84.1 Project 97: Full CI/CD — code to Docker to EKS with monitoring
Friends, this capstone ties the pipeline together. Today we build, scan, push, deploy to EKS, and prove a Grafana panel moves.
मित्रांनो, हा capstone pipeline एकत्र करतो. आज build, scan, push, EKS deploy, Grafana panel.
दोस्तों, यह capstone pipeline जोड़ता है. आज build, scan, push, EKS deploy, Grafana panel.
What you will build in this project
- CI builds and scans.
- Push SHA image.
- Deploy to EKS.
- Dashboard shows traffic.
1. Start from a real company story
At Swiggy in Bengaluru, each team had a different path to prod and rollbacks took guesswork.
Rough cost: about Rs 45 lakh across a messy release week.
Ravi standardized build-scan-push-deploy-monitor for one shop API.
Today we run that golden path once.
Ravindra Bagale's Tip
Students deploy latest tags. Always deploy an immutable SHA or semver. Keep that habit.
Students latest tags deploy करतात. नेहमी SHA किंवा semver. सवय ठेवा.
Students latest tags deploy करते हैं. हमेशा SHA या semver. आदत रखिए.
2. Start and prepare
Step 1: Why this project
Why: Real outages teach. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: a1
Type this:
echo 'Today we build cap97'
You will see:
Today we build cap97
What it means: Why.
Example 2: a2
Type this:
mkdir -p /tmp/cap97 && echo 'Scope ready'
You will see:
Scope ready
What it means: Scope.
Example 3: a3
Type this:
echo 'Keep commands short and check every output'
You will see:
Keep commands short and check every output
What it means: Habit.
Step 2: Prepare workspace
Why: Folders and notes. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: prep. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: b1
Type this:
mkdir -p /tmp/cap97 && printf '%s\n' 'lab notes' > /tmp/cap97/NOTES.txt && cat /tmp/cap97/NOTES.txt
You will see:
lab notes
What it means: Notes.
Example 5: b2
Type this:
echo 'Work only under /tmp/cap97 for this project'
You will see:
Work only under /tmp/cap97 for this project
What it means: Path.
Example 6: b3
Type this:
echo 'Write ACCEPT.txt at the end'
You will see:
Write ACCEPT.txt at the end
What it means: Accept file.
Step 3: Pipeline stages
Why: Order. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: stages. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: c1
Type this:
printf '%s\n' 'lint -> test -> build -> scan -> push -> deploy -> smoke' > /tmp/cap97/STAGES.txt && cat /tmp/cap97/STAGES.txt
You will see:
lint -> test -> build -> scan -> push -> deploy -> smoke
What it means: Stages.
Example 8: c2
Type this:
echo 'Fail fast on lint and tests before spending on image builds'
You will see:
Fail fast on lint and tests before spending on image builds
What it means: Fail fast.
Example 9: c3
Type this:
echo 'Smoke hits /healthz on the new ReplicaSet'
You will see:
Smoke hits /healthz on the new ReplicaSet
What it means: Smoke.
3. Build the main pieces
Step 4: Build and scan
Why: Image gate. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: scan. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: d1
Type this:
echo 'docker build -t registry.example.com/shop/api:$SHA .'
You will see:
docker build -t registry.example.com/shop/api:$SHA .
What it means: Build.
Example 11: d2
Type this:
echo 'trivy image --exit-code 1 --severity HIGH,CRITICAL registry.example.com/shop/api:$SHA'
You will see:
trivy image --exit-code 1 --severity HIGH,CRITICAL registry.example.com/shop/api:$SHA
What it means: Scan.
Example 12: d3
Type this:
echo 'Push only after scan passes'
You will see:
Push only after scan passes
What it means: Push gate.
Step 5: Deploy EKS
Why: Rolling. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: deploy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: e1
Type this:
echo 'kubectl -n shop set image deploy/shop-api api=registry.example.com/shop/api:$SHA'
You will see:
kubectl -n shop set image deploy/shop-api api=registry.example.com/shop/api:$SHA
What it means: Deploy.
Example 14: e2
Type this:
echo 'kubectl -n shop rollout status deploy/shop-api'
You will see:
kubectl -n shop rollout status deploy/shop-api
What it means: Status.
Example 15: e3
Type this:
printf '%s\n' 'Acceptance: rollout complete and /healthz returns 200' > /tmp/cap97/ACCEPT.txt && cat /tmp/cap97/ACCEPT.txt
You will see:
Acceptance: rollout complete and /healthz returns 200
What it means: Gate.
Step 6: Monitor
Why: Grafana check. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: mon. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: f1
Type this:
printf '%s\n' 'Watch request rate and 5xx on the shop-api dashboard for 10 minutes' > /tmp/cap97/MON.txt && cat /tmp/cap97/MON.txt
You will see:
Watch request rate and 5xx on the shop-api dashboard for 10 minutes
What it means: Mon.
