Field notes
The Edixos engineering blog
Hard-won lessons on Kubernetes, platform engineering, GitOps, and running cloud-native infrastructure in production.
- 6 min read
AI SRE Agents: Autonomous Kubernetes Operations That Won't Wreck Prod
Autonomous incident response is real in 2026, and dangerous done naively. The senior pattern: LLM reasoning bounded by GitOps guardrails, with an agent whose blast radius is defined in code.
ai-agentssrekubernetesaiopsgitopsincident-responseplatform-engineering - 7 min read
Kubernetes FinOps: A Field Guide to Cutting Cluster Cost Without Breaking Prod
Kubernetes bills balloon because requests are guesses and idle capacity is invisible. A practitioner's FinOps playbook: rightsizing, spot, governance-as-code, and the cost metrics that matter.
finopskubernetescost-optimizationrightsizingspot-instancesmulticloudsre - 10 min read
Local Kubernetes Development with Tilt: Fast Inner Loop
Run a multi-service stack on a real local Kubernetes cluster with Tilt, Kind, and ctlptl. Live Update, per-service Tiltfiles, Delve debugging, and no Bitnami.
tiltkuberneteslocal-developmentdeveloper-experiencekindory - 9 min read
AI Agents as Code Reviewers: Give Them the Design Doc
Over 1 in 5 GitHub code reviews now involve Copilot. We gave an AI agent our design docs to grade real pull requests. Here is what it caught, and missed.
ai-code-reviewplatform-engineeringcode-reviewdeveloper-productivitykubernetes - 11 min read
Deterministic IPAM for Multi-Tenant Kubernetes on GKE
GKE rounds every node up to a /24, so a /20 pod range caps a cluster at 16 nodes. A deterministic SubnetPool playbook to escape multi-tenant VPC exhaustion.
kubernetesipamgkenetworkingmulti-tenancyplatform-engineering - 13 min read
Private Service Connect Multi-Gateway Pattern on GCP
Private Service Connect traffic grew 4x in 2025. A field-tested GCP pattern for exposing Kubernetes services privately at enterprise scale with Envoy Gateway.
private-service-connectgateway-apienvoy-gatewaygcpplatform-engineeringcert-manager - 12 min read
GKE Dataplane V2: Stale eBPF Blocks Deleted NetworkPolicy
On GKE Dataplane V2, deleting a NetworkPolicy left running pods blocked by stale eBPF state. A hands-on field postmortem, with Cilium adoption up 47% in 2025.
gkeciliumebpfnetworkpolicydataplane-v2postmortem - 14 min read
Just-in-Time Privileged Access for Multi-Tenant Kubernetes
Unit 42 found 99% of cloud identities are over-permissive. A field-tested reference architecture for just-in-time privileged access on shared Kubernetes.
kubernetesrbacjust-in-time-accessmulti-tenancyplatform-securityzero-standing-privileges - 12 min read
Kubernetes Controllers: The Cache-Staleness Bug at Scale
Kubernetes production use hit 82% in 2025. Here is how step-based reconcilers and informer-cache staleness fixes keep custom controllers reliable at scale.
kubernetescontroller-runtimereconciliationplatform-engineeringreliabilityinformer-cache - 12 min read
Fleet-Scale Kubernetes Addon Management with Sveltos
Staged addon promotion across cluster fleets with Sveltos. 48% of teams expect >50% cluster growth in a year (Portainer 2026). Here is the full lifecycle.
kubernetessveltosfleet-managementplatform-engineeringgitopsaddons - 11 min read
Bare-Metal Kubernetes with Talos: Provisioning War Stories
Talos Linux (10.7k GitHub stars) meets bare-metal Kubernetes: honest provisioning war stories on iPXE, kexec, rescue mode, disk wipes, and Pulumi gotchas.
talosbare-metalkubernetesimmutable-infrastructurescalewaypulumi - 13 min read
How to Build Kubernetes as a Service with Custom Controllers
A field-tested blueprint for Kubernetes as a Service: a management cluster as control plane, KRM CRDs, custom Go controllers, Crossplane, and multi-tenant RBAC.
kuberneteskubernetes-as-a-serviceplatform-engineeringcontrol-planecustom-controllerscrdkrmcrossplaneconfig-connectormulti-cloudlanding-zonemulti-tenancy - 11 min read
Crossplane and OVHcloud: A provider-ovh Step-by-Step Guide
Provision OVHcloud as Kubernetes CRDs with Crossplane and Edixos' provider-ovh: install on kind, discover resources, wire credentials, deploy a managed cluster.
crossplaneovhcloudprovider-ovhkubernetesplatform-engineeringgitops - 6 min read
Why Terraform Falls Short for Platform Engineering (and Kubernetes Wins)
Terraform provisions, but it can't run a self-service platform. Why Kubernetes, KRM, and CRDs replace TicketOps with API-first, self-healing control planes.
crdcrossplanekrmkrokubernetesplatform-engineeringterraform - 4 min read
Our Kubernetes Journey: 10 Years Building Cloud-Native Platforms
How Edixos went from Kubernetes 1.2 in production (2015) to multi-tenant platforms running 1,000+ apps — with custom controllers, GitOps, and Crossplane.
cloud-nativecrdkubernetesplatform-engineeringcrossplanegitops