Andy Wu.

Andy Wu

Software & infrastructure.

I build Kubernetes platforms, workload identity, and infrastructure automation at Oracle. A few side projects got out of hand.

View projects Résumé
  • CKACertified Kubernetes Administrator
  • OCI Foundations AssociateOracle Cloud Infrastructure
  • OCI Architect ProfessionalOracle Cloud Infrastructure
The villa is imaginary. The projects are real. Scroll to explore ↓

Selected work.

GitHub
Cloud infrastructure

Jul–Aug 2026

A Kubernetes console for investigating failed workloads, reviewing a fix, and checking recovery. Built around an EKS platform I deployed on AWS.

  • Go
  • React
  • Kubernetes
  • Terraform
View source
AI & education

May–Aug 2026

A college admissions platform for researching schools, reviewing essays, and building a college list.

  • Multi-agent AI
  • Python
  • XGBoost
Visit site
Product engineering

Mar–Jul 2026

A shared ledger that helps club treasurers match payment emails to dues. Fewer spreadsheet detective stories.

  • Next.js
  • NestJS
  • PostgreSQL
View source

A few more things I built.

Creative tools

Mar–Aug 2025

Recipes with an interactive kitchen counter. The ingredients have actual physics.

  • Next.js
  • FastAPI
  • Matter.js
View source
AI & education

Apr–Sep 2025

An AP study workspace that brings textbook retrieval, tutoring, quizzes, and graphs together.

  • React
  • FastAPI
  • RAG
View source
Product engineering

Original build: Feb–May 2023Originally built without AI

Films, television, ratings, and saved collections—with live catalog data from TMDB.

  • React
  • Express
  • OCI
View source
Application correctness

Jun–Jul 2023Originally built without AI

A personal calendar revisited with owner-only access, conflict-aware edits, and daylight-saving tests.

  • Angular
  • Firebase
  • TypeScript
View implementation
Client work

Spring 2024Originally built without AI

A working website for a tutoring center, with schedules the staff can update themselves.

  • React
  • Google Sheets
  • DreamHost
Visit siteView source
Earlier projects & coursework

AnimalCalendar, Ants, Ngordnet, MazeGame, and the original FilmVault predate my use of AI coding tools. The Berkeley projects build on course-provided frameworks.

AntsOriginally built without AIFall 2022CS 61A · Python inheritance, composition, and game-unit behaviorNgordnetOriginally built without AISpring 2023CS 61B · WordNet traversal, set intersections, and NGram rankingMazeGameOriginally built without AISpring 2023CS 61B · Seeded worlds, save/load, and deterministic replaySuperSpaceGamesOct 2020–Jan 2021iOS games and physics experimentsPast projectsMore experiments on GitHub
KubeVista
KubeVista operations console showing its validated deployment snapshot

Cloud infrastructure

KubeVista

Jul–Aug 2026

Project dates from LinkedIn. Incident-response and guarded-operation updates: September 2026.

I built the Go API, React console, and AWS platform around them. The console connects Deployments, ReplicaSets, Pods, and events so an investigation can lead into a reviewed restart, scale, or rollback. Recovery checks look at the rollout—not just whether Kubernetes accepted the request.

  • Go
  • React
  • Kubernetes
  • Terraform
Role
Solo builder
Owned
Product, Go API, React interface, AWS platform, delivery, security boundaries, and operations
Status
Guarded operations tested locally; paid AWS environment retired

System map

Architecture

KubeVista architecture from GitHub Actions through Argo CD into a private EKS node group, with AWS ingress, pod identity, secrets, and an observability stack
The original AWS platform. The newer operator path adds reviewed restart, scale, and rollback without granting arbitrary cluster writes.

How it works

Terraform provisioned networking across three availability zones, two private worker nodes, Pod Identity, and KMS encryption. Twelve Argo CD applications delivered the platform, with metrics, logs, and traces through Prometheus, Grafana, Loki, Tempo, and OpenTelemetry. The newer Go operator path checks identity, dry-runs the change, and follows rollout state after execution.

Engineering decisions

  1. The browser never submits YAML. Restart, scale, and rollback are typed operations; rollback pins the reviewed template from an owned ReplicaSet.
  2. Review plans expire after five minutes, work once, and are bound to the request and Kubernetes resource version to prevent edits or replay.
  3. Recovery requires the expected controller generation and updated/available replicas. A local kind lab exercises probe, crash-loop, image-pull, memory, and scheduling failures. Plans and receipts remain process-local.

