Skip to content

Final report GSoC'26 project Ga4gh

GA4GH Logo ELIXIR Logo Google Summer of Code Logo

This is the final report for my project that I've been working on during my summer of 2026 under the guidance of the mentors listed below.

Project Details

About Me

I am Gopi Kishan, a 3rd-year computer science engineering student with a strong passion for open-source development, cloud-native architectures, and distributed systems.

This GSoC 2026 project with GA4GH and ELIXIR marks my second successful Google Summer of Code (GSoC) participation, having previously cracked GSoC 2025 with the Mifos Initiative where I contributed to open-source financial inclusion software. In addition, I have contributed as a developer in Code for GovTech (C4GT) with the Piramal Foundation (PSMRI), working on citizen-centric civic technologies.

I love solving complex engineering challenges, from concurrency patterns to hardware-secured systems, and am dedicated to writing clean, production-grade code.

1. Project Overview & Core Mission

Every GA4GH-compliant service—such as DRS (Data Repository Service), WES (Workflow Execution Service), TES (Task Execution Service), or TRS (Tool Registry Service)—is required to expose a /service-info endpoint that returns structured metadata about the service instance. The wider organizational structure, governance, and use cases for these standard APIs are described in the GA4GH core publication.

The Problem

Traditionally, this metadata has been compiled directly into the application binaries or hardcoded in backend databases. This design makes metadata updates operationally complex: updating a simple contact URL or organization name required a full code review, binary rebuild, CI pipeline execution, and Pod restart.

The Solution: Decoupled Standalone Microservice

During GSoC 2026, I designed and built a lightweight, cloud-native standalone Go microservice that externalizes, validates, and serves standard-compliant /service-info metadata. Instead of coupling metadata with heavy application logic, the ServiceInfo service runs independently, allowing platform administrators to hot-reload metadata dynamically without any service interruption.

2. Core Service Architecture & Go Refactor

Technical Implementation

  • The Go Migration: Ported the backend service from the initial Python prototype to Go to minimize resource utilization, achieve fast container startup times (<50ms), and decrease memory usage down to ~15MB.
  • Decoupled Architecture: Re-engineered the service from a shared-pod sidecar model (requiring container configuration sharing) into a standalone microservice routed externally via Ingress rules. This completely decoupled the service lifecycle and reduced the blast radius of metadata server crashes.

3. Concurrency-Safe Hot-Reloading & Validation

Technical Implementation

  • Directory Watching via fsnotify: Configured the watcher to monitor the containing directory rather than the file itself. This is required because Kubernetes updates ConfigMaps by performing an atomic symlink swap (..data), which alters directory references rather than updating the file inode directly.
  • Thread Safety: Handled configuration access concurrently using a sync.RWMutex. HTTP handlers acquire a read lock (RLock), while the hot-reloader goroutine acquires a write lock (Lock) to swap the configuration pointer in memory.
  • Schema Validation: Implemented structural checks verifying mandatory fields (id, name, version, type.*, organization.*) are present. Invalid configurations trigger logs and are rejected, preserving the previous configuration state without crashing.

4. CORS, Observability, & Containerization

Technical Implementation

  • Observability Middlewares: Integrated Prometheus metrics middleware, exposing request counts and latency histograms (ga4gh_service_http_requests_total, ga4gh_service_http_request_duration_seconds) on an independent metrics port.
  • CORS & Clean Shutdowns: Enabled full CORS headers to support queries from browser-based web portals and added OS signal listeners to intercept SIGTERM/SIGINT for clean socket closures.
  • Distroless Containerization: Built multi-stage Dockerfiles utilizing a scratch base image to deploy minimal, secure, and distroless runtime containers (<20MB total footprint).

5. Kubernetes & Cloud-Native Deployment

Technical Implementation

  • Raw Manifests & Ingress: Provided standard deployment manifests alongside Ingress path rules that isolate /service-info routes from the rest of the genomics API traffic.
  • Helm Charts: Designed a structured Helm Chart with configurable values, enabling deployment configuration overrides for organizations, environments, and server ports.

6. Testing Strategy & Continuous Integration

Technical Implementation

  • E2E Integration Testing: Developed HTTP client integration tests that dynamically allocate free loopback ports (:0) to eliminate port collisions during concurrent test execution.
  • Polled Assertions: Replaced static, flaky test delays (time.Sleep) with poll-based loops checking state change conditions within a 2-second timeout.
  • CI/CD Automation: Set up GitHub Actions workflows checking compilation, vet, and lint guidelines (golangci-lint), and automated Docker image packaging to the GitHub Container Registry (GHCR) on merge.

7. Documentation & Diagram Migrations

Technical Implementation

  • Guide Overhaul: Reorganized user guides, quickstart manifests, and configuration documentation.
  • Mermaid Migrations: Migrated static text-based ASCII flowcharts into high-fidelity, interactive Mermaid graphs. Cleaned up HTML elements inside Mermaid code blocks to ensure compatibility with MkDocs rendering engines.

