eks-gitops-platform

Sanitized AWS EKS GitOps lab: Terraform provisions a VPC and EKS cluster; Helm values configure ingress-nginx and cert-manager; one Argo CD Application deploys ingress-nginx from those values.

This repository does not apply infrastructure. GitHub Actions runs terraform fmt and terraform validate only. There is no terraform apply job and no AWS account is required for CI.

What it deploys

Layer	Path	Purpose
Terraform	terraform/	VPC (public/private subnets, NAT) and EKS with a managed node group, using terraform-aws-modules
Helm values	helm/ingress-nginx/values.yaml	ingress-nginx controller replicas, LoadBalancer service, metrics
Helm values	helm/cert-manager/values.yaml	cert-manager CRDs, leader election namespace, Prometheus
GitOps	gitops/applications/ingress-nginx.yaml	Argo CD Application: upstream ingress-nginx chart + values from this repo

terraform apply (run locally, not in CI) would create the VPC and EKS cluster only. Ingress, cert-manager, and Argo CD are not applied by Terraform.

Validate Terraform locally

Requires Terraform >= 1.6. No AWS credentials are needed for format or validate.

cd terraform
terraform fmt -recursive
terraform init -backend=false
terraform validate

Apply is intentionally not wired

• CI never runs terraform plan or terraform apply.
• There is no remote state backend and no AWS secrets in this repo.
• If you apply locally, you own the AWS account, state file, and destroy.

After a local apply you would install Argo CD, then apply gitops/applications/ingress-nginx.yaml. cert-manager can be installed with:

helm repo add jetstack https://charts.jetstack.io
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  -f helm/cert-manager/values.yaml