Excloud
platform engineer
jun 2023 to aug 2026
remote
most of it was not happy-path provisioning. it was recovery: reconciling partial state, making attach/detach/resize idempotent, cleaning up failed transitions, and debugging protocol-level failures in production.
- compute
- the Go control plane over QEMU/KVM: VM lifecycle APIs, rescue boot, volume attach and reap, subnet operations, bare-metal host setup, and reconciliation after failed transitions.
- block storage
- the storage engine on SPDK and NVMe-oF with the VFIO-user path into QEMU guests. A reconciler converges database intent against live bdev, lvol and RAID state, so a crash mid-provision recovers instead of orphaning volumes.
- kubernetes
- managed clusters end to end: control-plane and worker bootstrap, OIDC and JWKS, short-lived join credentials, Cilium and CoreDNS, a CSI driver with attach, mount, resize and failover, and a Karpenter cloud provider.
- identity / objects
- the identity and account plane — IMDS tokens, Valkey-backed caching, IAM authorization, encrypted secrets — and the S3-compatible object storage API with multipart uploads, presigned URLs and SigV4 checksums.
- managed data
- Postgres and Kafka/Streams orchestrated on the compute and DNS control planes: node lifecycle, replicas, broker provisioning, topics, users and ACLs.
- networking
- an AF_PACKET ARP/NDP proxy with BPF filtering, VLAN handling, rate limits, GARP and IPv6 DAD, plus authoritative DNS with AXFR, IXFR, TSIG and weighted records.
- the shared layer
- the Go foundation the services are built on: an HTTP framework deriving OpenAPI 3.1 from Go types by reflection, a typed error taxonomy, domain types and OpenTelemetry middleware — used by every service on the platform.
- api to client
- a generation pipeline from OpenAPI 3.1 across eight services, feeding the SDK, a 20-group CLI, and a Terraform provider with 30 resources and 13 data sources.
- console / delivery
- the Next.js console for compute, buckets, Streams, secrets, billing and security groups, with an authenticated instance terminal over Xterm and WebSockets. Plus Firecracker-based ephemeral CI runners on owned hardware, usage-based billing, and the docs site.
- live migration
- the disk migration tool rebuilt around resumable sender and receiver sessions with checkpointing, pinned per-session TLS, heartbeats and idempotent thaw recovery.
GoCTypeScriptSwiftPythonKubernetesQEMU/KVMFirecrackerSPDKNVMe-oFVFIO-userCSIKarpenterLinuxPostgreSQLValkeyClickHouseKafkaOpenTelemetryOpenAPI 3.1TerraformNext.jsReactElectronDNSHTTP/2TLS
at handover, aug 20264,000+ accounts380 active VMs140 managed Postgres clusters20+ internal services