How Spacelift unified infrastructure management for EDX Markets across OpenTofu, Ansible, and Kubernetes

EDX Markets runs a digital asset trading venue and clearinghouse for institutional-only trading, backed by leading brokerages, market makers, and trading firms. EDX was built to bring traditional finance market structure to institutional crypto markets via a non-conflicted model, an approach made even more compelling by the collapse of high-profile crypto firms like FTX. Those same responsible standards extend to its infrastructure: SOC 2-compliant, institutional-grade controls, industry-leading trading technology, and uptime expectations matching the 24/7 nature of crypto itself.

“Any time we have downtime, it means our market is closed while someone else’s market is still open, so we strive for 100% uptime,” says Robert Put, Head of Infrastructure at EDX Markets.

The infrastructure supporting that uptime spans two clearinghouses across four AWS regions, with on-premises trading environments in New York and Tokyo and disaster recovery sites in Chicago and Singapore. An automation-first infrastructure team supports the clearing technology, markets technology, and security teams, using private Spacelift workers connected across internal networks via Twingate.

We spoke to Put about the approaches to infrastructure management the team tried, why they chose Spacelift, and what they have built since going live with Spacelift in September 2025.

From day one, EDX’s infrastructure team committed to putting everything into infrastructure as code (IaC). The team prioritized application deployment speed, standing up CI/CD pipelines for application developers first, while infrastructure changes ran through custom Python and bash tooling.

That approach worked. It got infrastructure into code and kept changes moving. But as the environment expanded from the United States into Asia and added on-premises components in both regions, the custom tooling became more complex, and the time needed to maintain and extend increased accordingly. Maintaining a bespoke deployment solution was not where the firm wanted to invest as its footprint scaled.

Compliance needs added to the pressure. Demonstrating a clear audit trail of authorized infrastructure changes was far more straightforward through a managed platform than through custom tooling.

EDX evaluated Terraform Cloud (TFC) as a path forward but ruled it out. The per-resource pricing model ran directly against the team’s IaC-everything philosophy. “A per-resource model creates the wrong incentive,” Put explains. “Teams start minimizing what they load into the platform or batching changes to avoid runs, which is exactly the behavior you don’t want when the goal is getting everything into IaC.”

The team first assessed Spacelift in early 2025. After an initial technical demo, they stepped back for eight months while capacity and migration planning aligned. When they returned in August 2025, the deal closed in two weeks.

Three tools were running across the EDX Markets stack: OpenTofu for cloud infrastructure, Ansible for on-prem configuration management, and Kubernetes with Helm for cloud application deployment. Each had its own workflow, its own audit trail, and its own failure modes. Finding a platform that could handle all three was a hard requirement.

One thing that stood out early was the ability to manage Spacelift through its own platform. As Put describes it, “Managing IaC pipelines with IaC seemed very appealing to us. The Spacelift provider felt like a first-class product.” The team ultimately used the Spacelift OpenTofu provider to deploy every Spacelift pipeline, which made the initial rollout and subsequent scaling straightforward.

Private worker support was another important requirement. Because EDX Markets manages on-premises trading environments alongside cloud infrastructure, private Spacelift workers needed to reach internal networks securely. The team uses Twingate alongside private workers to enable that connectivity across their global on-premises footprint.

EDX onboarded in phases. The team started with a net new workload, (i.e., the OpenTofu pipelines without existing automation). Once those were stable, they migrated Ansible pipelines, and then Kubernetes. “We 100% leveraged the Spacelift OpenTofu provider for deploying all our Spacelift pipelines, which made it extremely easy to move and scale fast once the first dev pipelines were working,” Put says.

Replacing AWS CodeBuild for Kubernetes deployments had an immediate impact. The previous flow ran CodePipeline into CodeBuild and executed helm install directly. Routing deployments through Spacelift with Helm templating instead removed a layer of operational overhead and eliminated Helm rollback issues that required manual infrastructure intervention when things go wrong.

The GitHub integration changed how the team prepares for production deployments. Plan and dry-run output is now visible directly in pull requests, which has reduced the coordination effort required before applying changes to production and made it easier to identify bugs in production in time to address them.

Developer self-service was another major focus. Developers previously had no direct access to roll back deployments or restart services, so those requests routed through the infrastructure team. Spacelift’s spaces, login policies, and approval policies changed that. Developers now access specific stacks in lower environments, trigger Ansible and Kubernetes tasks through predefined playbooks, and manage their own rollbacks. Approval policies prevent modifications outside the defined guardrails.

Client onboarding is another area where Spacelift improved an existing process. Infrastructure is a core part of onboarding every new institutional client, and that work was already defined in code. Applying it meant coordinating a series of related changes across multiple systems. With Spacelift, updating a single client onboarding file now triggers all dependent stacks automatically, creating a more repeatable process that minimizes room for human error.

Drift detection runs nightly on all client-related stacks. “If there’s drift, it’ll ping us in Slack and then an infrastructure engineer will review before applying the remediation,” says Put. This decision to investigate before remediating is a deliberate choice to understand the root cause rather than auto-fix.

Spacelift also enables EDX to bring other teams onto the same system. Because it provides one auditable workflow for any type of change, teams beyond infrastructure, such as EDX’s security team, can onboard and drive their own changes through the platform.

EDX Markets now manages 18,000 resources through Spacelift, spanning OpenTofu, Ansible, and Kubernetes in a single platform. That level of consolidation is something the team’s previous tool-by-tool setup could never deliver.

Lead time to change moved from within a day to hours or minutes. The specific wins vary by tool. For OpenTofu, removing local runs was the primary driver. For Kubernetes, eliminating the AWS CodeBuild layer and helm install failures made the biggest difference. For the broader team, the GitHub plan output integration reduced production planning overhead.

“The mental overhead of remembering where to deploy IaC changes has dropped with correctly configured triggers and approval policies,” Put says. Automated dependency management handles the sequencing the team used to track manually. There were also compliance benefits. With every deployment running through Spacelift, SOC 2 audit evidence is a Spacelift run record rather than a reconstruction from AWS audit logs.

Looking ahead, EDX is removing direct production write access for infrastructure engineers. Spacelift will be the only interface for production changes; AWS logins will stay read-only except for escalation during incidents. AI integration is also on the roadmap: connecting Spacelift’s MCP server to AI-assisted developer tooling so developers can cross-reference Spacelift deployment history and IaC changes with the issues they are troubleshooting.

Put’s advice to any team still on the fence? “I wish I had onboarded Spacelift from day one at EDX Markets.”