The Journey

From fragmented portals to a unified cloud-native platform

I joined the IT function of a large Indian state-sector power utility at a point when its digital services had grown organically as a collection of independently outsourced web portals. Each portal had been built and operated in isolation — its own technology stack, its own login and user database, and no shared infrastructure, deployment automation, or path to scale. For users and administrators alike, a separate username and password for every portal made the estate difficult to use and to govern.

Over the following three years I set out to consolidate this into a single, secure, modern platform — solving each problem as it surfaced, and letting each solution reveal the next constraint. This is that progression:

  1. Unified application layer (MERN) Standardised new and rebuilt services on a single modern stack (MongoDB, Express, React, Node.js) with a shared component and utility library — replacing a fragmented set of stacks with one coherent codebase.
  2. One identity for everything (SSO + Auth + RBAC) Replaced per-portal logins with a central Single Sign-On, a dedicated token authority, and a custom role-based access-control service — so a user signs in once and carries a single, governed identity across every application.
  3. Repeatable deployments (Docker Swarm) Where there had been no concept of automated deployment, introduced containerisation — starting with Docker Swarm and an NGINX reverse-proxy container — to make releases repeatable.
  4. Real orchestration (Kubernetes + Sealed Secrets) As traffic and the number of services grew, Swarm’s limits around autoscaling and self-healing became the bottleneck. Migrated to Kubernetes (GKE), adding horizontal pod autoscaling and encrypted, git-safe secret management with Sealed Secrets (kubeseal).
  5. GitOps continuous delivery (ArgoCD) Manual, drift-prone deployments were the next constraint. Adopted GitOps with ArgoCD — Git as the single source of truth, with automatic reconciliation, self-healing, and instant rollback.
  6. Edge security & defence-in-depth Fronted the platform with an L7 gateway and a Web Application Firewall (Cloud Armor + OWASP Core Rule Set), with an in-cluster ModSecurity layer behind it.
  7. Observability & security monitoring Added Prometheus, Loki and Grafana for metrics and logs, and Fluent Bit shipping structured logs to the SIEM.
  8. Release engineering & platform tooling Built a build-once / promote-any release engine (immutable image tags, instant rollback) and a shared platform library adopted across ~20 services — turning cross-cutting concerns into a single upgrade point.

The result: a fragmented set of siloed portals became roughly twenty services on one secure, observable, automatically-deployed platform — unified behind a single sign-on, and operated end to end by one engineer.

The deeper design decisions behind three parts of this journey are written up as case studies: the zero-trust auth platform, the Swarm → GKE + GitOps migration, and the shared platform library.