🚀 CloudNative DevOps Blueprint

A comprehensive DevOps blueprint for deploying cloud-native applications with enterprise-grade tooling

🎯 Overview

This project demonstrates a production-ready DevOps pipeline for deploying a MERN (MongoDB, Express, React, Node.js) application using modern cloud-native technologies and best practices. From local development to cloud deployment, this blueprint covers the entire application lifecycle.

Quick navigation: Explore Other Branches · Application Versions · Project Deployment Flow · Technology Stack · Documentation Hub

🌿 Explore Other Branches

This repository is organized as a set of branches. main (this one) is the broadest, most comprehensive blueprint — the branches below are standalone, focused deep-dives into a specific slice of the stack, each with its own complete setup and docs:

flowchart LR
    Begin["🌱 begineer<br/>core flow only"] -->|adds mesh, policy,<br/>secrets, log aggregation| Main["🚀 main<br/>broadest blueprint · this branch"]
    Main -->|focus: custom domain,<br/>TLS, GitHub SSO| TLS["🔐 domain-and-tls<br/>focused deep-dive"]
    Main -->|focus: real cloud,<br/>Terraform-provisioned EKS| Prod["☁️ prod<br/>production deployment"]

    classDef begin fill:#23ce26,color:#000,stroke:#23ce26
    classDef main fill:#57606a,color:#fff,stroke:#57606a
    classDef tls fill:#0ea5e9,color:#fff,stroke:#0ea5e9
    classDef prod fill:#7B42BC,color:#fff,stroke:#7B42BC

    class Begin begin
    class Main main
    class TLS tls
    class Prod prod

Loading

🌱 begineer Beginner-Friendly Core Flow The starting point, before main's more advanced pieces (service mesh, policy engines, secrets management, log aggregation). Docker + Docker Compose Kubernetes on kind with Ingress Jenkins CI/CD Helm + ArgoCD GitOps Kustomize (dev/prod overlays) Prometheus/Grafana observability

🔐 domain-and-tls Domain, TLS & Platform A custom domain and TLS setup on Kubernetes, and everything that requires end-to-end. Gateway API + wildcard Let's Encrypt cert via DNS-01 GitOps deployment (ArgoCD + Argo Rollouts canary) Prometheus/Grafana + blackbox-exporter TLS monitoring GitHub OAuth SSO (Dex, native Grafana OAuth, oauth2-proxy)

☁️ prod Real AWS EKS Production Deployment Actual cloud infrastructure, provisioned with Terraform, driven by a real CI/CD pipeline. Terraform-provisioned AWS EKS, VPC, ECR Envoy Gateway (Gateway API) + cert-manager Jenkins + Trivy + SonarQube CI/CD pipeline ArgoCD + Argo Rollouts canary, triggered by CI

At a glance — what each branch actually includes:

Capability	🌱 begineer	🚀 main (this branch)	🔐 domain-and-tls	☁️ prod
Containerization	✅ Docker Compose	✅ Docker	✅ Docker	✅ Docker
Kubernetes cluster	kind + Ingress	kind + Ingress/Gateway API	kind + Gateway API	Real AWS EKS
Infra as Code	—	✅ Terraform (optional path)	—	✅ Terraform (EKS, VPC, ECR)
CI/CD	✅ Jenkins	✅ Jenkins + Trivy + SonarQube + GitHub Actions (GHCR, cosign, Kyverno signature enforcement)	—	✅ Jenkins + Trivy + SonarQube
GitOps	✅ ArgoCD	✅ ArgoCD + Kargo (promotion)	✅ ArgoCD	✅ ArgoCD
Progressive Delivery	—	✅ Argo Rollouts (canary + blue-green)	✅ Argo Rollouts (canary)	✅ Argo Rollouts (canary)
Config management	Helm + Kustomize	Helm + Kustomize	Helm	Helm
Service Mesh	—	✅ Istio	—	—
Policy Engine	—	✅ Kyverno	—	—
Secrets Management	—	✅ Vault + External Secrets Operator	—	—
Custom Domain + TLS	—	—	✅ cert-manager, DNS-01 wildcard	✅ cert-manager
SSO	—	—	✅ GitHub OAuth (Dex, Grafana, oauth2-proxy)	—
Monitoring	✅ Prometheus/Grafana	✅ Prometheus/Grafana	✅ + TLS cert-expiry alerts	✅ Prometheus/Grafana
Log Aggregation	—	✅ Fluent Bit + Loki	—	—

