{"id":198,"date":"2026-10-30T07:56:32","date_gmt":"2026-10-30T07:56:32","guid":{"rendered":"https:\/\/rezachegini.com\/?post_type=project&#038;p=198"},"modified":"2026-10-30T07:56:33","modified_gmt":"2026-10-30T07:56:33","slug":"django-gitops-eks-argocd-vault-terraform","status":"publish","type":"project","link":"https:\/\/rezachegini.com\/?project=django-gitops-eks-argocd-vault-terraform","title":{"rendered":"Django GitOps \u2014 EKS, ArgoCD, Vault &amp; Terraform"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Built a production-grade GitOps pipeline for a Django REST API on AWS EKS, covering the full DevOps lifecycle from local K3s development to cloud production with automated multi-environment promotion and enterprise-style secrets management.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Infrastructure (Terraform)<br>Provisioned VPC with public\/private subnets across two AZs, EKS cluster with managed node groups, RDS PostgreSQL in private subnets, ECR registry with lifecycle policies, S3 remote state with versioning and encryption, DynamoDB state locking, and all IAM roles following least-privilege principles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GitOps (ArgoCD + Kustomize)<br>Four environments \u2014 local (K3s), dev, staging, and prod \u2014 using Kustomize base\/overlay pattern. Each overlay patches only what differs: image tag, replicas, resource limits, and database host. ArgoCD auto-syncs dev and staging on every commit. Production requires manual approval in GitHub Actions and manual sync in ArgoCD UI.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Secrets Management (Vault + ESO)<br>HashiCorp Vault stores all credentials using KV v2 with version history. External Secrets Operator polls Vault every minute and syncs values into Kubernetes Secrets automatically. Zero hardcoded credentials in the codebase or Git history.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CI Pipeline (GitHub Actions)<br>Five-job pipeline: run tests against a real PostgreSQL container, build and push to ECR with git SHA tag, auto-deploy to dev, auto-deploy to staging, manual approval gate, then update prod manifest for ArgoCD sync.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Real Issues Debugged<br>EBS CSI driver IRSA on EKS 1.31, PostgreSQL PGDATA conflict on EBS volumes, ArgoCD CRD annotation size limits, and GitOps secret rotation ordering between Vault and live database.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Built a production-grade GitOps pipeline for a Django REST API on AWS EKS, covering the full DevOps lifecycle from local K3s development&hellip;<\/p>\n","protected":false},"featured_media":0,"menu_order":0,"template":"","tech":[136,128,141,138,139,137,133,127,120,142,140,135],"class_list":["post-198","project","type-project","status-publish","hentry","tech-amazon-eks","tech-argocd","tech-aws-iam","tech-django","tech-docker","tech-github-actions","tech-gitops","tech-hashicorp-vault","tech-kubernetes","tech-kustomize","tech-postgresql","tech-terraform"],"_links":{"self":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project\/198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project"}],"about":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/types\/project"}],"wp:attachment":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=198"}],"wp:term":[{"taxonomy":"tech","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftech&post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}