---

DevSecOps Infrastructure (Terraform + EKS + Ansible)

Infrastructure-as-code to stand up a Jenkins-centric toolchain VPC, EC2 hosts (Jenkins/Nexus/SonarQube), and an EKS cluster with ordered addon deployment matching the observed eksctl flow from the GitHub wiki.

What this deploys

• VPC with public/private subnets, IGW, route tables, and Kubernetes-ready subnet tags.
• Security groups for Jenkins, Nexus, and SonarQube.
• EC2 instances for Jenkins, Nexus, and SonarQube plus an SSH keypair written locally (jenkins-key.pem).
• EKS cluster (secure-shop-eks) with a managed node group and addons sequenced as: control-plane/network (eks-pod-identity-agent, vpc-cni, kube-proxy, coredns) then node-dependent (aws-ebs-csi-driver, metrics-server).
• Generated artifacts: Ansible inventory (ansible/inventory/hosts.ini) and PEM keys for EC2 and EKS worker SSH access.

Prerequisites

• Terraform >= 1.5
• AWS CLI configured with credentials and default region (or set AWS_PROFILE/AWS_REGION)
• kubectl (to interact with the EKS cluster)
• Optional: eksctl (for cross-checking with jenkins-eks-cluster.yaml)

Step-by-step execution guide

1) Prepare

• Clone the repo and cd into it (Terraform files are at repo root; Ansible under ansible/).
• Configure the AWS CLI with valid credentials and default region (aws configure) or set AWS_PROFILE/AWS_REGION.
• (Optional) Update variables.tf defaults or provide overrides via terraform.tfvars / -var.

2) Provision infrastructure with Terraform

terraform init
terraform plan -out=tfplan   # recommended to lock the apply plan
terraform apply tfplan

Key outputs: VPC, subnets/route tables/IGW, security groups, EC2 hosts (Jenkins/Nexus/SonarQube) with jenkins-key.pem, EKS cluster secure-shop-eks + node group, addons ordered as per eksctl run, generated Ansible inventory at ansible/inventory/hosts.ini.

3) Configure servers with Ansible

Run Ansible from the repo root (inventory is generated under ansible/ from Terraform):

ansible-galaxy install -r ansible/requirements.yml
ansible-playbook -i ansible/inventory/hosts.ini ansible/site.yml

Roles executed: common, jenkins, nexus, sonarqube.

4) Validate EKS

aws eks update-kubeconfig --name secure-shop-eks --region us-east-1
kubectl get nodes
kubectl get pods -A

Ensure node(s) are Ready and core addons are Running before deploying workloads.

Alternative kubeconfig (Terraform-rendered):

terraform output -raw secure_shop_eks_kubeconfig > kubeconfig_secure_shop
export KUBECONFIG=$PWD/kubeconfig_secure_shop
kubectl config use-context secure-shop-eks
kubectl get nodes

This avoids mutating your default kubeconfig and uses the template output directly.

Key artifacts and outputs

• PEM keys: jenkins-key.pem and jenkins-cluster-key.pem written locally with 0400 permissions.
• Ansible inventory: ansible/inventory/hosts.ini generated with public IPs for Jenkins/Nexus/SonarQube.
• EKS kubeconfig (template output): see secure_shop_eks_kubeconfig output for a rendered config using templates/kubeconfig.tpl.
• All outputs: terraform output after apply.

Addon ordering (matches eksctl log)

• Control plane/network installed with the EKS module: eks-pod-identity-agent, vpc-cni, kube-proxy, coredns.
• Node-dependent addons applied after the node group is Ready via aws_eks_addon: aws-ebs-csi-driver, metrics-server.

Execution example screenshots

Expected deliverables are captured under Excution Example Screenshot/:

• 
• 
• 
• 
• 

Cleanup

terraform destroy

This will remove the VPC, EC2 hosts, EKS cluster, and generated local keys/inventory.

For more architectural notes and diagrams, see the GitHub wiki: https://github.com/dx1004/DevSecOps-Infrastructure/wiki