8. Pull Request Reference Table

The table below records all pull requests completed during the GSoC 2026 lifecycle:

PR # Type Description
#1 chore Initialized Git repository structure and basic actions pipelines.
#2 feat Programmed the initial ServiceInfo Go struct mapping.
#4 chore Set up issue templates, Contributing rules, and Code of Conduct.
#6 docs Initialized MkDocs styling configurations and automation workflows.
#10 docs Configured auto-generating API schema descriptions.
#12 feat Developed the proxy deep merge config logic.
#13 docs Drafted initial technical architecture documentation.
#14 refactor Rewrote core service from Python to Go.
#17 feat Programmed Hot-Reloading using directory-based fsnotify checks.
#19 feat Set up Docker container builds.
#20 feat Added observability endpoints, Prometheus tracking, and CORS support.
#21 feat Created initial raw Kubernetes manifests and standalone routing docs.
#22 refactor Replaced sidecar layout in code and configuration with standalone microservice logic.
#23 ci Standardized pull request quality pipelines (build/test/lint).
#24 docs Added high-level diagrams and corrected text typos.
#25 fix Cleared minor key capitalization errors in manifests.
#26 fix Corrected minor formatting issues in deployment templates.
#28 feat Developed the templated Helm Chart for Kubernetes.
#29 ci Added publishing automation for built container images to GHCR.
#31 docs Documented Helm deployments and GHCR image tags.
#32 feat Added robust unit and E2E integration test suites with polling.
#33 docs Overhauled user guides, quickstart paths, and contributing rules.
#34 docs Converted documentation index layout to standard Mermaid flowchart.
#35 docs Migrated folder layouts to Mermaid graphs and removed heading emojis.

9. The Next Horizon: Attested-TLS (aTLS) & Confidential Computing

In collaboration with my mentors, the next phase of this project extends the ServiceInfo microservice to support Confidential Computing (supported by the Confidential Computing Consortium) in federated clouds (such as the ELIXIR Cloud federation).

The Objective

Establish hardware-level trust for GA4GH metadata endpoints. Instead of simply trusting the server domain, clients must be able to verify that the service is running inside a secure, untampered Trusted Execution Environment (TEE) (using Intel SGX or AMD SEV).

sequenceDiagram
    autonumber
    actor Client as External Client
    participant SI as ServiceInfo (TEE Enclave)
    participant Vendor as CPU/GPU Certificate Authority

    Client->>SI: Request Attestation Quote / aTLS Handshake
    SI-->>Client: Return Signed Hardware Evidence & Enclave Quote
    Client->>Vendor: Verify Evidence Signature against Vendor Root
    Vendor-->>Client: Evidence Valid (Authentic Hardware & Code)
    Client->>SI: Establish Secure aTLS Channel & Query /service-info

Future Work Scope

  • aTLS Integration: Integrate the Attested-TLS (aTLS) protocol into the ServiceInfo Go codebase. During the TLS handshake, the service will supply CPU-signed evidence verifying memory isolation and software integrity (utilizing patterns from the confidential-ai-example implementation).
  • Client Verification Interface: Implement client-side verification tools for other GA4GH services (like TESK or WES) to automatically validate remote service enclaves using vendor certificates.

10. Reflection: AI-Assisted Engineering Workflow

As a developer working in GSoC 2026, one of the most transformative aspects of my project was the integration of AI coding assistants (like Antigravity) directly into my development workflow. Rather than treating AI as a magic shortcut, I used it as an active pair programmer to accelerate my learning and execution.

A Transparent Disclaimer & Architectural Brainstorming

Rather than using AI to generate code blindly, I primarily utilized it as a tool for architectural brainstorming and critical inquiry. Every time the AI proposed a design or solution, I would cross-question it: "Why do we need this particular approach?", "What are the alternative solutions?", and "Why shouldn't we use those alternatives instead?" Challenging the AI and evaluating alternative architectures was the most valuable part of this workflow.

Instead of generating the entire codebase all at once, the development progressed step-by-step. We planned the implementation phase-by-phase, focusing on one small feature at a time. After each step, I reviewed the generated modules in context with the rest of the codebase, cross-questioning the code's design: "Why this implementation? Why not that? What are the pros and cons of this design?" Finally, I wrote real, robust tests to verify actual runtime behavior and edge cases, rather than just writing dummy tests to artificially boost code coverage metrics.

The Shift in Coding Practices: From Writer to Reviewer

Using AI shifted my daily work from writing raw code line-by-line to serving as an architect and code reviewer. Instead of writing boilerplate, I spent my time defining detailed requirements, reviewing generated code diffs for potential edge cases, and thinking about system design. It transformed the coding process into a highly collaborative feedback loop of directing, reviewing, compiling, and testing.

Guide for Aspiring and Seasoned Programmers

If you are integrating AI into your workflow, here is what I recommend:

  1. Never Copy-Paste Blindly: AI is only a helper. If you don't understand the generated code, you shouldn't merge it. You are ultimately responsible for the reliability of the software.
  2. Verify with Tests: AI can write code that looks syntactically correct but fails under load or concurrency. Always back up AI-generated features with robust unit and integration tests.
  3. Focus on Requirements: Spend time writing clear architectural guidelines and prompt parameters. The better your structural planning, the better the resulting code output will be.

Acknowledgments & Future Commitment

I would like to express my deepest gratitude to my mentors, Pavel and Alex for their guidance, detailed code reviews, and support throughout the summer of 2026. This opportunity has been an invaluable learning experience in building high-quality, production-grade cloud-native software.

Although the formal Google Summer of Code period is ending, I am committed to continuing my contributions to this project and the broader GA4GH/ELIXIR ecosystem. I look forward to collaborating on the upcoming Attested-TLS (aTLS) integration and helping build the next generation of secure, confidential genomics infrastructure.

Thank you for this incredible journey!