IT Ops Query: Cloud-native platform engineering in the enterprise

### Overview Recorded at KubeCon 2025 North America in Atlanta, this episode of IT Ops Query features host Beth Pariso interviewing Gaurav Saxena, Director of Engineering at a Fortune 20 automotive company. Saxena leads an infrastructure engineering team of 50 engineers focused on developer experience, productivity, an internal developer platform (IDP), data infrastructure, and site reliability engineering. The discussion centers on modernizing cloud-native core infrastructure, adopting CNCF projects to build developer platforms, implementing software supply chain security, and integrating AI workloads and agentic workflows into platform engineering.

### Key Topics - **Internal Developer Platforms (IDPs):** Establishing declarative interfaces and operational guardrails so developers can provision infrastructure without needing to navigate underlying Kubernetes details. - **Software Supply Chain Security:** Utilizing cryptographic signing, provenance tracking, and policy enforcement across CI/CD pipelines using tools like Sigstore, Cosign, and Kyverno. - **AI Infrastructure & Model Routing:** Supporting enterprise AI workloads with GPUs, private LLMs, and intelligent context-aware traffic management tools such as Envoy AI Gateway. - **Agentic AI in Operations:** Employing multimodal AI agents and MCP servers to assist developers with platform onboarding, triaging production incidents, and vulnerability scanning alongside humans in the loop.

### Technical Details - **Platform Abstraction & Management:** The platform leverages CNCF graduated and incubating projects including Crossplane, OpenTelemetry, and KubeVela. Crossplane provides a Kubernetes-driven control plane to manage hyperscaler cloud resources. Combined with KubeVela specifications, developers define declarative requirements (e.g., databases, load balancers, messaging) while the platform team handles access control lists, availability zones, and underlying Kubernetes objects. - **Supply Chain Security & Admission Control:** Following the OpenSSF baseline, the organization adopts Sigstore and Cosign within CI/CD pipelines to generate cryptographically signed Software Bills of Materials (SBOMs), verify provenance, and record metadata on public ledgers. To address vulnerabilities discovered after build artifacts sit in registries, Kyverno functions as policy-as-code integrated with Kubernetes admission controllers to reject non-compliant images. - **AI Workload Routing and Serving:** To prevent enterprise data leakage, the organization relies on open-source, private LLMs with strict guardrails. Saxena highlights the recently released Envoy AI Gateway—acting as an intelligent Layer 7 proxy capable of context-aware routing, rate limiting, and optimizing inference cost and latency across models—alongside solo.io's agent workflow tooling, Knative, and KServe (which reached incubating status).

### Takeaways Security, data sovereignty, and observability must be treated as first-class citizens rather than afterthoughts when architecting enterprise platforms. Integrating agentic workflows can significantly reduce developer cognitive load and expedite mean-time-to-resolution (MTTR) during outages, provided organizations maintain a human-in-the-loop approach and balance developer freedom with rigorous governance.