Collects live data from building systems (sensors, HVAC, meters) and serves the dashboards and alarms facility teams use. I run it on GKE at Primustech. First what I shipped on it, each as a small working model; then the platform from the inside: how traffic moves, what I alert on, and where the money went.
Primustech · Kubernetes on GKE
Moved a live building-operations platform off a single Docker Compose VM and onto Kubernetes.
One VM, Docker Compose, one in-memory queue
One failure domain, deployed by hand, and a queue that could not be shared.
I own the Cloud Build delivery pipeline: build once, promote by digest, approve before release.
A simulation of the real release gates.
Measured first, then cut monitoring, database and compute, with every trade-off written down.
Dashboards and alerts built around how this system actually fails.
leader
follower
follower
Quorum held, 3 of 3 up
All quiet.
The platform could watch a building's air-conditioning. Letting it switch units on and off took a different kind of care.
control bridge
dry run
commands this hour 0/6
air-conditioning unit
26 °C from the plant's readback
selector auto
Security and reliability changes to a running platform, each split so that no single step can take it down, and rehearsed first.
Cache
open
No password anywhere
The cache accepts any client inside the cluster. Flip a switch to start the change.
The building IoT platform I run on GKE: how traffic moves through it, what I alert on and why, and where the money went.
How internet traffic reaches the cluster: load balancer, WAF, ingress, Services, pods and the database.
BrowserHTTPS 443
One public hostname. Any other host, or the raw IP, gets a 404 by design.
Global HTTPS load balanceranycast IP
TLS ends here on a reserved global IP with a Google-managed certificate.
Cloud ArmorWAF
OWASP CRS rules plus a login throttle, tuned per route so legitimate traffic passes, with auth and rate limits behind them.
GKE IngressL7 paths
Path routing sends the device API, the REST and WebSocket API, and the web UI to separate Services.
Service to podsClusterIP
Core API pods are spread across three zones and across nodes, so losing a zone costs a third of capacity, not all of it.
Core API to Cloud SQLprivate IP
A Cloud SQL Auth Proxy sidecar connects over private service access using Workload Identity: no key files, no password on the wire.