Case 01
Capstone
Automated, security-gated delivery on AWS EKS
A platform that takes five containerized apps from a Git push to a running AWS EKS cluster, with security checks that can stop the release.
How it fits together
The problem
Deploying by hand means someone has to remember every step — the tests, the scans, the version bump, the rollout. Miss one and it ships anyway.
Where it could go wrong
What is exposed
- public ingress
- container images
- CI credentials
- cluster API
Checks in place
- scanning gates before release
- policy-as-code
- separate staging and production
Result
- releases blocked on failed scans
- cluster matches Git
- drift corrected on its own
How I built it
Terraform builds the AWS side: networking, compute, ingress, persistent storage and remote state. Eleven GitHub Actions workflows cover testing, container builds, versioning and release promotion, and only run for what actually changed. Argo CD and Helm keep the cluster matching Git, correcting drift and healing on their own. CodeQL, Gitleaks, Trivy, govulncheck and Dependabot run as gates, wired to one central policy.