DevOps Real-World Project: Build and Operate CI/CD on EKS

Microservices-based pharmaceutical application with a front-end (Pharma UI) and eight back-end microservices, already committed to GitHub. Get introduced to the GitHub organization structure, the full DevOps tool stack (Terraform, GitHub Actions, Docker, ArgoCD, EKS), and the AWS services (VPC, EKS, ECR, RDS, IAM, Secrets Manager) you'll provision from scratch throughout this course.

See the complete architecture before you build it. This covers how infrastructure gets provisioned through Terraform modules (starting with dev, later QA and production), how Terraform runs through GitHub Actions with an approval gate for safety, and the full CI/CD pipeline flow — from code push through testing, image scanning, ECR, Helm charts, and automatic deployment to EKS via ArgoCD.

This video covers prerequisites for the project: installing AWS CLI v2, Terraform (≥1.1.1), kubectl, Helm v3, Git, Python 3, plus optional GitHub CLI and VS Code. Requires AWS and GitHub accounts. Recommends creating a ~/DevOps/ZenPharma directory structure exactly as shown to avoid path-related issues later.

Before writing any Terraform code, get the full roadmap for provisioning infrastructure — configuring AWS credentials, setting up GitHub organization and repositories (frontend, backend, infra, GitOps), enabling SSH authentication, creating an S3 backend for Terraform state (with separate paths for dev, QA, and prod), and building the VPC module. By the end of this section, all AWS resources — VPC, IAM, EKS, ECR, RDS, and Secrets Manager — will be provisioned.

A guided walkthrough of the documentation before diving into hands-on execution — covering AWS credential setup, GitHub organization and repository structure (forking front-end and back-end, creating infra and GitOps repos), passwordless SSH authentication, and creating the S3 bucket for Terraform state with versioning and encryption enabled. Understand each step conceptually here before executing it in the next video.

Hands-on setup: create an IAM admin user and configure AWS CLI credentials, clone the front-end and back-end repositories using SSH authentication, create the infra and GitOps repositories locally, and set up an S3 bucket with versioning, encryption, and public access blocked — the foundation Terraform needs before provisioning any infrastructure.

Before writing any code, understand how the VPC module is structured and why — the module/envs folder layout, required subnets (public for load balancers, private for EKS and RDS), key input variables (CIDR blocks, project, environment), and why we use Terraform's official AWS VPC registry module instead of writing one from scratch. Also covers the separate backend state file per environment (dev, QA, prod) and why that separation matters.

Hands-on: create the VPC module files (variables.tf, main.tf, output.tf) and the dev environment files (backend.tf, provider.tf, main.tf), then run terraform init to download the required modules and terraform plan to verify the code creates 24 resources as expected. Code is committed and tagged so you can pull it directly if you get stuck.

Run terraform apply to provision the VPC module's 24 resources — subnets, route tables, NAT gateway, internet gateway, security groups, and more — then validate everything in the AWS console. Includes an important cost note: NAT Gateway is chargeable, so remember to delete resources when not actively using them.

Build the IAM module with three key IRSA roles — External Secret Operator (to pull secrets from Secrets Manager), ArgoCD (to manage cluster resources), and AWS Load Balancer Controller — plus a GitHub Actions OIDC role for passwordless authentication between GitHub and ECR. Note: this module depends on the EKS module's OIDC provider, so it's written and committed here but can't be applied until EKS is created.

Build the EKS module using Terraform's official registry module — configuring the Kubernetes version, managed node group sizing (desired, min, max), and essential add-ons (VPC CNI, kube-proxy, CoreDNS, EKS Pod Identity Agent). Outputs include the cluster name, endpoint, and OIDC provider ARN needed by the IAM module.

Build the remaining three modules — ECR (creating registries for all nine microservices), RDS (PostgreSQL database with credentials pulled from Secrets Manager), and Secrets Manager (storing DB and JWT credentials). Then wire everything together in the root main.tf, calling all six modules (VPC, IAM, EKS, RDS, ECR, Secrets Manager), and see how easily the same setup can be replicated for a QA environment.

Run terraform init, plan, and apply across all six modules to provision the complete infrastructure — around 90 resources including the EKS cluster and RDS database. Covers creating terraform.tfvars for sensitive values, troubleshooting an S3 state lock issue, and fixing a missing output error before the full apply completes successfully in about 25-30 minutes.

Validate everything Terraform provisioned — nine ECR registries, the EKS cluster with its node group, two secrets in Secrets Manager, and the RDS database instance — confirming the infrastructure code works as expected. Then run terraform destroy to tear down all 99 resources, since going forward, infrastructure will be provisioned through pipelines instead of manual commands.