Although it has been a while since my last post here, I don’t want to break with the tradition of doing my annual review (make sure to check out the previous years: 2021, 2023, 2024).
Coming back to writing again feels like something I should have done months ago, but hey, it’s never too late. I used to have this habit of writing, especially in the morning, but this year most of the time I didn’t really feel like I wanted to write. I was also increasingly engaged in other hobbies (such as music …more on that later), so I kind of forgot the positive effects of reflecting on my own thoughts and putting them into words.
As I sit down here (again in the morning), it feels very hard to remember all the things that happened this year. Whenever this happens, I sometimes wonder if all the AI/GenAI usage has already impacted my brain, making me less capable of remembering things 🫠.
Professionally, I was constantly switching between Golang (mainly working on Heureka) and Python (mostly dealing with OpenStack Barbican). Beyond that, I had the chance to not only work in a Kubernetes environment but also deploy things on my own, debug, fix issues, and deepen my Kubernetes skills. At some point, I wanted to pursue the CKS (Certified Kubernetes Security Specialist) certification, but due to lack of time, I didn’t manage to do so.
Apart from work I’m pretty grateful for all the things I managed to experience and all the new people I’ve met. Since January, I’m playing the Bongos regularly together with Barrio Latino playing Salsa, Cumbia, ChaChaCha and Bolero. Not only this: I also managed to get more serious about House music production after purchasing my first groovebox. I also have to think of the great time my family and I had in Peloponnese, Greece. I enjoyed the food, the olive oil, the people and of course the ☀️.
Now let’s first start with the goals I had for this year.
Goals for 2025 #
Looking back at the goals I set for myself in 2024, it’s time to reflect a little bit on these:
Kubernetes exploration
K8s remains a knowledge gap I’m more than determined to address. I’ll again follow a “slow productivity” approach:
- Start with small-scale experiments using k3s/k3d
- Work towards deploying my own little cluster, either on a VPS or locally
- Build practical experience through hands-on projects
And I still need to finish Kubernetes in Action which is really a great book if you want to learn about Kubernetes.
Golang deep dive
With my recent transition towards more Software Engineering-focused tasks, I’m planning to strengthen my Golang expertise. There are 2 specific areas I’d like to know more about:
- Generics: This remains somewhat of a black box that I need to illuminate more
- Concurrency: Beyond basic understanding, I want to explore and implement common patterns that can be applied across different problems
Security tooling
The GitHub repository security checker is still on my radar. With the rise of LLMs, I believe much of the foundational work (authentication, API interactions) can be implemented easily. The key focus will be on defining comprehensive security and compliance checks that provide real value to the users.
Music
My percussion journey continues with a focus on Congas. I’ve already invested in some “Compact Congas” (Giovanni Hidalgo model) that fit perfectly in my space. I believe Congas offer more “flexibility” than Bongos for song accompaniment (and solos!), and I’m particularly excited to explore Salsa music, though I’m keeping my options open for other styles.
The acoustic guitar hasn’t been forgotten - I still pick it up regularly. However, I’m considering taking formal lessons to improve, especially in finger-style playing. But who knows if I’ll ever get the chance to do this at all 🤷
To be honest, I must admit that I really made impressive progress only in the music area. But let’s start with the technical topics first.
Kubernetes #
Nowadays, Kubernetes has become the leading orchestration platform. While at Cashlink I used to set up a completely new environment (using EKS) from scratch (which was rather a simple configuration), at SAP I already found complex clusters that required me to learn new things. I learned a lot by just having a service/application (Heureka) and being forced to take care of the full deployment. I definitely learned a lot about Helm charts, and I for sure made my mistakes along the way. On this journey, I also discovered kubel, which became my main tool for interacting with the various clusters (from Emacs of course). I’m still lacking knowledge in some more advanced topics, which is why I initially planned to at least pursue the CKS. Due to time constraints, I didn’t have the time or mental capacity to address this.
Golang #
I came to SAP partly because I wanted to dive deeper into Golang. Last year (at least for the second half) I went into gopher-mode for quite a long time. During that time, I realized I lacked deep knowledge in Generics and concurrency. Looking back at this year, I think I’ve learned a lot more about concurrency than Generics. I even started to document some best practices but at some point I gave it up (mostly because these days, with the use of LLMs, you already have access to lots of information; what’s the point of having these kinds of resources available on personal blogs/sites?).
