jansoltys9/jsappinf-platform-portfolio

# JSAPPINF – AWS EKS DevOps 平台实验室 JSAPPINF 是一个构建在 AWS EKS 之上的类生产环境 DevOps 平台实验室。 该项目展示了在基础设施即代码、Kubernetes、GitOps、安全 secrets 分发、应用部署、ingress、TLS、数据库集成以及运维故障排除方面的实际平台工程工作。 此仓库的目标是展示该项目经过脱敏处理的履历视图，不包含私有的凭证、Terraform state、特定环境的 secrets 或敏感的账户配置。 ## 平台可视化概述 关于平台基础设施、仓库分布、部署流程、职责边界和应用架构的可视化指南可在此处查看： [打开 JSAPP 平台可视化概述](docs/visual-platform-overview.md) ## 项目总结 该平台围绕 AWS EKS 构建，并使用 Terraform 进行配置。 ## 仓库模型 实际项目被特意拆分到多个仓库中。这反映了类生产环境的归属模型，即基础设施配置、应用源代码、Helm 打包和 GitOps runtime 配置是相互独立的。 | 仓库 | 用途 | 公开履历状态 | |---|---|---| | `terraform-modules` | 可复用的 Terraform 模块，例如 VPC、EKS、RDS、ECR 及其支持性基础设施模块。 | 私有真实仓库，仅作描述。 | | `jsappinf-platform` | 环境级别的基础设施组合、平台附加组件、组件注册表、IAM/IRSA、KMS、DNS、Gateway API、身份验证、数据库配置和边缘安全连接。 | 私有真实仓库，仅作描述。 | | `JSAPP` | 用于 UI、user、product 和 order 服务的 Node.js 微服务源代码。GitLab CI 构建不可变镜像并将其推送到 AWS ECR。应用程序拥有数据库契约、发布者和消费者。 | 私有真实仓库，仅作描述。 | | `helmchartsappjs` | 用于 JSAPP 服务的可复用 Helm charts，包括 deployments、services、Gateway API 路由、调度、探针和 runtime 配置。 | 私有真实仓库，仅作描述。 | | `jsappinf-gitops` | ArgoCD 期望的 runtime 状态、app-of-apps 模型、平台应用程序、ExternalSecrets 和特定于环境的部署配置。 | 私有真实仓库，仅作描述。 | | `jsappinf-platform-portfolio` | 用于履历和 LinkedIn 展示的脱敏公开文档仓库。它不包含 secrets、Terraform state、私有凭证或敏感的账户配置。 | 公开履历仓库。 | 私有仓库包含实际的实现。这个公开的履历仓库记录了架构、工作流和决策，而不会暴露敏感的项目数据。 ## GitLab 与 GitHub 发布模型 实际的实现仓库在 GitLab 中保持私有。 GitLab 被用作主要的工作平台，用于： ``` real infrastructure code real application source code real Helm charts real GitOps manifests real CI/CD pipelines private project history ``` 公开的 GitHub 仓库是刻意经过脱敏处理的，并以文档为中心。 GitHub 被用作公开的履历层，用于： ``` architecture overview repository ownership model GitOps deployment flow secrets delivery model multi-environment strategy edge security design capacity planning notes LinkedIn Featured project link ``` 这种分离是刻意为之的。 ``` GitLab: private implementation and day-to-day engineering work GitHub: public portfolio documentation without sensitive data ``` 公开仓库不包含： ``` Terraform state backend configuration tfvars files private credentials tokens real secret values AWS account-specific identifiers private pipeline variables sensitive GitOps repository secrets ``` 这使得项目可以被公开展示，同时保护真实的实现和操作细节。 ## 文档 详细的履历文档可在 `docs/` 目录中找到。 ``` docs/infrastructure-overview.md High-level AWS, EKS, networking, platform add-ons and application architecture. docs/gitops-deployment-flow.md GitLab CI, ECR, Helm, ArgoCD and Kubernetes rollout flow. docs/repository-ownership-model.md Repository responsibility boundaries across Terraform, application code, Helm and GitOps. docs/secrets-flow.md AWS Secrets Manager, External Secrets Operator and Kubernetes runtime secret delivery. docs/multi-env-and-account-strategy.md Planned dev/stage/prod-like environment model and lightweight AWS account strategy. docs/edge-security-cloudfront-waf.md CloudFront + AWS WAF edge security direction and clean public routing model. docs/karpenter-capacity-flow.md Optional Karpenter ON_DEMAND/SPOT capacity validation model. docs/foundation-and-lightweight-landing-zone-strategy.md Foundation-layer and lightweight Landing Zone strategy for multi-environment growth. docs/component-responsibility-matrix.md Component ownership, repository boundaries, Terraform state ownership and lifecycle classification. docs/platform-architecture.md Current validated