Run the Stack on Amazon EKS

You will hand in

• Terraform for EKS (cluster, node group or Karpenter, add-ons: VPC CNI, CoreDNS, kube-proxy, EBS CSI, Pod Identity agent)
• Managed RDS, ElastiCache, and MSK (or Strimzi on EKS, with justification)
• AWS Load Balancer Controller installed; Ingress creates an ALB
• App deployed via the Helm charts with prod values; images from ECR

1. 1

   Cluster with Terraform

   Done when: An EKS cluster with managed add-ons and access entries.

   • Use terraform-aws-modules/eks/aws with the Project 7 VPC
   • Managed node group (2–3 nodes) for system workloads; optionally Karpenter for apps
   • Access entries: admin role for the platform team, view role for developers
   • Enable control plane logging (api, audit, authenticator)

   Prove it works

   terminalcopy cmd

   $ aws eks update-kubeconfig --name shoplite-prod && kubectl get nodes -L topology.kubernetes.io/zone

   ── expected output ──

   NAME STATUS ZONE

   ip-10-20-11-14.ap-south-1... Ready ap-south-1a

   ip-10-20-12-87.ap-south-1... Ready ap-south-1b

   ip-10-20-13-5.ap-south-1... Ready ap-south-1c

2. 2

   Managed data services

   Done when: RDS, ElastiCache, and MSK reachable only from the cluster.

   • Reuse the Project 7 database module; add ElastiCache and MSK modules
   • Security groups: allow from the EKS node/pod security group only
   • Store endpoints/credentials in Secrets Manager

   Prove it works

   terminalcopy cmd

   $ kubectl run -it --rm pg --image=postgres:17 -- psql "$DB_URL" -c 'select 1'

   ── expected output ──

   ?column?

   ----------

   1

3. 3

   Controllers and identity

   Done when: AWS Load Balancer Controller and Pod Identity for app service accounts.

   • Install the AWS Load Balancer Controller (Helm) with its IAM role via Pod Identity
   • Pod Identity associations for api (S3 bucket + secret read) and worker
   • Install External Secrets (GitOps course, Mission 2.1) to sync DB credentials

   Prove it works

   terminalcopy cmd

   $ kubectl -n shoplite exec deploy/api -- aws sts get-caller-identity --query Arn --output text

   ── expected output ──

   arn:aws:sts::123456789012:assumed-role/shoplite-api-pod/eks-shoplite-...

4. 4

   Deploy the app

   Done when: The Helm charts deployed with prod values; ALB serving traffic.

   • Push images to ECR (with Project 2's tagging)
   • values-prod.yaml: external DB/cache/Kafka hosts, Ingress class alb with annotations for scheme and target type ip
   • helm upgrade --install and verify

   Prove it works

   terminalcopy cmd

   $ kubectl -n shoplite get ingress shoplite -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'; echo; curl -s http://$(kubectl -n shoplite get ingress shoplite -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/api/actuator/health

   ── expected output ──

   k8s-shoplite-shoplite-3f2a1c9b8d-1234567890.ap-south-1.elb.amazonaws.com

   {"status":"UP"}

• Add Karpenter with Spot (Platform course, Mission 0.3)
• Use Gateway API instead of Ingress
• Blue-green cluster upgrade drill

Résumé bullet

Built a production EKS platform with Terraform (managed add-ons, access entries, Pod Identity, AWS Load Balancer Controller) and deployed a microservices app using managed RDS, ElastiCache, and MSK, with zero static AWS credentials.

Demo script

• terraform destroy + apply the app layer to show reproducibility
• Show a pod's AWS identity via STS
• Show the ALB created from an Ingress