Example 17: f2
Type this:
echo 'Rollback if error budget burns too fast'
You will see:
Rollback if error budget burns too fast
What it means: Budget.
Example 18: f3
Type this:
echo 'kubectl -n shop rollout undo deploy/shop-api'
You will see:
kubectl -n shop rollout undo deploy/shop-api
What it means: Undo.
4. Automate and verify
Step 7: GitOps option
Why: Argo sync. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: gitops. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: g1
Type this:
echo 'Prefer updating the overlay tag in git and letting Argo sync'
You will see:
Prefer updating the overlay tag in git and letting Argo sync
What it means: GitOps.
Example 20: g2
Type this:
echo 'Same SHA appears in git history and in the cluster'
You will see:
Same SHA appears in git history and in the cluster
What it means: Audit.
Example 21: g3
Type this:
echo 'Capstone accepts either kubectl set image or Argo'
You will see:
Capstone accepts either kubectl set image or Argo
What it means: Either.
Step 8: Secrets
Why: No keys in CI. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: secrets. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: h1
Type this:
printf '%s\n' 'OIDC to cloud roles' 'External Secrets for app runtime' > /tmp/cap97/SEC.txt && cat /tmp/cap97/SEC.txt
You will see:
OIDC to cloud roles
What it means: Sec.
Example 23: h2
Type this:
echo 'Never print secrets in CI logs'
You will see:
Never print secrets in CI logs
What it means: Logs.
Example 24: h3
Type this:
echo 'Short-lived tokens only'
You will see:
Short-lived tokens only
What it means: TTL.
Step 9: Definition of done
Why: Checklist. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: dod. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: i1
Type this:
printf '%s\n' 'CI green, scan clean, SHA live, smoke 200, dashboard quiet' > /tmp/cap97/DOD.txt && cat /tmp/cap97/DOD.txt
You will see:
CI green, scan clean, SHA live, smoke 200, dashboard quiet
What it means: DoD.
Example 26: i2
Type this:
echo 'Write the SHA in the release notes'
You will see:
Write the SHA in the release notes
What it means: Notes.
Example 27: i3
Type this:
echo 'Keep the rollback command ready in the chat'
You will see:
Keep the rollback command ready in the chat
What it means: Rollback ready.
5. Harden and accept
Step 10: Story Swiggy
Why: Bengaluru lesson. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: j1
Type this:
printf '%s\n' 'At Swiggy in Bengaluru, every team had a different path to prod.' 'Ravi standardized build-scan-push-deploy-monitor.' > /tmp/cap97/STORY.txt && wc -l /tmp/cap97/STORY.txt
You will see:
2 /tmp/cap97/STORY.txt
What it means: Story.
Example 29: j2
Type this:
echo 'Rough cost: about Rs 45 lakh across a messy release week.'
You will see:
Rough cost: about Rs 45 lakh across a messy release week.
What it means: Cost.
Example 30: j3
Type this:
echo 'Ravi: PASS'
You will see:
Ravi: PASS
What it means: Sign-off.
Step 11: Proof
Why: Files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: k1
Type this:
ls /tmp/cap97
You will see:
NOTES.txt\nSTORY.txt\nACCEPT.txt
What it means: Tree.
Example 32: k2
Type this:
test -f /tmp/cap97/ACCEPT.txt && echo ACCEPT_OK
You will see:
ACCEPT_OK
What it means: Accept present.
Example 33: k3
Type this:
echo 'Next: Disaster recovery two regions project 98'
You will see:
Next: Disaster recovery two regions project 98
What it means: Bridge.
Step 12: Acceptance
Why: Golden path works once. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: z1
Type this:
echo 'CI green'
You will see:
CI green
What it means: A.
Example 35: z2
Type this:
echo 'SHA on EKS'
You will see:
SHA on EKS
What it means: B.
Example 36: z3
Type this:
echo 'Grafana traffic'
You will see:
Grafana traffic
What it means: C.
Check yourself
Q1. Who standardized Swiggy path?
Ravi
Q2. Registry?
ECR
Q3. Cluster?
EKS
Q4. Tag style?
SHA
Q5. latest OK?
no
Q6. Prove with?
Grafana
Friends, you ran the golden path. Did you understand? Let us try it once more. Change a log line, push, and prove the new SHA is live with metrics up.
मित्रांनो, तुम्ही golden path चालवला. Log line बदला, push करा, नवीन SHA live आणि metrics up हे सिद्ध करा.
दोस्तों, आपने golden path चलाया. Log line बदलें, push करें, नया SHA live और metrics up साबित करें.
Lab: try at home
- CI green.
- Image in ECR.
- EKS rolling.
- Grafana moves.
Recap
- One path to prod.
- Scan before push.
- SHA deploys.
- Monitor after.
- Rollback by SHA.