Amazon EKS — Project 2 — CI/CD Pipeline

1 minute read

Project 2 — CI/CD Pipeline for EKS

Build a complete CI/CD pipeline: code push → build → test → scan → deploy to EKS via GitOps.

Pipeline Architecture

CI/CD Pipeline
┌────────────────────────────────────────────────┐
│                                                │
│  GitHub                                        │
│  ┌────────┐     ┌─────────────┐               │
│  │ Push   │────▶│ GitHub      │               │
│  │ to main│     │ Actions     │               │
│  └────────┘     └──────┬──────┘               │
│                        │                       │
│  CI Stage:             │                       │
│  ┌─────────┐  ┌───────▼──────┐  ┌──────────┐ │
│  │ Build   │─▶│ Test + Scan  │─▶│ Push ECR │ │
│  └─────────┘  └──────────────┘  └─────┬────┘ │
│                                       │       │
│  CD Stage:                            │       │
│  ┌──────────────┐   ┌────────────┐    │       │
│  │ Update Git   │──▶│ ArgoCD     │◀───┘       │
│  │ (image tag)  │   │ (sync)     │            │
│  └──────────────┘   └─────┬──────┘            │
│                           │                    │
│                    ┌──────▼──────┐             │
│                    │ EKS Cluster │             │
│                    └─────────────┘             │
│                                                │
└────────────────────────────────────────────────┘

Step 1: Create ECR Repository

$ aws ecr create-repository --repository-name my-app --region us-east-1

Step 2: GitHub Actions Workflow

name: CI/CD Pipeline
on:
  push:
    branches: [main]

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: my-app
  EKS_CLUSTER: demo

jobs:
  build-test-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run tests
        run: |
          pip install -r requirements.txt
          pytest tests/ -v

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions
          aws-region: us-east-1

      - name: Login to ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push
        env:
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

      - name: Scan image
        run: |
          aws ecr start-image-scan --repository-name $ECR_REPOSITORY --image-id imageTag=$IMAGE_TAG
          aws ecr wait image-scan-complete --repository-name $ECR_REPOSITORY --image-id imageTag=$IMAGE_TAG

      - name: Update manifest
        env:
          IMAGE_TAG: ${{ github.sha }}
        run: |
          cd k8s-manifests
          kustomize edit set image myapp=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          git commit -am "Update image to $IMAGE_TAG"
          git push

Step 3: ArgoCD Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/myorg/k8s-manifests.git
    path: overlays/production
    targetRevision: main
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

What You Practiced

  • Container image building and scanning
  • ECR as container registry
  • GitHub Actions CI pipeline
  • ArgoCD GitOps CD
  • OIDC authentication (no long-lived credentials)

What’s Next?

Monitor it: Project 3 — Monitoring Stack.

You may also enjoy