Gate. Forecast. Failover.
A tested EKS platform, not just a diagram of one. Terraform and GitOps run an EKS cluster with cost-aware autoscaling and policy enforcement out of the box. On top of that baseline: a blocking DevSecOps CI gate, a proactive autoscaler that scales ahead of predictable traffic, and a disaster-recovery path with a measured recovery time.
Solid boxes: deployed and tested. Dashed: proof-of-concept, off by default.
What it is
An EKS platform built the way a small platform team actually runs one: infrastructure as code, GitOps delivery, cost-aware autoscaling, and policy enforcement as the tested baseline — then three additions on top, each scoped and labeled honestly as either production-grade or a proof-of-concept.
| Infrastructure | Terraform, modular, per-environment state | tested |
| Delivery | Argo CD, GitOps, app-of-apps pattern | tested |
| Node scaling | Karpenter — bin-packing, spot-aware | tested |
| Policy | Kyverno admission control | tested |
| CI security | gitleaks · Semgrep · Checkov · npm audit | poc |
| App scaling | KEDA, forecast-driven, ahead of load | poc |
| Resilience | DynamoDB Global Tables + Route 53 failover | poc |
Architecture
Git is the only source of truth. Terraform provisions the cluster and everything that needs AWS IAM (IRSA roles, Karpenter's NodePool, the load balancer controller); Argo CD reconciles everything else — the app, the observability stack, Kyverno's policies, and the two proof-of-concept additions — straight from this repository. Nothing is applied by hand.
A CI gate that actually blocks poc
Four scanners, each independent so one failure never hides another. The build fails on any finding by default — a soft-fail toggle exists only to demo a green run on purpose.
gitleaks scans the whole repository, not just the Terraform, on every push and PR.
Semgrep, scoped to this repo's actual custom logic — the app itself is a prebuilt image, so the surface is small by design and the README says so.
npm audit, conditional — it only runs if a package.json actually exists, instead of faking one to tick a box.
Checkov against the Terraform, with a no-blanket-suppression policy: every skip needs a written reason and a documented production fix.
Scaling ahead of the load, not after it poc
A CronJob reads recent ALB request-rate history from CloudWatch, blends in a same-time-yesterday signal, and publishes a forecasted replica count as a custom metric. KEDA scales the app off that forecast instead of live load — the one thing a reactive HPA structurally can't do. It's classical time-series smoothing, not a trained model, and the README says that plainly too.
A failover with a number attached poc
DynamoDB Global Tables replicate one small table across two regions. A Lambda-backed endpoint — not a fork of the app image — is deployed identically to both. Route 53 health checks drive the failover; a short TTL keeps DNS propagation from dominating the measured recovery time.
| RTO | time from health-check failure to Route 53 failing traffic over | |
| RPO | near-zero, not zero — Global Tables replicate asynchronously |
Build log
Every project accretes — this one absorbed a security-gate design from an earlier, separate pipeline project rather than merging two competing delivery systems into one. The full reasoning is in the repo's changelog; here's the shape of it.
Repo consolidation
Absorbed the security-gate concept from a separate CI/CD project — not its CodePipeline stack, which would have competed with Argo CD.
Baseline verification
Confirmed the existing platform still deploys clean end to end before adding anything.
DevSecOps gate
Added the four-scanner CI gate, proven with a deliberately planted secret.
Predictive scaling
KEDA + a forecasting CronJob, measured against a reactive-HPA baseline.
Disaster recovery
Cross-region failover, tested once, torn back down.
Documentation
This page, the README, and a study guide written phase by phase.