Live testTwelve Argo CD applications were Synced and Healthy, and all 896 requests returned HTTP 200 while an API pod was replaced. The paid AWS environment was then torn down and checked for leftovers.

How a change gets through

The write path is deliberately narrower than the inventory API. Each stage removes a class of accidental or unauthorized change before Kubernetes accepts it.

  1. ChooseSelect restart, scale, or rollback for an allowed Deployment and explain why the change is needed.
  2. ConstrainThe API rejects unsupported kinds, namespaces, actions, and replica counts before touching the cluster.
  3. Dry runKubernetes authorization and admission evaluate the same request without persisting it.
  4. BindA five-minute, single-use plan locks the reviewed request to the current resource version.
  5. ExecuteThe API rechecks identity and dry run, applies the scoped change, records a receipt, and checks rollout recovery.

The August AWS deployment used the read-only version and has been torn down. Guarded operations and the incident lab were added afterward and tested locally; the AWS traffic result does not measure those newer features.

View source
Illuma
Illuma college admissions platform homepage

AI & education

Illuma

May–Aug 2026

I founded Illuma and built its AI tools and admissions probability model. The tools share state and validate their outputs before passing results to the next step.

  • Multi-agent AI
  • Python
  • XGBoost
Role
Founder and lead engineer
Owned
Product direction, agent system, admissions model, and platform implementation
Status
Live product

System map

Architecture

Illuma architecture showing a student workspace, an agent coordinator, research and writing tools, shared state and validation, and admissions data and prediction services
A coordinated tool system: each specialist works against the same student context instead of producing isolated chat responses.

How it works

A student request enters a coordinator that selects typed tools for school research, college-list planning, or essay review. Every tool reads and updates shared application state, and deterministic checks gate what can move to the next step. The prediction path combines a student profile with historical applicant outcomes and university data.

Engineering decisions

  1. Typed tool inputs and outputs make handoffs inspectable and reject malformed results early.
  2. Shared state keeps recommendations consistent across research, essays, and the evolving college list.
  3. Admissions prediction is kept as a separate data pipeline rather than hidden inside an unconstrained language-model answer.

ScaleThe product grew to more than 5,000 users, with 39 typed tools and admissions modeling across 130 universities using 79,000 applicant outcomes.

Product figures are from my September 2026 résumé.

Visit site
Ledgly
Ledgly financial dashboard with charges, payments, and membership balances

Product engineering

Ledgly

Mar–Jul 2026

Original project dates. Payment-reliability updates: September 2026.

I built the ledger, payment-email matching, permissions, and review workflow. The latest work tackles what happens when requests arrive twice or two treasurers allocate the same payment: idempotent creation, transactional audit records, and concurrency checks backed by PostgreSQL tests.

  • Next.js
  • NestJS
  • PostgreSQL
Role
Solo full-stack engineer
Owned
Architecture, ledger model, reconciliation, permissions, and audit workflow
Status
Public deployment protected; reliability upgrade tested on a feature branch

System map

Architecture

Ledgly architecture showing the Next.js interface, NestJS API, PostgreSQL ledger, Gmail ingestion, and a review gate before financial records are changed
Incoming payment email becomes a proposed ledger match, not an automatic financial fact.

How it works

The Next.js client calls an organization-scoped NestJS API backed by Prisma and PostgreSQL. A Gmail worker reads payment notices, extracts candidate transactions, and proposes member matches with confidence. Treasurers review ambiguous matches before payments are allocated to charges; the API records the before-and-after state in the audit log.

Engineering decisions

  1. Amounts use integer cents. Serializable allocation transactions and bounded retries prevent competing requests from overallocating a payment or charge.
  2. An organization-scoped idempotency key binds to the request fingerprint. The payment, audit entry, and replay response commit together; changed-payload reuse is rejected.
  3. Gmail matches and AI financial changes retain review gates. The new keyed creation path does not allocate funds or send notifications, keeping its transaction boundary explicit.

Verified locally and in CISix PostgreSQL integration tests cover replay, tenant boundaries, competing allocations, and rollback. Eight concurrent same-key requests produce one payment and one audit entry—not an exactly-once guarantee for email or external systems.

The payment-reliability work is implemented and tested on codex/payment-reliability, not deployed to the public app. Ledgly records payments; it does not move money.

View source
Sizzle

Creative tools

Sizzle

Mar–Aug 2025

Original project dates. Performance and accessibility updates: September 2026.

A dish or a few ingredients become a saved recipe and an illustrated cooking view. I built the generation pipeline and physics counter, then separated frame-by-frame movement from React rendering so the playful part does not keep rerendering the app.

