vincent@portfolio: ~
speks — app.yaml
← cd ..

SpEKS Application Platform

in production

A six-component internal platform that turned scientific app deployment at STEMCELL Technologies from a multi-day ops ticket into a self-service command — 20+ Shiny, Streamlit, FastAPI, and static apps running on EKS behind a ShinyProxy Operator, delivered by GitOps.

role ·
design + build, sole platform engineer
years ·
2023 – present
org ·
STEMCELL Technologies (MBBG)
access ·
internal — no public repo
Architecture diagram — API / GitOps registry / EKS

problem

Twenty-plus data scientists shipped R/Shiny and Python apps by filing infrastructure tickets. Every deployment was a hand-written manifest applied by an ops engineer, so lead time was measured in days, no two apps were configured the same way, and there was no audit trail or credible rollback path. The bottleneck was a person, and it did not scale.

approach

Build a real platform rather than more automation scripts: a declarative app spec, one command to change it, and a control loop that makes the cluster match Git.

  • Hybrid CRUD + GitOps. A FastAPI control plane writes to a Kustomize registry in Git (source of truth) and caches reads in DynamoDB; FluxCD reconciles, and the ShinyProxy Operator owns app sessions.
  • Go CLI and validator. A Cobra CLI scaffolds four app types from templates and validates every manifest against platform standards before merge — the failure class moved from production to pre-commit.
  • Multi-tenant identity. Okta SSO, Active Directory groups, and Kubernetes RBAC map team scopes end to end, so a scientist's group membership is the only access decision.
  • Reproducible substrate. A Terraform EKS module plus 11 shared GitLab CI templates make new projects and new environments a config change, not a project.

outcome

  • 20+apps self-served
  • days → mindeploy lead time
  • < 5 minrollback
  • 0critical CVEs in prod images

Data scientists now promote their own apps from staging to production with one click and a full audit trail. Infrastructure tickets for app deployment went to zero, and the platform became the foundation the bioinformatics pipelines and HPC portals were built on.

apps/flow-cytometry-qc/app.yaml
apiVersion: speks.mbbg.io/v1
kind: Application
metadata:
  name: flow-cytometry-qc
spec:
  type: shiny          # shiny | streamlit | fastapi | static
  image: ecr/mbbg/flow-qc:2.14.0
  access:
    okta_groups: [mbbg-data-science]
  resources: { cpu: "2", memory: 8Gi }
  promotion: { to: prod, requires_approval: true }
$ speks app deploy — recorded session
$ speks app deploy flow-cytometry-qc --env prod✓ validate    manifest OK · 14 rules · 0 warnings✓ scaffold    kustomize overlay → registry/prod/flow-cytometry-qc✓ commit      a3f9c21 deploy(flow-qc): 2.14.0 → prod◍ reconcile   flux · kustomization/prod · 38s✓ live        https://apps.mbbg.internal/flow-cytometry-qc

screens

  • Next.js catalogue UI
  • CLI validator output