Deploying a secure, scalable three-tier stack on Amazon EKS with complete pipeline automation, static analysis, dependency vulnerability scanning, GitOps continuous delivery, and full-stack monitoring.
This project is built around automated CI/CD flow triggering code quality, container builds, GitOps updates, and EKS deployments.
| Layer | Tools | Role in Architecture |
|---|---|---|
| Frontend |  |
Interactive user interface for the travel blog website. |
| Backend |   |
RESTful API layer handling core business logic & routing. |
| Database & Cache |   |
Primary Document DB and high-performance in-memory caching. |
| Orchestrator |  |
Manages execution of pipeline scans, builds, and automated commits. |
| Security Scanning |   |
Third-party libraries dependency analyzer and Docker image scanner. |
| Code Quality |  |
Static Application Security Testing (SAST) and quality audits. |
| GitOps CD |  |
Declarative GitOps engine syncing K8s configurations automatically. |
| Cloud Kubernetes |  |
Managed highly available cluster to host Wanderlust workloads. |
| Monitoring |   |
Real-time cluster metrics, performance panels, and alerts. |
| Email Broker |  |
Delivers build notifications to subscribers on job status changes. |
Tip
Click any section below to navigate directly to the detailed configuration guide.
- 1. AWS Infrastructure Setup (EKS)
- 2. SonarQube Server Deployment
- 3. GitHub Actions Secrets Configuration
- 4. ArgoCD Installation & Configuration
- 5. Prometheus & Grafana Monitoring Setup
- 6. Gmail Notifications Configuration
- 7. Clean Up Instructions
- 8. Showcase Gallery
Configure your CLI environment and provision a managed AWS EKS cluster.
Download and install the AWS CLI:
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
sudo apt install unzip -y
unzip awscliv2.zip
sudo ./aws/install
aws configurecurl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin/
kubectl version --clientcurl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin
eksctl versionExecute these commands to bootstrap the cluster. Note that nodegroups will launch with t2.large nodes to handle database, caching, frontend, backend, and monitoring pods.
# 1. Create EKS Control Plane
eksctl create cluster --name=wanderlust \
--region=us-west-1 \
--version=1.30 \
--without-nodegroup
# 2. Associate IAM OIDC Provider for Service Accounts
eksctl utils associate-iam-oidc-provider \
--region us-west-1 \
--cluster wanderlust \
--approve
# 3. Create Node Group
eksctl create nodegroup --cluster=wanderlust \
--region=us-west-1 \
--name=wanderlust-nodes \
--node-type=t2.large \
--nodes=2 \
--nodes-min=2 \
--nodes-max=3 \
--node-volume-size=30 \
--asg-access \
--external-dns-accessYou can host SonarQube as a Docker container on an EC2 instance or run it on a cloud instance.
To launch a SonarQube server locally or on your master instance:
docker run -d --name SonarQube-Server -p 9000:9000 -d sonarqube:lts-communityAccess the server at http://<your-ip>:9000. Navigate to Administration ➔ Security ➔ Users ➔ Tokens to generate a token for authentication in the GitHub Action.
To run the CI/CD pipeline, the GitHub repository needs specific secrets configured under Settings ➔ Secrets and Variables ➔ Actions.
Ensure you define the following secrets:
| Secret Name | Description | Example |
|---|---|---|
DOCKER_USERNAME |
Docker Hub username. | yourusername |
DOCKER_PASSWORD |
Docker Hub password/access token. | dckr_pat_... |
SONAR_TOKEN |
Generated token from your SonarCloud/SonarQube account. | sqa_... |
MAIL_USERNAME |
Gmail account used to send build status alerts. | your-email@gmail.com |
MAIL_PASSWORD |
Generated Gmail App Password. | xxxx xxxx xxxx xxxx |
MAIL_TO |
Target recipient email address. | recipient@gmail.com |
Deploy ArgoCD onto the newly provisioned Kubernetes cluster for declarative CD.
# Create namespace
kubectl create namespace argocd
# Apply installation manifest
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
# Monitor deployment progress
kubectl get pods -n argocd --watchkubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "NodePort"}}'Locate the NodePort assigned:
kubectl get svc argocd-server -n argocdkubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d; echoLog in via your browser using the username admin and the retrieved password. We recommend updating your password immediately under user configuration.
Install the ArgoCD CLI tool:
sudo curl --silent --location -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/v2.4.7/argocd-linux-amd64
sudo chmod +x /usr/local/bin/argocd
# Login to your ArgoCD Server
argocd login <node-ip>:<node-port> --username admin
# Add Cluster context
argocd cluster add $(kubectl config current-context) --name wanderlust-clusterDeploy the Prometheus operator stack via Helm to collect logs and visualize cluster resources.
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.shhelm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
kubectl create namespace prometheushelm install prometheus-stack prometheus-community/kube-prometheus-stack -n prometheusExpose the Prometheus and Grafana dashboards to clean, accessible ports on your node:
kubectl patch svc prometheus-stack-kube-prom-prometheus -n prometheus -p '{"spec": {"type": "NodePort"}}'
kubectl patch svc prometheus-stack-grafana -n prometheus -p '{"spec": {"type": "NodePort"}}'kubectl get secret --namespace prometheus prometheus-stack-grafana -o jsonpath="{.data.admin-password}" | base64 --decode ; echoAccess Grafana in the browser at http://<node-ip>:<grafana-nodeport> using username admin and the decoded password.
Configure GitHub Actions to send detailed pipeline alerts to your inbox on every build.
- Navigate to your Google Account Settings.
- Turn on 2-Step Verification (Mandatory).
- Search for App Passwords.
- Generate a new App Password with a custom name like
GitHub Actions Wanderlust. - Copy the generated 16-character password and save it as
MAIL_PASSWORDin your GitHub repository Secrets.
In your .github/workflows/ci.yml pipeline, add the notification step to email results on failure or success:
# Email Notification Step
- name: Send Email Notification
uses: dawidd6/action-send-mail@v3
if: always() # Trigger notifications on all outcomes
with:
server_address: smtp.gmail.com
server_port: 465
username: ${{ secrets.MAIL_USERNAME }}
password: ${{ secrets.MAIL_PASSWORD }}
subject: 'Wanderlust Build Report: ${{ job.status }}'
to: ${{ secrets.MAIL_TO }}
from: 'Wanderlust CI/CD Workflow'
body: |
Wanderlust CI/CD pipeline run finished with status: ${{ job.status }}.
- Commit: ${{ github.sha }}
- Actor: ${{ github.actor }}
- Workflow Run Details: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}To avoid unexpected charges, terminate all provisioned AWS cloud resources once testing is complete:
# Terminate nodegroups and control plane
eksctl delete cluster --name=wanderlust --region=us-west-1Here is a visual breakdown of the running components, security analysis, and GitOps deployments.
🚀 CI Pipeline - Build & Test (GitHub Actions)
|
🚀 CI Pipeline - Push & Bridge (GitHub Actions)
|
🛡️ Static Code Analysis (SonarQube)
|
📦 Container Registry (Docker Hub)
|
🔄 GitOps Sync - Overview (ArgoCD)
|
🔄 GitOps Sync - Details (ArgoCD)
|
🖥️ Workloads Terminal Monitor (K9s CLI)
|
🌍 Deployed Frontend Application
|