e#gh-light-mode-only)](https://github.com/mrguato/github-readme-stats#gh-light-mode-only) [![Top Langs - Dark](https://github-readme-stats.vercel.app/api/top-langs/?username=mrguato&layout=compact&theme=dark&bg_color=0d1117&title_color=58a6ff&text_color=c9d1d9#gh-dark-mode-only)](https://github.com/mrguato/github-readme-stats#gh-dark-mode-only) [![Top Langs - Light](https://github-readme-stats.vercel.app/api/top-langs/?username=mrguato&layout=compact&theme=light&bg_color=f6f8fa&title_color=0366d6&text_color=24292e#gh-light-mode-only)](https://.com/mrguato/github-readme-stats#gh-light-mode-only)

标签：age, Cloudflare Tunnel, EC2, FluxCD, GitOps, Helm, homelab, hypervisor, IaC, k3s, kube-prometheus-stack, Kustomize, Landing Site, Longhorn, MinIO, Raspberry Pi, SOPS, ThinkCentre, Traefik, Velero, 内存执行, 博客, 合规, 威胁情报, 子域名突变, 安全控制, 开发者工具, 系统提示词, 网络安全, 自定义请求头, 身份管理, 隐私保护