Skip to content

Architecture

Summary

  • AWS us-east-1: one VPC per environment, an EKS cluster per environment, Aurora PostgreSQL Serverless v2, ECR, Secrets Manager, Route 53, ACM, and a budget.
  • Cluster add-ons: External Secrets Operator, AWS Load Balancer Controller, ExternalDNS, metrics-server, Cluster Autoscaler, Argo CD, and self-hosted CI runners (ARC).
  • Delivery (GitOps): GitHub Actions → self-hosted runner (IRSA, in-VPC) → ECR (by digest) → commit the digest to Git → Argo CD reconciles.
  • Access: Route 53 → ALB (ACM TLS) → Ingress → Service → pods → Aurora.
  • Secrets: Secrets Manager → External Secrets Operator → Kubernetes Secret → pods.

See the runbook for operations and the decisions for rationale.

Environments

See Environments. Ownership is in Ownership.

Trust boundaries

  • CI runners run inside the VPC and use IRSA; there are no long-lived AWS keys.
  • EKS API endpoints are private; operators opt in with explicit CIDRs.
  • An application reads only its own secrets and the published contract.

Service mesh

None. A single service does not justify the control plane, per-pod proxies, and operational cost of a mesh: TLS terminates at the ALB, NetworkPolicy gives coarse isolation, and Argo Rollouts covers canary. The rationale and the conditions that would change it are in ADR-018.