{"componentChunkName":"component---src-templates-mdproject-jsx","path":"/projects/bkv_pulumi_templates","result":{"data":{"allGithubFile":{"nodes":[{"base":"bkv_pulumi_templates.md","relativeDirectory":"projects","childMarkdownRemark":{"id":"464643d1-5a92-5341-bad0-4cd0bfa09bef","html":"<h1>BKV Pulumi Templates - BKV Corporation</h1>\n<p>Developer: Manuel Solalinde <a href=\"mailto:manolosolalinde@gmail.com\">(manolosolalinde@gmail.com)</a></p>\n<p>An internal <strong>infrastructure-as-code library</strong> that standardizes how the data and engineering teams ship containerized applications to AWS. Instead of each project re-implementing networking, authentication, load balancing and CI/CD from scratch, every app starts from a small set of reusable building blocks and ready-made scaffolding — so a new app is deployable in minutes rather than rebuilt from the ground up. It eliminates per-project re-implementation of the same infrastructure and is the deployment foundation behind <strong>6+ production apps</strong>: Surveillance Dashboard, Gas Targets, Gas Injection, Plunger Optimization, AI Agent Chat, and the broader Streamlit toolkit.</p>\n<h2>What it provides</h2>\n<ul>\n<li><strong>A single application-stack component</strong> — one declaration provisions a complete, production-ready ECS Fargate application end to end: container registry (ECR) with Docker build and push, an Application Load Balancer fronted by <strong>corporate SSO (Azure AD OIDC)</strong>, DNS and TLS (Route53 + ACM), WAF, scoped IAM, centralized logging (CloudWatch), and target-tracking autoscaling. The whole library is implemented as reusable Pulumi <strong>ComponentResources</strong>, so apps assemble infrastructure from typed, parameterized parts rather than hand-wiring resources.</li>\n<li><strong>Project scaffolding</strong> — generates a new, immediately deployable project pre-wired to the library and to CI/CD: GitHub Actions run <code class=\"language-text\">pulumi preview</code> on every pull request and <code class=\"language-text\">pulumi up</code> on merge, so every scaffolded app ships with preview-on-PR and deploy-on-merge from day one.</li>\n</ul>\n<h2>Design decisions &#x26; trade-offs</h2>\n<ul>\n<li><strong>One orchestrator over many loose components</strong> — a single top-level application-stack component composes the underlying pieces instead of asking each project to wire them together by hand. This reduces parameter explosion and enforces consistency across apps.</li>\n<li><strong>Composable add-ons over a monolithic template</strong> — analytics integrations attach to an existing application stack rather than baking every integration into one template. Teams adopt features gradually, without rewriting the base deployment.</li>\n<li><strong>Consume shared infrastructure, don't redeclare it</strong> — applications consume the shared base network (VPC, subnets, ECS cluster, WAF) through a stack-reference pattern instead of re-creating it. One owner manages the base network; apps simply reference it.</li>\n<li><strong>Dual-path corporate auth</strong> — SSO at the load balancer (Azure AD OIDC) governs <em>app access</em>, while SAML federation governs <em>analytics query access</em>. Keeping these as separate identities lets app sign-in and data-query permissions evolve independently.</li>\n</ul>\n<h2>Hard problems solved</h2>\n<ul>\n<li><strong>Standardized enterprise authentication for every app</strong> — corporate SSO (Azure AD OIDC) at the ingress plus SAML-federated analytics access, so every app gets enterprise sign-in essentially for free instead of reinventing auth each time.</li>\n<li><strong>Least-privilege cross-account data access</strong> — secure, scoped access into a central Redshift data warehouse living in a separate account, granted through an assumable role rather than broad, shared credentials.</li>\n<li><strong>Reusable multi-environment deployments</strong> — the same code yields <code class=\"language-text\">dev</code>, <code class=\"language-text\">stage</code>, and <code class=\"language-text\">prod</code> environments, with secrets sourced at runtime from Pulumi secrets and AWS Secrets Manager and never placed in the codebase.</li>\n<li><strong>Consistent tagging and naming at scale</strong> — a uniform, predictable scheme for naming and tagging every resource so cost allocation and ownership tracking stay reliable across a growing fleet of apps.</li>\n</ul>\n<h2>Key Features</h2>\n<ul>\n<li><strong>One-command application stack</strong> — a single application-stack component provisions ECR, ALB, DNS, certificates, WAF, IAM, logging, the Fargate service, and autoscaling.</li>\n<li><strong>Corporate SSO built in</strong> — Azure AD OIDC at the load balancer for app access, and SAML federation for analytics query access.</li>\n<li><strong>Reusable and multi-environment</strong> — components are parameterized and environment-scoped, so the same code deploys <code class=\"language-text\">dev</code>, <code class=\"language-text\">stage</code>, and <code class=\"language-text\">prod</code>.</li>\n<li><strong>Standardized CI/CD</strong> — scaffolded projects ship with GitHub Actions preview-on-PR and deploy-on-merge workflows.</li>\n<li><strong>Secrets-safe by design</strong> — secret values flow through Pulumi secrets and AWS Secrets Manager, never the codebase.</li>\n<li><strong>Composable add-ons</strong> — Athena and Redshift integrations attach to an existing application stack without rewriting it.</li>\n</ul>","frontmatter":{"title":"BKV Pulumi Templates","image_url":"./images/covers/pulumi_templates.png","description":"An internal Pulumi component library and project scaffolding that standardizes deployment of containerized apps on AWS ECS Fargate with Azure AD auth, autoscaling, and Athena/Redshift integrations.","technologies":"Python, Pulumi, AWS (ECS Fargate, ALB, ECR, Route53, ACM, WAF, CloudWatch, IAM, S3, Athena, Glue, Redshift, Secrets Manager), Azure AD (OIDC + SAML SSO), Docker, GitHub Actions.","date":"2026-05-31T00:00:00.000Z"}},"user":"manolosolalinde","repository":"cv"}]},"site":{"siteMetadata":{"title":"Manuel Solalinde's Portfolio","description":"Manuel Solalinde's Portfolio and Featured Projects","author":"Manuel Solalinde"}}},"pageContext":{"uid":"bkv_pulumi_templates.md","rootQuery":"\n    query mdProjectQuery($uid: String) {\n        allGithubFile(filter: {base: {eq: $uid}, relativeDirectory: {eq: \"projects\"}}) {\n            nodes {\n              base\n              relativeDirectory\n              childMarkdownRemark {\n                id\n                html\n                frontmatter {\n                  title\n                  image_url\n                  description\n                  technologies\n                  date\n                }\n              }\n              user\n              repository\n            }\n        }\n        site {\n            siteMetadata {\n                title\n                description\n                author\n            }\n        }\n    }\n"}},"staticQueryHashes":["3649515864"]}