  • Next.js
  • FastAPI
  • Matter.js
Role
Solo builder
Owned
Recipe pipeline, FastAPI service, interactive cooking view, and OCI deployment
Status
Performance and accessibility upgrade tested on a feature branch

Behind the project

A natural-language request first searches saved recipes. If nothing fits, FastAPI creates structured ingredients, equipment, and steps, persists them in Supabase, and starts illustration work in the background. The Next.js cooking view renders each step and uses Matter.js to place the relevant objects on a virtual counter.

Engineering choices

  • Recipe generation produces a fixed structure so the interface does not have to parse prose.
  • Illustrations run in a bounded, in-process worker pool after saving the recipe. This is background work, not a durable job queue.
  • Matter.js updates element transforms through refs; React owns recipe state. A single runner pauses when hidden or paused, with keyboard movement and a static reduced-motion layout.

Local measurementWith 20 items, React commits fell from 301 to zero over a five-second development sample while physics movement continued. Browser checks cover pause, keyboard controls, reduced motion, and runtime errors without paid APIs.

The performance and accessibility upgrade is tested on codex/cooking-performance, not production-deployed. The benchmark is a local React rendering measurement, not an FPS or CPU claim.

View source
Academis

AI & education

Academis

Apr–Sep 2025

Original project dates. Session-isolation and evaluation updates: September 2026.

I built PDF ingestion and retrieval alongside the study interface. The latest work isolates each learner’s conversation and adds a small retrieval-evaluation harness, so access boundaries and ranking calculations can be tested without paid model calls.

  • React
  • FastAPI
  • RAG
Role
Solo builder
Owned
Document ingestion, retrieval, tutoring API, and study interface
Status
Local demo; session isolation and evaluation tested on a feature branch

From textbook to answer

  1. Textbook PDFs
  2. Chunks & embeddings
  3. Retrieve passages
  4. Generate answer

The ingestion pipeline extracts PDFs, creates overlapping chunks and embeddings, and stores them in MongoDB Atlas Vector Search. FastAPI retrieves passages for tutoring. The newer ask route verifies a Firebase ID token and scopes chat history to the verified user, subject, and session. Retrieval can fall back to an ungrounded answer, so not every response is textbook-backed.

Engineering choices

  • Conversation keys use verified identity, not a client-supplied user ID. Account or course changes clear the chat and discard late responses.
  • History has a 30-minute idle expiry and bounded session/message counts. It remains process-local, not shared durable storage.
  • A versioned synthetic dataset measures recall@k and reciprocal rank offline. Missing rankings fail the check rather than quietly improving the score.

Test coverageEight tests cover authentication contracts, session boundaries, expiry, request limits, and metric calculations. The small evaluation fixture makes ranking changes inspectable; live Atlas quality still needs measurement.

Session isolation and evaluation are tested on codex/session-isolation, not production-deployed. Economics is the most complete content; science courses remain partial. The evaluation harness does not establish answer accuracy or a retrieval-quality improvement.

View source
FilmVault

Product engineering

FilmVault

Original build: Feb–May 2023Originally built without AI

v1: Feb–May 2023; v2: Jun–Oct 2024; v3: Apr–Aug 2025. The first two versions were built without AI; later versions and September 2026 updates include AI assistance.

I built the original FilmVault before adopting AI coding tools and have since updated the interface, local setup, and API failure handling. TMDB supplies the catalog; FilmVault owns accounts, ratings, and collections. The newer shared catalog client handles slow responses, rate limits, and temporary outages.

  • React
  • Express
  • OCI
Role
Solo full-stack engineer
Owned
React client, Express API, member data, TMDB integration, and original OCI design
Status
Recorded local demo; API resilience tested on a feature branch

Behind the project

The React client uses one Express API for searches, people, authentication, profiles, ratings, and collections. The API enriches member-owned records with TMDB movie and television metadata, sends account email, and can process profile images before writing them to OCI Object Storage.

Engineering choices

  • Only public catalog GET requests use the bounded cache. In-flight requests coalesce, and cache keys include the query and authentication context.
  • A five-second deadline, response-size cap, and at most two attempts bound upstream work. Eligible transient failures can return stale data with explicit response headers; authentication errors cannot.
  • Caching is process-local, not shared across replicas. SQLite keeps local demos repeatable; the original deployment design uses MySQL and OCI.

Failure testingSix HTTP-fixture tests exercise coalescing, retry limits, stale responses, credential changes, malformed payloads, and slow streams. These validate failure behavior, not production throughput.

