Private EKS GitOps Platform

(01)Overview

A production-style Kubernetes platform on AWS running an 11-service polyglot e-commerce application (Go, C#, Node.js, Python, Java — built on Google's open-source Online Boutique). The cluster lives entirely in private subnets behind a bastion host, infrastructure is provisioned with Terraform on a versioned S3 backend, and every release flows through a GitOps pipeline: GitHub Actions builds and scans each service with Trivy, pushes to GHCR, and Argo CD Image Updater promotes the new image into the cluster automatically.

(02)What we built

1. 1. Fully private EKS cluster — worker nodes isolated in private subnets, admin access only through a Bastion Host, NAT/Internet Gateway for controlled egress.
2. 2. Complete infrastructure provisioned with Terraform and a versioned S3 remote-state backend.
3. 3. Microservice-aware CI in GitHub Actions: path-filtered matrix builds, Trivy image scanning, and pushes to GitHub Container Registry.
4. 4. GitOps delivery with Argo CD + Argo CD Image Updater — automated image promotion, self-healing deployments, and automated rollouts.
5. 5. Services exposed through the Kubernetes Gateway API and AWS Load Balancer Controller, with DNS automated by ExternalDNS + Route53 and TLS via ACM.
6. 6. Metrics and alerting with Prometheus, Alertmanager, and Grafana — real-time Slack notifications for firing and resolved alerts.
7. 7. Centralized logging with Elasticsearch, Kibana, and Filebeat via Elastic Cloud on Kubernetes (ECK).
8. 8. IAM hardened with IRSA and EKS Pod Identity; dynamic persistent storage via the EBS CSI Driver; HPA-driven autoscaling under load.