Ismail founded Edixos to do one thing properly: treat infrastructure as a software engineering problem. Eleven years in cloud-native platform engineering, SRE, and multi-tenant architecture, spent close enough to Kubernetes internals to extend them rather than work around them.
His current work is the technical lead on Renault's GKE as a Service platform, where product teams provision and operate their own clusters in self-service. He designed the architecture and wrote most of the Platform Composer controllers and CRDs behind it, along with the multi-tenancy model, the federated authentication path, and the service exposure design. Cluster provisioning went from days to minutes.
He is the main maintainer of provider-ovh, the Crossplane provider for OVHcloud, published on the Upbound Marketplace with more than 15,000 downloads and running Database-as-a-Service in production for French social ministries. He was certified CKA in December 2017, among the first worldwide.
Focus areas
- Kubernetes API Machinery
- CRD & Operator pattern
- Crossplane
- Multi-tenancy
- Platform Engineering
- GitOps
- Go
- GKE
- Workload Identity Federation
- FinOps
Field record
Where the experience comes from
-
Edixos
Founder & CEO
Leads cloud-native audits, platform maturity assessments, and architecture reviews for enterprise clients. Defines target platforms, governance models, and modernization roadmaps across GitOps, security, observability, and platform operations.
- Kubernetes
- Crossplane
- Go
- GCP
- Platform Engineering
-
Renault
Tech Lead, GKE as a Service
Designed the platform architecture and developed most of the Platform Composer controllers and CRDs (Workspace, StandardCluster, Service Exposure). Built the multi-tenant model on a management cluster with Capsule tenants, federated authentication through Okta OIDC and Workload Identity Federation, and an automated RBAC model synchronized with enterprise groups.
- GKE
- Go
- Config Connector
- Capsule
- Okta OIDC
- APIGEE
- Sveltos
- Kyverno
-
Renault AITS
Senior Site Reliability Engineer
Led the migration of more than 1,000 applications to public cloud as the group closed two data centres. Designed production-ready multi-tenant Kubernetes architectures and wrote the controllers that provisioned those environments.
- Kubernetes
- GKE
- Go
- Operators
- Cloud Migration
-
Suez Smart Solutions
Site Reliability Engineer
SRE for two industrial platforms: DigitalCity Saint-Étienne, an OpenAPI platform exposing IoT data for the smart city, and ON'connect coach, a hot water consumption optimization service.
- Kubernetes
- Kafka
- OpenAPI
- IoT
-
Société Générale
Kubernetes Specialist
Deployed an API Management platform on OpenShift, including the WSO2 images, provisioning automation, and CI through OpenShift S2I.
- OpenShift
- Docker
- WSO2
-
BNP Paribas IRB
Kubernetes Specialist
Integrated Docker into the development workflow, deployed the CI/CD platform, and automated Kubernetes development environment provisioning.
- Kubernetes
- Docker
- CI/CD
Selected work
-
Cloud Native Days France // 2026
Platform Engineering: the Renault case study, Kubernetes as a Service
Talk on running Kubernetes as a Service at scale, selected in the community's top ten sessions of the edition.
-
Upbound Marketplace
provider-ovh for Crossplane
Main maintainer. More than 15,000 downloads, running Database-as-a-Service in production for French social ministries.
-
Edixos
Nauticus
Kubernetes controller for advanced namespace management, covering tenants, namespaces, and isolation on multi-tenant platforms.
Published articles
All articles-
provider-ovh 2.18.0: FileShare access rules become their own resource
provider-ovh 2.18.0 adds FileShareACL and removes inline accessRules from FileShare — silently pruned, not rejected, so unchanged manifests stop managing rules.
-
provider-ovh 2.17.0: full OVHcloud schema coverage for Crossplane
provider-ovh 2.17.0 exposes every OVHcloud Terraform resource as a Crossplane CRD: 335 CRDs, 31 new kinds, and four removed database engines to migrate first.
