CloudOpsConsole
v1.4.0 · production · 30-day uptime 99.94%

CloudOps Platform

Multi-tenant SaaS on Kubernetes. Built for scale, designed for interviews — every layer instrumented, every line open source.

Explore the platformView architecture
platform onlineCognito · OIDCOTel · tracesStep FunctionsWS · streamingRLS · multi-tenant

Production-shaped operator console on Kubernetes & AWS.

A polyglot service mesh fanning out one synthetic order across six languages, with a live service map, span waterfalls, and a gated load generator. Built to show what prod-grade observability looks like — at portfolio cost.

Open the consoleSee the architecture
search p95 (warm)
< 100 ms
checkout SLO
99.0 %
WS reconnect
≤ 30 s
idle cost / hr
≈ $0.20

Built on

  • EKS
  • Cognito
  • API Gateway
  • Lambda
  • Step Functions
  • DynamoDB
  • Kinesis
  • RDS · Postgres + RLS
  • CloudFront
  • S3
  • OTel
  • Grafana
  • Loki
  • Tempo
  • Prometheus

What ships

Six concrete demos behind one storefront.

Each card is a path you can actually click through once a demo environment is up. The infrastructure is in modules/ — the references below tell you exactly where to look.

ADR-017

Lambda + EKS hybrid search

Cognito-authorised API Gateway in front of a Lambda that LRU-caches per tenant and HMAC-signs into Express on EKS, where the Postgres FTS index lives.

see it→
ADR-018

Realtime via WebSocket + Kinesis

Order events publish to Kinesis post-commit; a fanout Lambda pushes owner-scoped updates to active WS connections. Stale connections prune on 410 Gone.

see it→
ADR-019

Post-order workflow on Step Functions

The authenticated API creates the order first; Step Functions keeps durable confirmation-email delivery, while the execution name remains the Idempotency-Key.

see it→
ADR-016

Cognito → JWT everywhere

One JWT verified the same way in middleware, Express, the search Lambda, and the WS connect handler. custom:tenant_id drives RLS in Postgres.

see it→
backlog #51

Multi-tenant by default

Force-RLS on every customer-facing table. withTenant() opens a transaction, sets app.tenant_id, and commits — so a forgotten WHERE clause cannot leak.

see it→
story #89

End-to-end OpenTelemetry

Traceparent stitched from browser → Next.js RSC → API GW → Lambda → Express → RDS → Kinesis → fanout Lambda → WS push. One Grafana board.

see it→
One request, four surfaces

Every node is a real module under modules/. Colours follow AWS service categories.

trace
Page load
Browser
RSC + WS
CloudFront
assets.<dom>
ALB
group=cloudops
Next.js · EKS
middleware jwt
Cognito
OIDC + JWKS
Search read
API GW HTTP
search.<dom>
search-gateway λ
LRU 60s + HMAC
Express · EKS
/_internal/search
RDS Postgres
FTS + RLS
Order + realtime
Express /order
RLS + audit
Kinesis
post-commit
ws-fanout λ
GSI by tenant
API GW WS
ws.<dom>
Browser
live status pill
Checkout saga
Step Functions
Standard SM
Express /order
exec name = key
SQS
order-email
order-email λ
Node 22 arm64
SES
verified sender
ComputeDatabaseNetworkingSecurityApp IntegrationAnalyticsFrontend · CloudOps

Ready when you are.

The platform is wired top to bottom. Open the live service map or walk the architecture flows end to end.

Open the consoleSee the architecture