Node CI/CD to EKS with GitHub Actions

Level:Advanced

Time:3-5 hours

Cost:high

Works locally:No

Cloud creds:Yes

Cleanup:No

Reviewed:2026-05-30

Validation:make test

Node.js Docker Kubernetes Kustomize Terraform AWS GitHub Actions

Overview

Node app with tests, Makefile, Kustomize overlays, and EKS Terraform.

What You Will Build

Outcome Passing pipeline run plus scan/deploy evidence

Tools used Node.js, Docker, Kubernetes, Kustomize, Terraform, AWS, GitHub Actions

Best fit Advanced - 3-5 hours

Architecture Diagram

Student workstation Repository files CI/CD pipeline AWS account Validation proof

Prerequisites

• Install or review: Node.js, Docker, Kubernetes, Kustomize, Terraform, AWS, GitHub Actions.
• Use your own cloud account credentials and keep them out of commits.
• This project expects cloud resources, so verify budget alerts and cleanup first.
• Open the safety guide before running commands that create infrastructure.

Credentials And Cost Warning

Cost and credential stance

Cost risk is high. Cloud target: AWS. Cloud credentials needed: Yes. Always use your own account, never commit secrets, and confirm cleanup before creating paid infrastructure.

Step-By-Step Lab

Use this flow before you run commands:

1. Read the cost and credential warning above.
2. Review the validation, troubleshooting, cleanup, and portfolio proof sections below.
3. Follow the original project guide preserved near the bottom of this page.
4. Return to the validation and cleanup checks before you capture portfolio evidence.

Validation Checks

Run the project validation command before and after meaningful changes:

make test

Troubleshooting

• Run make test first so local tooling issues are visible early.
• If a command fails, check tool versions, working directory, and required environment variables.
• For cloud failures, confirm account identity, region, quotas, and least-privilege IAM.
• For pipeline failures, check repository secrets, runner permissions, and pinned action versions.

Cleanup

No dedicated cleanup command was detected in the project README. Treat this as a warning: before provisioning anything, write down the exact delete, destroy, or rollback steps for your environment.

Portfolio Proof

• Validation command output: make test
• Screenshot or terminal proof: Passing pipeline run plus scan/deploy evidence
• Notes explaining what changed, what failed, and how you fixed it
• Cleanup evidence, especially for cloud or Kubernetes resources

Original Project Guide

The original README content is preserved here for lab-specific commands and context. Headings are intentionally demoted so the page outline stays focused on the standard lab flow.

External image reference github-actions

🛡️ 2026 DevSecOps Enhancements (What You Will Learn)

This repository demonstrates advanced DevSecOps CI/CD patterns using GitHub Actions and Kustomize:

1. OIDC AWS Authentication: The workflow utilizes OpenID Connect (OIDC) to authenticate with AWS. This eliminates the necessity of storing long-lived, static IAM access keys in GitHub Secrets, significantly reducing the risk of credential compromise.
2. Environment Isolation via Kustomize: By leveraging Kustomize overlays (dev, staging, prod), the infrastructure configuration is strictly isolated. This guarantees separation of duties, allowing precise RBAC controls over who can deploy to each specific environment slice.

Table of Contents

• End-to-End CI/CD Pipeline for Simple Node App Deployment on EKS using GitHub Actions
  • Table of Contents
  • Repository Structure
  • CI/CD Workflow
    • Build Job
    • Deployment Job
  • Infrastructure Details
  • Notifications
  • GitOps Principles
• Hit the Star! ⭐ - Author by DevCloud Ninjas

Repository Structure

The repository is organized into several key directories:

├── app
│   ├── app.py
│   ├── calculator.js
│   ├── calculator.test.js
│   ├── Dockerfile
│   ├── Dockerfile-python
│   ├── index.js
│   └── package.json
├── kustomize
│   ├── base
│   │   ├── deploy.yaml
│   │   ├── ingress.yaml
│   │   ├── kustomization.yaml
│   │   └── svc.yaml
│   └── overlays
│       ├── dev
│       │   ├── deploy-dev.yaml
│       │   ├── ingress-dev.yaml
│       │   ├── kustomization.yaml
│       │   └── svc-dev.yaml
│       ├── prod
│       │   ├── deploy-prod.yaml
│       │   ├── ingress-prod.yaml
│       │   ├── kustomization.yaml
│       │   └── svc-prod.yaml
│       └── staging
│           ├── deploy-staging.yaml
│           ├── ingress-staging.yaml
│           ├── kustomization.yaml
│           └── svc-staging.yaml
├── README.md
├── terraform
│   ├── ingress-nginx.tf
│   ├── main.tf
│   ├── outputs.tf
│   ├── terraform.tf
│   └── variables.tf
└── VERSION

CI/CD Workflow

Build Job

The build job performs several key tasks:

1. Environment Setup: Node.js environment is set up and dependencies are installed.
2. Run Tests: Executes unit tests for the application.
3. Determine Version Increment: Checks the commit message to determine if the version needs to be incremented using Semantic Versioning scheme.
4. Docker Build and Push: Builds a Docker image and pushes it to a registry.

Deployment Job

The deployment job handles the following:

1. Terraform Setup: Initializes Terraform and sets up the backend with different state files.
2. Terraform Plan and Apply: Executes terraform plan and terraform apply to provision environment specific infrastructure.
3. Kubernetes Configuration: Configures kubectl to interact with the Kubernetes cluster.
4. Ingress Controller Setup: Uses Helm to install the ingress controller.
5. Application Deployment: Uses kubectl to deploy the Kustomized application manifests.

Infrastructure Details

• Dev Environment: Uses t3.small EC2 instances and deploys a single replica.
• Staging Environment: Uses t3.medium EC2 instances and deploys three replicas.
• Prod Environment: Uses t3.large EC2 instances and deploys three replicas.

DNS for all environments is automatically managed via Cloudflare and environment-specific subdomains are assigned and pointed to their respective LB hostname (using CNAME) ie., dev.afraz.dev, staging.afraz.dev and prod.afraz.dev.

Notifications

Slack notifications are configured to send updates at the end of each job. This provides immediate feedback on the success or failure of the pipeline and also updates on the DNS changes if applicable.

GitOps Principles

The pipeline adheres to GitOps principles, where Git serves as the single source of truth. Any change to the application or infrastructure is expected to be made through a Git commit.

Hit the Star! ⭐

If you are planning to use this repo for learning, please hit the star. Thanks!

Author by DevCloud Ninjas

Source Files On GitHub

Use the guide first.

The full learning flow stays on this page. Open GitHub only when a step asks you to inspect code, fork the lab, or download source assets.

Read safety guide Open project source