The catalog-resilience upgrade is tested on codex/catalog-resilience, not production-deployed. The video shows the local app; Terraform documents the original OCI design.

View source
AnimalCalendar

Application correctness

AnimalCalendar

Jun–Jul 2023Originally built without AI

Original build without AI. Firebase correctness and security-rule updates: September 2026, with AI assistance.

One of my earlier projects: an animal-themed calendar with Google and email sign-in, draggable events, and a month view. I returned to the data layer to make edits persist safely and stop one account from accessing another account’s events.

  • Angular
  • Firebase
  • TypeScript
Role
Solo builder
Owned
Calendar interface, authentication, event persistence, security rules, and emulator tests
Status
Earlier project; correctness upgrade tested on a feature branch

What I changed

  • Authenticated Firebase operations and owner-scoped rules reject anonymous and cross-account reads and writes.
  • Version-checked transactions detect competing edits. Deletion tombstones prevent an older client from restoring a removed event.
  • Changes persist before the interface updates; conflicts surface with a reload path instead of silently overwriting data.
  • Eight date and emulator tests cover daylight-saving transitions, authorization, validation, concurrent edits, and deletion behavior.

Implemented and tested on codex/calendar-correctness; the new rules are not deployed. Dates display in the browser’s local timezone; recurrence and all-day events are not supported. Angular and dependency upgrades remain before a public relaunch.

View implementation
Summit Tutoring Center

Client work

Summit Tutoring Center

Spring 2024Originally built without AI

I built this for a tutoring business owned by family friends. It covers classes, staff, counseling, and inquiries, and fits the hosting setup they already had.

  • React
  • Google Sheets
  • DreamHost
Role
Designer and developer
Owned
Information architecture, frontend, staff-managed content flow, and deployment
Status
Live client website

Behind the project

Staff edit schedules, seminars, and posts in familiar Google Sheets. The React site fetches the published CSV, parses quoted and multiline fields, and keeps the latest good response in browser storage. The production build stays on the business's existing DreamHost account.

Engineering choices

  • Google Sheets serves as the editing interface, avoiding a custom CMS and new staff accounts.
  • A five-minute cache limits repeat fetches while stale-data fallback keeps the last valid schedule visible.
  • The inquiry form uses Web3Forms when configured and can fall back to an email draft.

ResultThe site is live for a real tutoring business, and nontechnical staff can update frequently changing information without asking for a code deployment.

Visit site View source

About me.

Andy smiling in a suit on the UC Berkeley campus
Berkeley, California.

I'm Andy. I graduated from Berkeley in 2024 and now work at Oracle, where I build around Kubernetes, infrastructure automation, workload identity, and backend services.

Most of my side projects start with a problem I have run into myself: applying to college, managing club finances, studying, cooking, or keeping track of movies. I like building the infrastructure, but I care just as much about whether the finished thing is pleasant to use.

Away from the keyboard, I read fantasy, draw and paint, and take an unreasonable number of cat photos. That is how this portfolio ended up inside an imaginary villa.

Oracle

Oracle

Software Engineer · OCI

I work across Kubernetes platform services, workload identity, infrastructure generation, and backend APIs. My contributions include an Elasticsearch-to-OpenSearch migration and work carried from implementation through rollout and operational support.

Recognized with Oracle Platinum and SaaS Engineering & OAL Gold awards.

University of California, Berkeley

B.S. Computer Science · 2024

Andy with two friends in graduation stoles at UC Berkeley
Graduation day with friends, 2024.

UC Berkeley

I graduated in 2024 with a B.S. in Computer Science. A lot of my earliest work here came from Berkeley courses: graph-backed word tools, simulations, and procedurally generated games.

I keep those projects in the archive because they show the point where software stopped feeling abstract and started feeling like something I could shape.

A few things about me.

I read a lot of fantasy, like making things by hand, and share my home with two cats.

A hand-painted Gundam illustration in black, white, red, blue, and yellow
I like drawing and painting.This Gundam piece is one of my favorites.
Illustrated ESTP personality character
My MBTI is ESTP.The energetic, figure-it-out-as-I-go result feels pretty accurate.
A round cream-colored cat sitting with its paws crossedAn orange cat lying upside down on a patchwork quilt
I have two cats.They are frequent desk visitors and the reason my camera roll is mostly cat photos.

Say hello.

andyw98@berkeley.edu

I am always happy to talk about infrastructure, useful products, Berkeley, or the fantasy novel currently keeping you up too late.

LinkedInGitHubRésumé