AWS EKS Infrastructure Portfolio
OngoingProduction-grade Kubernetes platform demonstrating enterprise-level Terraform automation, security, and observability on AWS
Overview
A comprehensive Infrastructure-as-Code project demonstrating enterprise-level AWS, Kubernetes, and DevOps practices. This project deploys a fully functional EKS cluster with SSO authentication, security hardening, observability, and cost optimization—entirely automated via Terraform and GitLab CI/CD.
The entire infrastructure stack is defined in modular Terraform configurations, enabling on-demand deployment of a production-grade Kubernetes platform. From VPC networking to application ingress, every component is version-controlled, reproducible, and demonstrates real-world patterns used in enterprise environments.
Deployed Services
All services are protected with SSO authentication and CrowdSec WAF, demonstrating enterprise security patterns.
Homepage Dashboard
Service dashboard with Kubernetes auto-discovery, displaying all running workloads
Visit DashboardGrafana + Prometheus
Full observability stack with metrics visualization, alerting, and Loki log aggregation
SSO + WAF ProtectedAuthentik SSO
Domain-wide single sign-on with forward authentication protecting all services
Identity ProviderTraefik Ingress
Modern ingress controller with automatic TLS, middleware chains, and CrowdSec integration
Traffic ManagementCrowdSec WAF
Community-driven threat intelligence with real-time IP reputation scoring
Security LayerCost Optimized
Production-grade platform running at ~$75-100/month using spot instances and fck-nat
Infrastructure Architecture
| Cloud Platform | AWS (EKS, VPC, IAM, EC2, EBS) |
|---|---|
| Infrastructure as Code | Terraform 1.14, modular architecture with remote state |
| Container Orchestration | Kubernetes 1.34 on EKS with managed node groups |
| CI/CD | GitLab Pipelines (API-triggered deployments) |
| Ingress & Networking | Traefik, AWS NLB, Cloudflare DNS/CDN |
| Authentication | Authentik SSO with forward auth middleware |
| Security | CrowdSec WAF, threat intelligence, VPC endpoints |
| Observability | Prometheus, Grafana, Loki, Alertmanager |
Dependency Flow: networking → eks → ingress → security → monitoring → apps
├── main.tf # Root orchestration ├── variables.tf # Input definitions ├── outputs.tf # Output values ├── locals.tf # Centralized configuration ├── versions.tf # Provider constraints ├── providers.tf # Provider setup │ └── modules/ ├── networking/ # VPC, subnets, NAT, VPC endpoints (~374 lines) ├── eks/ # EKS cluster, node groups, OIDC, EBS CSI ├── ingress/ # Traefik, TLS, Cloudflare DNS records ├── security/ # Authentik SSO, CrowdSec WAF (~631 lines) ├── monitoring/ # Prometheus, Grafana, Loki, Alertmanager └── apps/ # Homepage dashboard, service routing
Hover over components for details
External traffic from web browsers and API clients reaching your infrastructure.
GitLab CI/CD Pipeline
The GitLab pipeline enables on-demand infrastructure deployment with API-triggered workflows, automated secret injection, and multi-stage verification. All infrastructure changes flow through version control with full auditability.
Challenge and Approach
The Challenge
Demonstrating DevOps and cloud infrastructure skills to potential employers is challenging with just words on a resume. I needed a tangible, live environment that showcases my ability to design, implement, and maintain production-grade Kubernetes infrastructure on AWS.
The Approach
I built a complete EKS environment using infrastructure-as-code principles. Terraform manages all AWS resources, Kubernetes manifests define the workloads, and GitLab CI/CD orchestrates the entire lifecycle. The result is a fully automated, reproducible infrastructure that demonstrates real-world DevOps practices.
Skills Demonstrated
Infrastructure & Cloud
VPC design, EKS cluster management, IAM roles/policies, security groups, multi-AZ deployment
Terraform Expertise
Modular IaC design, state management, provider configuration, dependency ordering
Kubernetes & EKS
Managed node groups, OIDC provider integration, Helm charts, IngressRoute CRDs
Security Implementation
SSO/Identity with forward auth, WAF integration, private subnets, VPC endpoints
Technical Decisions
Key architectural choices made to balance functionality, cost, and production-readiness.
Traefik over NGINX
Ingress Controller Choice
- Native Kubernetes CRD support (IngressRoute)
- Built-in middleware chain for auth/security
- Dynamic configuration without restarts
- Plugin ecosystem (CrowdSec bouncer)
Authentik over Keycloak
Identity Provider Choice
- Modern Python/Django stack
- Blueprint-based config (GitOps-friendly)
- Embedded outpost for forward auth
- Lower resource footprint
CrowdSec for WAF
Security Layer Choice
- Community-driven threat intelligence
- Real-time IP reputation scoring
- Kubernetes-native deployment
- Traefik plugin integration
fck-nat over NAT Gateway
Cost Optimization Choice
- 95% cost reduction (~$30/month saved)
- Same functionality for outbound traffic
- ARM-based for additional savings
- Appropriate for demo/dev environments
Cost Engineering
Real-world cost optimization without sacrificing functionality. Estimated total: ~$75-100/month for a production-grade K8s platform.
Results & Impact
This project demonstrates proficiency with Terraform, AWS, and Kubernetes while serving as a live portfolio piece. The infrastructure is fully reproducible from a single API-triggered pipeline, showcasing enterprise-level automation, security practices, and cost optimization strategies used in production environments.
Explore This Project
Interested in seeing more? Check out the live demo or browse the source code.