AWS EKS Infrastructure & CI/CD Setup

Hi, I want to build these 3 projects and make one GitHub repo with them.

1) Terraform Infra: AWS VPC + EKS + Aurora Serverless + Secrets Manager with IRSA

Goal

Provision production-style AWS infrastructure using Terraform modules with:
• VPC (public/private subnets, one NAT for cost control)
• EKS (managed node group)
• Aurora Serverless v2 (PostgreSQL) instead of basic RDS
• AWS Secrets Manager for DB credentials/rotation
• IRSA (IAM Roles for Service Accounts) so pods read secrets without static keys
• Remote Terraform state in S3 + DynamoDB locking

Acceptance Criteria / DoD
• terraform apply creates all resources with no manual console steps.
• aws eks update-kubeconfig → kubectl get nodes works.
• Pod using IRSA can read DB secret (prove with a sample Job/Pod).
• Aurora is not publicly accessible; connections from within VPC only.
• Remote state and locking functional; a second apply is idempotent.
• README explains variables, costs, and cleanup (terraform destroy).

Delivery Artifacts
• Complete Terraform code (modules), create-backend.sh, sample prod.tfvars.
• Minimal pod manifest demonstrating IRSA secret read.
• Architecture diagram (PNG) + cost notes (NAT GW, node, Aurora).



2) CI/CD: GitHub Actions → ECR → EKS with Argo Rollouts (Canary) + Feature Flags + Slack

Goal

Implement a modern delivery workflow for a containerized microservice:
• Build & test on GitHub Actions
• Push image to Amazon ECR
• Deploy to EKS using Argo Rollouts for canary releases (e.g., 10% → 50% → 100%)
• Feature flags (ConfigMap-based or Open-source toggles) to enable/disable features without redeploy
• Slack notifications on pipeline and rollout events
Acceptance Criteria / DoD
• Commit to main triggers build/test and pushes image → Slack notification sent.
• deploy-rollout.yml updates Rollout; canary steps visible in kubectl argo rollouts get rollout.
• Feature flag toggles change behavior without redeploy (e.g., turning on /beta route).
• Rollout aborts on high error rate (simulate with bad version) and posts Slack alert.
• README includes minimal setup for EKS credentials and Secrets.

Delivery Artifacts
• Source code, Dockerfile, k8s manifests (Rollout/Service/HPA/ConfigMap), GH Actions YAMLs.
• Step-by-step README (ECR repo creation, secrets, Slack setup).
• Short video/gif (optional) showing canary progression and flag toggle.



3) Observability: Prometheus + Grafana + OpenTelemetry (Tracing) + Cost Dashboard + Alerts to SNS/Slack

Goal

Provide a unified observability stack with:
• Metrics: Prometheus (kube-state-metrics, node exporter, app metrics)
• Tracing: OpenTelemetry SDK in the app → collector → Jaeger (or Grafana Tempo)
• Dashboards: Grafana for cluster health and AWS cost trend (CloudWatch Billing)
• Alerts: Prometheus Alertmanager routes to AWS SNS (email/SMS) and Slack
• SLOs: Define targets (e.g., p95 latency, error rate) and associated alerts
Acceptance Criteria / DoD
• Grafana shows a Cluster Overview dashboard (CPU/mem, pod restarts, API error rate).
• Jaeger/Tempo displays traces for app calls; spanning includes incoming HTTP + downstream calls.
• AWS cost dashboard shows current month cumulative charges + daily burn + per-service view.
• Alert firing tests: CPU load pod triggers alert → Alertmanager sends to SNS and Slack.
• README includes step-by-step install, secrets, and teardown.

Delivery Artifacts
• Helm values files, alert rules, Grafana dashboards JSON, OTel sample instrumented app code, Alertmanager config with SNS/Slack.
• IAM policy JSON for CloudWatch read and Alertmanager SNS publish.
• Screenshots of dashboards and example alert payload.