FinTrack EKS Platform

What is this?

A production-grade Kubernetes platform for FinTrack - a personal finance tracker. This documents the complete infrastructure, deployment pipeline, and observability stack built on AWS EKS, including progressive delivery, policy enforcement, and live secrets management.

Architecture

Untitled Diagram (1).gif

Stack

Layer	Technology
Cloud	AWS (EKS, RDS, S3, ECR, IAM, IRSA, Secrets Manager)
IaC	Terraform (modular, remote state, feature-based files)
Orchestration	Kubernetes 1.31 on EKS (5-node, t3.small)
CI	GitHub Actions with OIDC (no stored credentials)
CD	ArgoCD (pull-based GitOps)
Progressive Delivery	Argo Rollouts (canary: 20% → 50% → 100%)
Policy Enforcement	Kyverno (image trust, non-root containers)
Secrets	External Secrets Operator + AWS Secrets Manager (IRSA)
TLS	AWS ACM (terminated at ELB)
DNS	Route 53
Ingress	NGINX Ingress + Classic ELB
Monitoring	Prometheus + Alertmanager + Grafana
Logging	Loki + Promtail
Autoscaling	Horizontal Pod Autoscaler (CPU + memory)
DB Migrations	Prisma Migrate via Kubernetes Job in CI

Repository Structure

Repo	Description
fintrack-infrastructure	Terraform modules
fintrack-gitops	GitOps manifests (ArgoCD source of truth)
fintrack-frontend	React + Vite frontend
fintrack-backend	Fastify + Prisma + PostgreSQL API

Key Engineering Decisions

GitOps over push-based CD - ArgoCD pulls from Git rather than CI pushing to the cluster. Deployments are auditable, reversible, and drift is auto-corrected.
OIDC over stored credentials - GitHub Actions assumes an IAM role via OpenID Connect. No AWS keys stored anywhere.
IRSA over instance profiles - Backend pod and External Secrets Operator each assume scoped IAM roles via Kubernetes service account annotations. Access is pod-specific, not node-wide.
External Secrets over Sealed Secrets - Secrets are fetched live from AWS Secrets Manager at runtime via IRSA. Nothing sensitive is ever committed to Git, and rebuilding the cluster doesn't require re-encrypting anything.
Canary deployments (Argo Rollouts) over plain rolling updates - New backend versions receive 20% → 50% → 100% of traffic with pauses for verification before full promotion.
Policy-as-code (Kyverno) - Cluster-wide admission rules block non-ECR images and containers that don't declare a non-root security context.
AWS ACM over cert-manager + Let's Encrypt - TLS terminates at the load balancer and renews automatically; one less moving part inside the cluster.
Modular Terraform - Each infrastructure component (VPC, EKS, RDS, S3, IAM, DNS, External Secrets) is an independent reusable module. Bootstrap resources are split into feature-based files (namespaces.tf, argocd.tf, monitoring.tf, kyverno.tf, external-secrets.tf, argo-rollouts.tf) rather than one monolithic file.
HPA over fixed replicas - Backend scales from 2 to 5 replicas automatically based on CPU (70%) and memory (80%) utilization.