Speaker
Description
Delivering reliable beamline software increasingly looks like operating an on-premises “cloud”: many services, close to instruments and data, with rapid iteration and strong cyber security controls. At the Australian Synchrotron (ANSTO), our Scientific Computing team runs essentially all beamline computing services on-site using containers and Kubernetes. Across 10+ Kubernetes clusters we deploy and run shared platform services alongside beamline-specific applications for hardware control, data collection, and data processing, following an “everything is a container” approach. We support this with automated CI/CD and a GitOps-style delivery model, plus on-premises artifact repositories (Docker, Python, and S3-compliant storage) to keep builds and deployments within facility firewalls. Observability is treated as a first-class requirement: centralised logging and metrics (e.g., Prometheus and OpenSearch) and distributed tracing (OpenTelemetry/Jaeger) provide operational insight and auditability. Many cloud concepts were developed for purely virtual services, but our services eventually touch physical beamline hardware - there is only one set, and access to it is inherently restricted. We work around these constraints with digital twins of beamlines, coupled to a traditional dev/stage/prod model, to test and validate changes before they reach beamline operations. Using industry-standard tools reduces bespoke maintenance, improves collaboration, and lets us benefit from mature security ecosystems. Security is built in via authenticated access, Kubernetes RBAC, network policies, vulnerability scanning, patch cycles, and secrets management. This talk presents our architecture and lessons learned operating an on-premises cloud based research infrastructure in a 24/7 user facility.
