Open to remote work

Project deep dive · Kubernetes & GitOps

EKS GitOps Platform

Production-style Kubernetes platform on AWS using Terraform, Argo CD, KEDA and GitHub Actions.

The problem

Kubernetes gets hard to manage once deployments happen by hand. Configuration drifts from Git, permissions get harder to track, and clusters keep paying for capacity even when there is no real work to do. This project fixes both problems: Git is the source of truth, and idle workloads scale themselves down to zero.

Tech stack

AWS

DevOps

Kubernetes

Observability

What I built

  • Provisioned the AWS infrastructure with Terraform
  • Built an EKS cluster across multiple availability zones
  • Set up GitOps deployment with Argo CD
  • Configured KEDA for event-driven autoscaling
  • Assigned dedicated IAM roles to workloads using IRSA
  • Built the CI/CD pipeline with GitHub Actions
  • Deployed containerized applications to EKS
  • Added Prometheus and Grafana for observability
  • Configured VPC networking and load balancing for cluster traffic
  • Tested scaling behaviour and failure scenarios

Key architecture decisions

  1. Amazon EKS

    I used EKS to run the workloads without managing the Kubernetes control plane myself.

  2. Argo CD

    Argo CD continuously compares the cluster with Git and brings it back to the desired state whenever they differ.

  3. KEDA

    KEDA scales workers based on real queue activity, including down to zero replicas when there is no work.

  4. IRSA (IAM Roles for Service Accounts)

    Each workload gets its own AWS permissions. No shared static AWS credentials stored in workloads.

  5. Prometheus & Grafana

    Used to monitor cluster and workload health and catch problems before they turn into incidents.

  6. Terraform & GitHub Actions

    Terraform defines the infrastructure. GitHub Actions validates and applies every change through a reviewed pipeline.

Security

Security was designed in from the start, not bolted on afterward.

  • No static AWS credentials in any workload
  • Least privilege IAM roles per service
  • Kubernetes RBAC
  • IAM roles for service accounts (IRSA)
  • Secrets kept out of container images
  • Infrastructure changes reviewed through Git before they apply

Challenges

  1. How to scale workers without paying for idle capacity

    KEDA watches queue depth and scales the worker deployment up or down automatically, including to zero replicas when there is no work.

    Workers only use resources when there is actual work to process.

  2. What happens if someone changes something directly in the cluster

    Argo CD detects the drift between the live cluster and what Git says it should look like, and reconciles it back on its own.

    Git stays the source of truth, even if someone bypasses it by accident.

Result

  • Infrastructure fully defined and reproducible from Terraform code
  • Deployments are managed through Git and continuously reconciled by Argo CD, with no direct production changes required
  • Worker workloads scale from 0 to N replicas based on queue activity
  • No static AWS credentials required by any workload
View on GitHub