Flask App Deployment on AWS EKS with CI/CD, GitOps, and Infrastructure as Code

Project Overview

This project demonstrates an end-to-end DevOps workflow for deploying a containerized Flask application to Amazon EKS using modern DevOps practices.

The system is automated and reproducible using:

• Infrastructure as Code (Terraform)
• Configuration Management (Ansible)
• Continuous Integration (Jenkins)
• Containerization (Docker)
• Container Registry (Amazon ECR)
• Kubernetes Orchestration (Amazon EKS)
• GitOps Deployment (ArgoCD)
• Security Scanning (Trivy)

---

High-Level Architecture

Technologies Used

Category	Tools
Infrastructure	Terraform
Configuration	Ansible
CI/CD	Jenkins
Containerization	Docker
Registry	Amazon ECR
Orchestration	Amazon EKS
GitOps	ArgoCD
Security	Trivy
Cloud Provider	AWS

Build locally :

cd App
docker build -t finalproject:latest .

Infrastructure Provisioning (Terraform)

Terraform provisions:

• VPC & networking
• Security groups
• Jenkins EC2
• EKS cluster
• Node group
• ECR repository
• S3 backend for state

Initialize backend:

cd Terraform/Backend
terraform init
terraform apply -auto-approve

Apply infrastructure:

cd ../infra
terraform init
terraform apply -auto-approve

Update kubeconfig:

aws eks update-kubeconfig --region us-east-1 --name ivolve-proj-eks

Configuration Management (Ansible)

Ansible configures the Jenkins EC2 instance with:

• Java
• Jenkins
• Docker
• AWS CLI
• Trivy

Run Ansible:

cd Ansible
ansible-galaxy collection install amazon.aws
ansible-playbook -i inventory.aws_ec2.yml playbook.yaml

CI Pipeline (Jenkins)

The Jenkins pipeline performs:

• Build Docker image
• Security scan using Trivy
• Push image to Amazon ECR
• Update Kubernetes deployment manifest (GitOps)
• Commit and push changes

Pipeline stages:

• Build Image
• Security Scan
• Push Image
• Cleanup
• Update K8s Manifest (GitOps)

Jenkins configuration:

• Shared library name: shared-lib
• AWS credentials ID: aws-creds
• GitHub token ID: github-token
• ECR URI: 637423620989.dkr.ecr.us-east-1.amazonaws.com/ivolve-app
• Image tag: ${BUILD_NUMBER}
• WebHook : http://54.225.32.247:8080/github-web to trigger the pipeline whenever the code repo changes

---

Security Scanning (Trivy)

Images are scanned for HIGH and CRITICAL vulnerabilities before pushing to ECR.

Example:

trivy image --severity HIGH,CRITICAL image:tag

---

Amazon ECR

Images are stored in:

637423620989.dkr.ecr.us-east-1.amazonaws.com/ivolve-app:<tag>

Login command:

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 637423620989.dkr.ecr.us-east-1.amazonaws.com

Kubernetes (Amazon EKS)

Kubernetes resources include:

• Namespace
• Deployment
• LoadBalancer service

Apply manifests:

kubectl apply -f K8s/ns.yaml

Verification:

kubectl get pods -n ivolve
kubectl get svc -n ivolve

---

GitOps with ArgoCD

ArgoCD continuously monitors:

• K8s/deployment.yaml

When Jenkins updates the image tag:

• ArgoCD detects changes
• Syncs automatically
• Deploys new version to EKS

Benefits:

• Automatic deployments
• Git-based version control
• Easy rollback
• Declarative Kubernetes management

End-to-End CI/CD Flow

1. Developer pushes code to GitHub
2. Jenkins triggered via webhook
3. Image built and scanned
4. Image pushed to ECR
5. Manifest updated
6. ArgoCD detects change
7. EKS updates running pods automatically

---

DevOps Concepts Demonstrated

• Infrastructure as Code (IaC)
• Configuration as Code
• CI/CD automation
• GitOps workflow
• Container security
• Kubernetes deployment
• AWS cloud architecture

---

Author

Anas Tarek Cloud and DevOps Engineer