From git push to production on EKS

Problem

The 2024 pipeline worked end to end, but the cluster was created by hand with eksctl, Jenkins pushed images straight into the cluster, and nothing checked an image before it ran.

Solution

Terraform builds all infrastructure. GitHub Actions connects to AWS with OIDC and runs Gitleaks, SonarQube and Trivy before signing the image with Cosign and pushing it to ECR. Argo CD deploys from a GitOps repo, Kyverno only admits signed images, and Argo Rollouts releases in canary steps. OpenTelemetry, Prometheus, Loki, Tempo and Grafana cover observability.

Tools

AWSEKSTerraformGitHub ActionsArgo CDKyvernoPrometheusGrafana

Outcome

Design complete and build under way. Every release will be scanned, signed and rolled out gradually with automatic rollback.