What made this year particularly interesting was getting to architect and develop a completely new service in the area of HSM (Hardware Security Module) devices. This was fascinating territory (dealing with cryptographic hardware), PKCS#11 interfaces, and the inherent complexities of multi-tenancy in security-critical environments. The challenge wasn’t just about understanding the PKCS#11 standard, but making the whole system work reliably under concurrent load while maintaining strict security boundaries between tenants. That again made the whole team think deeply about concurrent operations against PKCS11 tokens. It’s one thing to read about thread safety in cryptographic operations, but implementing it in production is a different beast entirely.
Besides the HSM work and continuing with Heureka, I also had the chance to refactor a Golang project to a software architecture similar to Hexagonal Architecture (check out my notes from a podcast which described really well what this is about). What I particularly enjoyed about Go this year was how well it handles the kind of systems programming we do: Building robust, concurrent services that need to handle complex orchestration and high loads while maintaining clean, readable code.
Looking back, I feel incredibly grateful for being able to work on such exciting and technically challenging projects. Not every developer gets the opportunity to dive deep into cryptographic hardware and security-critical systems. It’s been both humbling and energizing to tackle these complex problems.
Python & OpenStack #
On the Python side, I spent considerable time extending OpenStack Barbican’s crypto plugin ecosystem, specifically developing a new plugin that further expands the available PKCS#11 capabilities. You can check out my contributions to the SAP Barbican fork if you’re curious about the technical details.
What struck me most this year was how Python and Go serve such different purposes in our infrastructure. While Go excels at building robust, concurrent services that need to handle high loads and complex orchestration, Python shines in the OpenStack ecosystem where flexibility and rapid iteration matter more than raw performance. The plugin architecture in Barbican, for example, makes it relatively straightforward to extend functionality. Both languages taught me different lessons about software architecture and the trade-offs we make in distributed systems.
I’m particularly proud that I managed to contribute meaningfully to one of OpenStack’s core services (well our changes are still not in upstream…yet). Barbican is used by thousands of deployments worldwide, so knowing that my work helps secure cryptographic operations at that scale feels quite rewarding. It’s one thing to write code, but contributing to critical infrastructure that others depend on adds a different level of responsibility and satisfaction.
Security Tooling #
Back in 2024, I mentioned wanting to build a GitHub repository security checker: A tool that would audit repositories for security and compliance issues. This year, I finally started working on this idea, which evolved into reposhield.
I kicked off the project in April, and true to my “slow productivity” approach, I spent considerable time on the architectural foundation rather than rushing into feature implementation. The project follows Hexagonal Architecture principles with a clean separation of concerns.
The current state is what I’d call “architecturally complete but functionally incomplete.” I’ve established:
- Core domain models (Finding, ScanResult, Severity levels)
- A well-defined
Scannerinterface for extensibility - GitHub API abstraction layer with proper rate limiting
- Configuration management through environment variables
- Mock implementations for testing (using mockery)
- GitHub Action integration structure
- Documentation outlining the complete architecture
What’s missing? The actual scanner implementations 🙈. I’ve designed the system to support multiple scanners (branch protection, secret detection, MFA enforcement, workflow security, etc.), but I haven’t implemented them yet. Part of this was intentional. I wanted to get the architecture right before diving into the individual features. The other part was simply running out of time and mental capacity, similar to what happened with the CKS certification.
Looking back, I’m satisfied with taking this measured approach. Having a solid architectural foundation means that when I do continue working on this project, adding new scanners will be straightforward. The clean architecture also makes the codebase easier to test and maintain, lessons I’ve internalized from working on larger open-source projects this year.
Music #
Last year I was very excited about buying my new pair of Congas. Although I was practicing a lot, I soon realized it’s not that much fun to play alone (same applies, I guess, for every instrument). Music is meant to bind people, to create some sort of community, to transfer a message. That’s why soon (I guess it was January or so) I started looking for bands/musicians on berlinmusiker.de, especially in the area of Latin music (I was mostly interested in Salsa). To my surprise I’ve found a band nearby which was actually looking for a percussionist.
