Marcin Mozolewski — Senior Cloud Platform Engineer

==> sys-01.md <==

# A network foundation shared by two clouds and a data center

Every team solved connectivity in its own way, and there was no highly available path between Google Cloud, on-premises and a second public cloud.

I helped design and build a redundant interconnect foundation with geo-redundant failover, and a pattern that lets spoke networks attach to it without one-off engineering. It is in production with disaster recovery in a second region, engineered for 20 Gbps against a four-nines target, and the first applications are running over it — about 25% better than the path they left.

result: in production · DR in a second region · 20 Gbps, four nines by design · ~25% better on the traffic moved

tags: cloud-interconnect cloud-router vpc terraform

==> sys-02.md <==

# Egress policy that runs inside the request, not beside it

Traffic arriving over Private Service Connect carries nothing that identifies the consumer behind it, so egress policy cannot be enforced per consumer — and no managed service offered it at the time, which I established before building anything.

I built a control plane that resolves each connection's consumer and decides allow or deny in-process inside the proxy, fail-closed, with no network round trip on the decision path. It runs across two regions and is operated hands-off through GitOps. Other teams adopt it through a Terraform provider I wrote.

result: two regions · fail-closed · no network round trip on the decision path

tags: envoy rust-wasm go postgresql kubernetes flux

==> sys-03.md <==

# One path for every new project

New projects, their Terraform workspaces and their infrastructure repositories were created ad hoc, with no consistent model to inherit.

I designed the automated path they all take now — creation, labeling, perimeter placement, identity federation, multi-environment support — and the API in front of it. Since 2026 it is the only way a new project is created, not one route among several, and hundreds of applications have been provisioned on one uniform model.

result: every new project since 2026 · hundreds of applications on one uniform model

tags: terraform terraform-cloud google-cloud open-policy-agent