Excloud
platform engineer
jun 2023 to aug 2026
remote
at handover, aug 20264,000+ accounts380 active VMs140 managed Postgres clusters20+ internal services
provisioning that works is the easy half. most of my time went on what happens when it does not: state left half written, attach and detach and resize that had to be safe to run twice, transitions that died somewhere in the middle. the protocol bugs were the worst, because those only ever showed up in production.
- compute
- the Go control plane over QEMU/KVM: VM lifecycle APIs, rescue boot, volume attach and reap, subnet operations, bare-metal host setup, and reconciliation after failed transitions.
- block storage
- the storage engine on SPDK and NVMe-oF with the VFIO-user path into QEMU guests. A reconciler converges database intent against live bdev, lvol and RAID state, so a crash mid-provision recovers instead of orphaning volumes.
- kubernetes
- managed clusters end to end: control-plane and worker bootstrap, OIDC and JWKS, short-lived join credentials, Cilium and CoreDNS, a CSI driver with attach, mount, resize and failover, and a Karpenter cloud provider.
- identity / objects
- the identity and account plane: IMDS tokens, Valkey-backed caching, IAM authorization, encrypted secrets. also the S3-compatible object storage API with multipart uploads, presigned URLs and SigV4 checksums.
- managed data
- Postgres and Kafka/Streams orchestrated on the compute and DNS control planes: node lifecycle, replicas, broker provisioning, topics, users and ACLs.
- networking
- an AF_PACKET ARP/NDP proxy with BPF filtering, VLAN handling, rate limits, GARP and IPv6 DAD, plus authoritative DNS with AXFR, IXFR, TSIG and weighted records.
- the shared layer
- the Go foundation the services are built on: an HTTP framework deriving OpenAPI 3.1 from Go types by reflection, a typed error taxonomy, domain types and OpenTelemetry middleware. every service on the platform is built on it.
- api to client
- a generation pipeline from OpenAPI 3.1 across eight services, feeding the SDK, a 20-group CLI, and a Terraform provider with 30 resources and 13 data sources.
- console / delivery
- the Next.js console for compute, buckets, Streams, secrets, billing and security groups, with an authenticated instance terminal over Xterm and WebSockets. Plus Firecracker-based ephemeral CI runners on owned hardware, usage-based billing, and the docs site.
- live migration
- the disk migration tool rebuilt around resumable sender and receiver sessions with checkpointing, pinned per-session TLS, heartbeats and idempotent thaw recovery.
GoCTypeScriptSwiftPythonKubernetesQEMU/KVMFirecrackerSPDKNVMe-oFVFIO-userCSIKarpenterLinuxPostgreSQLValkeyClickHouseKafkaOpenTelemetryOpenAPI 3.1TerraformNext.jsReactElectronDNSHTTP/2TLS