-
Integrator, consultancy, hire or freelancer: what each model really costs
Time and materials, fixed scope, hiring or a freelancer: what each really costs once elapsed time is counted, and when the large integrator is still right.
-
Kubernetes expertise: how to choose a consulting partner in 2026
Five kinds of Kubernetes provider sell the same promise without selling the same thing. How to pick the right model, the seven questions to ask, the red flags.
-
Kubernetes FinOps: A Field Guide to Cutting Cluster Cost Without Breaking Prod
Cut Kubernetes cluster cost without breaking production: rightsizing, spot capacity, governance as code, and the cost metrics that actually matter.
-
AI SRE Agents: Autonomous Kubernetes Operations That Won't Wreck Prod
The senior pattern for autonomous incident response: LLM reasoning bounded by GitOps guardrails, with no drift in production.
-
Local Kubernetes Development with Tilt: Fast Inner Loop
Run a multi-service stack on a real local Kubernetes cluster with Tilt, Kind, and ctlptl. Live Update, per-service Tiltfiles, Delve debugging, and no Bitnami.
-
Bare-Metal Kubernetes with Talos: Provisioning War Stories
Talos Linux (10.7k GitHub stars) meets bare-metal Kubernetes: honest provisioning war stories on iPXE, kexec, rescue mode, disk wipes, and Pulumi gotchas.
-
Fleet-Scale Kubernetes Addon Management with Sveltos
Staged addon promotion across cluster fleets with Sveltos. 48% of teams expect >50% cluster growth in a year (Portainer 2026). Here is the full lifecycle.
-
Kubernetes Controllers: The Cache-Staleness Bug at Scale
Kubernetes production use hit 82% in 2025. Here is how step-based reconcilers and informer-cache staleness fixes keep custom controllers reliable at scale.
-
Just-in-Time Privileged Access for Multi-Tenant Kubernetes
Unit 42 found 99% of cloud identities are over-permissive. A field-tested reference architecture for just-in-time privileged access on shared Kubernetes.
-
GKE Dataplane V2: Stale eBPF Blocks Deleted NetworkPolicy
On GKE Dataplane V2, deleting a NetworkPolicy left running pods blocked by stale eBPF state. A hands-on field postmortem, with Cilium adoption up 47% in 2025.
-
Private Service Connect Multi-Gateway Pattern on GCP
Private Service Connect traffic grew 4x in 2025. A field-tested GCP pattern for exposing Kubernetes services privately at enterprise scale with Envoy Gateway.
-
Deterministic IPAM for Multi-Tenant Kubernetes on GKE
GKE rounds every node up to a /24, so a /20 pod range caps a cluster at 16 nodes. A deterministic SubnetPool playbook to escape multi-tenant VPC exhaustion.
-
AI Agents as Code Reviewers: Give Them the Design Doc
Over 1 in 5 GitHub code reviews now involve Copilot. We gave an AI agent our design docs to grade real pull requests. Here is what it caught, and missed.
-
Crossplane and OVHcloud: A provider-ovh Step-by-Step Guide
Provision OVHcloud as Kubernetes CRDs with Crossplane and Edixos' provider-ovh: install on kind, discover resources, wire credentials, deploy a managed cluster.
-
How to Build Kubernetes as a Service with Custom Controllers
A field-tested blueprint for Kubernetes as a Service: a management cluster as control plane, KRM CRDs, custom Go controllers, Crossplane, and multi-tenant RBAC.
-
Why Terraform Falls Short for Platform Engineering (and Kubernetes Wins)
Terraform provisions, but it can't run a self-service platform. Why Kubernetes, KRM, and CRDs replace TicketOps with API-first, self-healing control planes.
-
Our Kubernetes Journey: 10 Years Building Cloud-Native Platforms
How Edixos went from Kubernetes 1.2 in production (2015) to multi-tenant platforms running 1,000+ apps — with custom controllers, GitOps, and Crossplane.
Want this expertise on your platform?
Tell us what is blocking you. We will tell you who takes it and how they would approach it.