Pulumi AWS IaC groundwork (EKS)#4
Closed
ryanntannn wants to merge 1 commit into
Closed
Conversation
Lays the IaC foundation under infra/pulumi/. EKS-based (user is OK with EKS), keeping the rest self-managed per the 'avoid managed services except S3' stance. - EKS cluster (@pulumi/eks) + managed node group + EBS CSI + OIDC provider - IRSA roles for the apiserver + runner SAs scoped to the S3 bucket ARNs (no static S3 keys — the keyless path that pairs with presigned URLs) - S3 buckets (models/weather/results) with lifecycle TTL, SSE, versioning - Self-managed: in-cluster Postgres on a gp3 EBS PV (not RDS), GHCR pull secret (not ECR), ingress-nginx (ALB documented as option), k8s Secrets, KEDA - VPC/subnets/NAT, synergyplus-env Secret + SAs, deploy runbook + honest managed-vs-self-managed trade-offs (you own Postgres HA/backups, k8s patching) Groundwork only: typechecks (tsc --noEmit); no pulumi up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019p51SPdbrjmGXJVeZnwTrD
ryanntannn
pushed a commit
that referenced
this pull request
Jun 25, 2026
A cloud-native counterpart to the self-managed infra/pulumi (PR #4): EKS + Karpenter, Aurora PostgreSQL Serverless v2 (replaces in-cluster Postgres), ECR, AWS LB Controller + ALB + ACM + Route53/ExternalDNS, Secrets Manager + External Secrets, AMP + Managed Grafana + CloudWatch, SES, IRSA, KMS. KEDA stays. Groundwork only — tsc --noEmit clean; no pulumi up. README carries the flipped decision table + an honest self-managed-vs-cloud-native comparison. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019p51SPdbrjmGXJVeZnwTrD
Contributor
Author
|
will do this in a private repo |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pulumi (TypeScript) groundwork to deploy SynergyPlus on AWS, under
infra/pulumi/. EKS-based (per your go-ahead), keeping the rest self-managed per the "avoid managed services except S3" stance.@pulumi/eks) + managed node group + EBS CSI + OIDC providersynergyplus-envSecret + SAs, deploy runbook + an honest managed-vs-self-managed decision tableStatus
Groundwork — typechecks clean (
tsc --noEmit);pulumi upnot run (no AWS spend). Honest liabilities documented: single-replica Postgres / you own backups, HA, and k8s patching.Decision table
EKS = managed (with IRSA + EBS CSI as the EKS-native companions used); everything else self-managed. Full table in
infra/pulumi/README.md.🤖 Generated with Claude Code