📦 Application Versions

Three versions of the application are available, each with distinct visual and functional differences:

Version	Frontend	Backend
1.0.0	🔵 Blue theme	v1.0.0
2.0.0	🔴 Red theme	v2.0.0
3.0.0	🟣 Purple theme	v3.0.0

See src/README.md for screenshots and build instructions.

🌟 Project Deployment Flow

End-to-end deployment pipeline from code commit to production

The gif above walks through one path end-to-end; it doesn't show every piece running at once. Every box below is a real, working piece of this repo — but most of the per-tool guides (Kyverno.md, Istio.md, ArgoRollouts.md, etc.) demo their slice standalone, each with its own kind cluster, not wired to the others. This is the composite architecture — how they compose if you ran them together, not a claim that this exact end-to-end chain runs in any single guide today. Note the two independent CI entry points feeding the same cluster: Jenkins (Docker Hub, the primary GitOps path) and GitHub Actions (GHCR, signed images that Kyverno verifies at admission) — see concepts/SupplyChainSecurity.md for why that second path exists:

flowchart TD
    Dev[Developer commit] --> CI[Jenkins CI<br/>SonarQube + Trivy scan<br/>build & push image]
    CI -->|triggers| CD[Jenkins CD<br/>gitops/Jenkinsfile<br/>updates image tag]
    CD -->|git commit + push| Git[(Git repo<br/>manifests / Helm values)]
    Git -.->|watched by| ArgoApp[ArgoCD Application]

    CI -.->|image published| Kargo[Kargo Warehouse<br/>watches image tags]
    Kargo -->|promotes dev→staging→prod<br/>opens PR, human merges| Git

    Dev -.->|parallel pipeline| GHA[GitHub Actions CI<br/>Trivy + Syft SBOM<br/>cosign sign, keyless]
    GHA --> GHCR[(GHCR: signed images<br/>+ SBOM attestation)]

    subgraph "AWS EKS cluster (provisioned by Terraform)"
        ArgoApp -->|sync| Kyverno[Kyverno<br/>admission policies +<br/>signature verification]
        GHCR -.->|verifyImages| Kyverno
        Kyverno -->|allowed| Rollout[Argo Rollouts<br/>canary / blue-green]

        subgraph "mern-devops namespace (Istio mesh)"
            Rollout --> FE[frontend<br/>+ Envoy sidecar]
            FE -->|mTLS| BE[backend<br/>+ Envoy sidecar]
            BE -->|mTLS| DB[(mongodb)]
        end

        Vault[(HashiCorp Vault)] --> ESO[External Secrets<br/>Operator] --> Secret[Kubernetes Secret]
        Secret --> BE
        Secret --> DB
    end

    FE -.->|metrics| Prom[Prometheus / Grafana]
    BE -.->|metrics| Prom
    FE -.->|logs| Fluent[Fluent Bit] --> Loki[Loki]
    BE -.->|logs| Fluent

    classDef controller fill:#1f6feb,color:#fff,stroke:#1f6feb
    classDef store fill:#2ea043,color:#fff,stroke:#2ea043
    classDef workload fill:#57606a,color:#fff,stroke:#57606a
    classDef external fill:#8b949e,color:#000,stroke:#8b949e,stroke-dasharray: 3 3
    classDef observability fill:#d29922,color:#000,stroke:#d29922

    class Dev external
    class CI,CD,ArgoApp,Kyverno,Rollout,ESO,Kargo,GHA controller
    class Git,Vault,GHCR store
    class FE,BE,DB,Secret workload
    class Prom,Fluent,Loki observability