AWS platform architecture, routing, identity, messaging, database and lifecycle design. docs/cross-cloud-platform-equivalence-strategy.md AWS, Azure and Google Cloud equivalence strategy and portable platform boundaries. ``` 它包括： ``` AWS VPC AWS EKS Managed node groups AWS ECR AWS RDS PostgreSQL RDS application-provisioner Lambda RabbitMQ application messaging Amazon Cognito AWS Secrets Manager AWS KMS responsibility model Route 53 DNS cert-manager External Secrets Operator AWS Load Balancer Controller Kubernetes Gateway API ArgoCD Helm-based application deployment GitLab CI/CD image build flow Node.js microservices optional Karpenter capacity model CloudFront + AWS WAF edge security design ``` 应用层由多个 Node.js 微服务组成： ``` ui-service user-service product-service order-service ``` 从 UI 到内部服务再到 PostgreSQL 支持的持久化的完整应用流程已得到验证。 ## 高层架构 ``` Developer / Operator -> GitLab repositories -> Terraform infrastructure code -> AWS account -> VPC -> EKS -> Platform add-ons -> ArgoCD -> Helm applications -> JSAPP microservices | +--> RDS PostgreSQL +--> RabbitMQ messaging +--> Secrets Manager through External Secrets +--> Cognito identity and JWT contract ``` 核心平台组件： ``` Terraform: provisions infrastructure and platform foundations VPC: provides public and private networking EKS: runs platform components and application workloads ArgoCD: reconciles GitOps desired state into Kubernetes External Secrets Operator: syncs runtime secrets from AWS Secrets Manager into Kubernetes cert-manager: manages TLS certificates where required AWS Load Balancer Controller: provisions and manages the Application Load Balancer integration Kubernetes Gateway API: defines Gateway and HTTPRoute application routing RDS PostgreSQL: provides application database persistence RDS application-provisioner Lambda: creates or reconciles service users, schemas, grants and generated credentials RabbitMQ: delivers the validated order.created event from order-service to product-service Amazon Cognito: provides the validated identity infrastructure, PKCE flow and JWT contract; direct UI and backend application integration remains planned ECR: stores immutable service container images ``` ## GitOps 部署流程 预期的部署模型将基础设施配置与应用程序交付分离开来。 ``` Application source change -> GitLab CI pipeline -> Docker image build -> Push image to AWS ECR -> Helm chart / values update -> GitOps desired state update -> ArgoCD sync -> Kubernetes rollout ``` 应用程序不会作为主要工作流使用 `kubectl` 进行手动部署。 首选的工作流是基于 Git 的，并由 ArgoCD 进行协调。 ## 仓库归属模型 该项目被拆分到多个仓库中，以反映类生产环境的职责边界。 ``` terraform-modules: reusable Terraform modules such as VPC, EKS, RDS and future modules jsappinf-platform: environment wiring, platform add-ons, Terraform composition and standards JSAPP: Node.js application source code, Dockerfiles and CI build logic helmchartsappjs: Helm charts, templates, service values and workload deployment shape jsappinf-gitops: ArgoCD Applications, app-of-apps structure and runtime desired state ``` 这种拆分分离了： ``` infrastructure lifecycle application build lifecycle Kubernetes packaging lifecycle runtime deployment lifecycle secret delivery model platform standards ``` ## Secrets 管理 原始 secret 值不存储在 GitOps 清单中。 