PLATFORM ENGINEER · KUBERNETES · AI INFRASTRUCTURE
I'm Musa. I build and operate the Kubernetes platforms that keep AI agent products reliable in production, and I contribute the same rigor upstream to Kubernetes itself.
Co-founder & Platform Engineer, SaaSPro Labs
01 / SELECTED ENGINEERING WORK
At SaaSPro Labs, I own the systems that make AI agents dependable, not just demoable.
01 — AI AGENT INFRASTRUCTURE
Kubernetes infrastructure powering AI agents for health insurance operations across Africa and the Gulf. Multi-cluster, namespace-isolated platform design, GitOps delivery, and live version upgrades with zero disruption to running workloads.
On-call ownership for systems a business runs on daily.
02 — PLATFORM DESIGN
Designed and scaffolded a namespace-isolated, two-cluster EKS platform from scratch, separating environments cleanly at the infrastructure layer rather than trusting convention to keep them apart.
Isolation as a property of the architecture, not a policy.
02 / OUT IN THE OPEN
The same discipline applied to the projects everything else runs on top of: Kubernetes, Prometheus, and Meshery.
KEP-6312 · kubernetes/enhancements
Authored a Kubernetes Enhancement Proposal to sig-network, relaxing hostAliases[].hostnames validation behind a feature gate to accept trailing-dot FQDN notation, standard Unix hosts-file syntax that kube-apiserver currently rejects outright with no workaround.
The proposal was shaped directly by a previous KEP's regression: a DNS validation fix that worked under glibc but silently broke resolution under musl libc (Alpine). The test plan here requires verifying actual hostname resolution inside both glibc and musl containers, not just confirming the API server accepts the object.
Verify real behavior, not surface-level success.
View the PR on GitHub ↗prometheus/alertmanager
Open PR to Alertmanager's email notifier: report the actual failure reason from SMTP reply codes instead of a generic send error, so operators can tell a bad recipient address from a rejected relay without digging through logs.
View the PR ↗meshery/meshery · meshkit · schemas
Ongoing contributions to the Meshery service-mesh management plane (CNCF): a path-traversal and script-injection fix in the registry's SVG upload path, a goroutine-lifecycle race that could panic on a closed channel, and a run of schema and API-contract corrections.
View the security fix ↗Tools built for the same problems, released as standalone utilities.
dnspreflight
Checks DNS-01 ACME challenge propagation at authoritative nameservers, the same check cert-manager runs internally, before you wait on a timeout to find out it failed.
View on GitHub ↗alertmanager-slack-threader
Relays Alertmanager webhook notifications into threaded Slack replies instead of a new message per notification, keeping incident channels readable.
View on GitHub ↗synthetic-monitoring-blackbox
Blackbox Exporter and Prometheus wired together for synthetic uptime and latency checks with alerting, deployable as a self-contained kit.
View on GitHub ↗Quran Unlock · mobile app · 300,000+ users
Quran Unlock locks distracting apps (Instagram, TikTok, X, YouTube) after each prayer time until the user reads a few minutes of Quran. Working closely with co-founders Yacine Alloul and Muhammad Khalifa on product direction, I shipped dark mode support, localization and copy fixes across the app's language packs, and UX polish.
Visit Quran Unlock ↗03 / HOW I THINK
From design to production traffic, and whoever's on call when it breaks.
An API accepting an object isn't the same as the system working. Test what actually happens at runtime, across the environments that matter.
Feature-gated, additive rollouts. Nothing ships in a way that can't be dialed back without taking workloads down with it.
Boundaries that matter get built into the infrastructure itself, not enforced by convention or a note in a runbook.
LET'S CONNECT
AI infrastructure, Kubernetes platforms, and the systems underneath them. That's where I work.