Me playing the LP compact congas I bought last year:
I was indeed very excited and soon I found myself rehearsing with the rest of the band (at the beginning we were only 4 people: one keyboardist, one conguero, one guitarist and a singer). Although I thought they were looking for some conguero, I then ended up playing again the bongos. This was/is not per se bad as I re-discovered this instrument and found out new ways to play it. In retrospect, however, I wish I would have played more congas! I haven’t used the pair of congas I bought for a while, mostly because I don’t have time to practice bongos AND congas. And if that wasn’t enough: Also this year I’ve found myself making more and more electronic music using my MC-101.
I think I’m pretty grateful for finding these lovely people and playing together with them. Meanwhile the overall band size grew to 10-13 people and we already had several concerts this year. Make sure to check out Barrio Latino Band on Instagram.
Our first concert at the Fete de la Musique 2025:
I’m playing the bongos (right side in the video):
Some other concert at the isy bar in Berlin:
Looking back at this musical journey, I feel incredibly grateful for being able to play in a band and managing to have concerts with a full ensemble after just a few months of rehearsing together. The experience taught me so much about music arrangement, how different instruments need to complement each other, when to step back and let others shine, and when to drive the rhythm forward. I definitely improved my bongo skills significantly, discovering techniques and patterns I never would have learned playing alone.
But what I enjoyed most was playing in front of people and feeling that direct energy exchange with the audience. There’s something magical about live performance you can literally feel when the crowd is with you, when they’re dancing, when they’re truly engaged. It’s a completely different experience from making music in isolation or even just rehearsing with the band.
Oh, and speaking of live performance energy - this year I also experienced it from the audience side when I went to my first Robbie Williams concert in Berlin. Man, it was absolutely awesome! I mean, being in that massive crowd, everyone singing along, you really feel that connection I’ve been discovering through playing with the band. Watching how Robbie just owned that stage and had everyone completely captivated… it definitely gave me some perspective on what we’re trying to achieve when we’re up there playing ourselves.
Productivity #
Compared to my last year’s statement:
After years of experimenting with various productivity systems, 2024 was the year where things finally clicked into place. Countless hours of listening to Cal Newport’s podcast on slow productivity helped me internalize key concepts like multi-scale planning, time blocking, and deep work. This evolution in my approach has fundamentally changed how I structure my days and manage my projects.
… this year I have no revelation to write about. I guess I’ve incorporated those practices well while keeping the balance between digital and analogue tools. I’m still using paper to actually plan my day:
I was, of course, tempted to add some AI sauce everywhere in order to optimize all the things, but I’m glad I haven’t done so. I’m still using ORG mode files to structure projects and keep track of notes, tasks, meeting notes, etc. I use my (analogue, paper-based) notebook to plan my day and capture spontaneous ideas and meeting notes.
One thing I stopped doing was meticulously tracking my time in ORG agenda. I found myself feeling blocked every time I wanted to keep track of my activities since it implied creating a new task, refiling it to the right ORG subtree, clocking in, etc. I’m also not keeping track of project tasks in ORG mode anymore, as I’m currently working on three projects max. Most of the time, I use GitHub issues for this purpose.
Overall, I think the year started with good intentions: I’ve done my multi-scale planning, I’ve had my quarters filled in with goals, and of course I’d written down my year’s goals. However, I feel I neglected focusing on just a few projects at a time (and also finishing them). Instead, I was more in an on-demand mode where I couldn’t have a clear picture of what I was heading toward. I guess I’ll have to review my habits again and return to a mode where I have a clear picture of what I want to achieve.
Habits #
Reading #
In terms of tooling, not much has changed since last year. I’m still using Goodreads as a source for book inspiration, and my Pocketbook Inkpad 3 still serves me best. Here is my reading list for 2025:
- Jäger, Hirten, Kritiker
- Tyranny of the Minority
- Brave New World
- Slow Productivity
- Baustellen der Nation
- Kleine Freiheit Garten
- Brief Answers to the Big Questions
- Nexus
- Becoming Supernatural
- The Anxious Generation
- The Righteous Mind
- The Stoic Mindset: Living the Ten Principles of Stoicism
- The Little Book of Stoicism