Loading

🛠️ Technology Stack

🏗️ Infrastructure	🔄 CI/CD	☸️ Orchestration & Config	🔐 Security & Secrets	📊 Observability
• Terraform • AWS EKS • Docker • Docker Bake • Ingress / Gateway API	• Jenkins • ArgoCD • Kargo • Argo Rollouts • SonarQube • Trivy • GitHub Actions • cosign • Syft	• Kubernetes • Helm • Kustomize • Istio • Kyverno • HPA / Locust	• HashiCorp Vault • External Secrets Operator	• Prometheus • Grafana • Fluent Bit • Loki

📚 Documentation Hub

📘 docs/concepts/ — the guides below are how-to runbooks; the concepts folder covers the why (GitOps, service mesh, progressive delivery, policy-as-code, secrets management, Helm vs Kustomize, Ingress vs Gateway API).

🐳 Containerization Docker.md Build and run containers with Docker Compose for multi-service applications Multi-stage Dockerfiles Production optimizations Container networking Volume management

☸️ Kubernetes Kubernetes.md Deploy on kind cluster with ingress Persistent storage setup Deployments and Statefulsets Secrets and Configuration Management Ingress/Gateway API Deployment

🔥 Stress Testing & HPA StressTest.md Load test the backend with Locust to trigger HPA autoscaling Locust stress client (local & Kubernetes Job) HPA autoscaling demonstration Grafana metrics observation during load

🔄 CI/CD Pipeline

Jenkins.md Automated build, test, and deployment Multi-stage pipeline Sonar scanning Quality gates Trivy Scanning Docker Images Build and Push Notification system
GitHubActions.md Signed CI/CD pipeline to GHCR Multi-arch build via existing docker-bake.hcl Trivy scan + Syft SBOM cosign keyless signing (Sigstore) Kyverno signature enforcement at admission

📦 Package, Configuration & Policy Management

📦 Helm Charts Helm.md Template-based Kubernetes deployments Chart customization Values management Release lifecycle

🔧 Kustomize Kustomize.md Environment-specific configurations Base and overlay patterns Patch management Multi-environment deployment

🛡️Kyverno Kyverno.md Policy management and governance Security policy enforcement Resource validation rules Compliance automation

🔐 Secrets Management

ExternalSecrets.md Secure secrets management with HashiCorp Vault integration External Secrets Operator Vault secret synchronization Kubernetes secret automation

📈 Monitoring

Monitoring.md Metrics observability with Prometheus & Grafana Metrics collection & storage Kube Prometheus Stack Dashboards Real-time monitoring dashboards Performance & resource tracking Alert management & notifications

🪵 Logging

Logging.md Centralized log collection with Fluent Bit, Loki & Grafana Fluent Bit DaemonSet collection Kubernetes metadata enrichment JSON log parsing Loki log aggregation LogQL querying in Grafana

🚀 GitOps Deployment

ArgoCD.md Continuous deployment with Git sync and automated application lifecycle management Repository connection Application management Sync policies Multi-cluster deployment RBAC integration

🚚 Continuous Promotion

Kargo.md Verified, PR-gated promotion of builds across dev → staging → prod Warehouse-driven Freight from image tags Health-gated Stage chaining (dev → staging → prod) PR-gated promotions, reviewed on GitHub before ArgoCD syncs Multi-environment Kustomize overlays

🎯 Progressive Delivery

ArgoRollouts.md Canary and blue-green deployments with automated rollbacks Canary traffic splitting Blue-green instant promotion Rollback strategies

🕸️ Service Mesh

Istio.md Advanced traffic management and security with service mesh capabilities mTLS encryption Traffic splitting & canary Observability & tracing Policy enforcement

☁︎ Production Deployment

🏗️ Cloud Infrastructure Terraform.md Provision and Deploy on AWS EKS cluster with IaC VPC and networking setup EKS cluster configuration Security groups and IAM Add-ons installation

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

⭐ Star this repository if you find it helpful!