runtime 的数据库 secret 模型是： ``` Terraform -> RDS application-provisioner Lambda -> service database users, schemas and grants -> generated credentials in AWS Secrets Manager -> External Secrets Operator -> Kubernetes Secret -> application pod environment variables -> RDS PostgreSQL login ``` 配置器拥有数据库身份和权限。应用程序迁移和种子作业拥有表、索引和初始应用程序数据。 示例应用程序 secret 契约： ``` DB_HOST DB_PORT DB_NAME DB_USER DB_PASSWORD ``` 安全原则： ``` Base64 is encoding, not encryption. Do not store raw secret values in Git repositories. Do not document decoded Kubernetes Secret values. ``` ## 应用程序 Runtime 当前服务端口： ``` ui-service 3003 user-service 3000 product-service 3001 order-service 3002 ``` 已验证的同步应用功能： ``` Browser / UI -> ui-service | +--> user-service | -> users schema | +--> product-service | -> products schema | +--> order-service -> orders schema ``` 已验证的异步消息传递流程： ``` order-service -> publishes order.created -> RabbitMQ -> product-service consumer ``` 该应用程序验证了 Kubernetes 部署、内部服务发现、数据库连接、runtime secret 分发、Gateway API 路由以及从发布者到消费者的核心消息传递路径。 ## 边缘安全方向 已经设计了 CloudFront + AWS WAF 边缘安全层，并验证了其基础设施和切换工作流。 当前目标方向： ``` Internet -> CloudFront -> AWS WAF Web ACL -> Application Load Balancer -> AWS Load Balancer Controller -> Kubernetes Gateway API -> HTTPRoute -> JSAPP services ``` 以前的 NLB、ingress-nginx 和 Kubernetes Ingress 路径已被 ALB 和 Gateway API 模型取代。 当前实施状态： ``` CloudFront and AWS WAF infrastructure implemented ALB origin integration validated edge cutover workflow validated Gateway API application routing validated long-running edge exposure disabled when not required ``` 边缘层在开发环境中是经过刻意成本优化的。可以将其启用以进行验证和演示，而无需保持持续活动状态。 初始的 WAF 基线是刻意考虑成本的： ``` AWSManagedRulesCommonRuleSet AWSManagedRulesKnownBadInputsRuleSet basic rate-based rule no Bot Control initially no CAPTCHA initially no full WAF logging initially ``` ## 容量与成本感知的开发模式 该项目被设计为成本感知的开发环境。 正常开发模式： ``` lower baseline capacity daily rebuild/destroy workflow Karpenter disabled or idle by default SPOT burst disabled by default ``` 验证模式： ``` optional Karpenter testing ON_DEMAND and SPOT application placement stable/burst workload model NodePool and scheduling validation ``` 这使得该项目在保持实用性的同时，依然能展示类生产环境的容量设计。 ## 多环境方向 当前实现侧重于开发环境。 计划的演进： ``` dev: cost-aware daily rebuild profile stage: integration validation profile prod-sim: production-like simulation profile ``` 未来方向： ``` separate backend keys separate tfvars environment-specific naming and tags future AWS Organization account separation NonProd and ProdSim account boundaries light landing-zone-style standards ``` 目标不是过度设计该实验室，而是展示从单一开发平台走向多环境和感知账户的架构的现实路径。 ## 本项目展示的内容 该项目展示了对以下方面的实际经验： ``` AWS platform engineering Terraform infrastructure provisioning EKS platform setup Kubernetes workload deployment Helm chart management ArgoCD GitOps GitLab CI/CD ECR image delivery RDS PostgreSQL integration RabbitMQ order.created publisher-to-consumer messaging RDS application identity and secret provisioning Secrets Manager and External Secrets Operator Cognito PKCE and JWT validation Route 53 DNS and TLS automation ALB and Kubernetes Gateway API routing cost-aware environment lifecycle production-like architecture documentation operational troubleshooting ``` ## 履历说明 本仓库是 JSAPPINF 项目的脱敏履历展示。 它特意排除了： ``` Terraform state tfvars files backend configuration secret values tokens private credentials AWS account-specific sensitive configuration raw Kubernetes Secret values ``` 其目的是展示架构、推理、标准和实现方向，而不暴露敏感的基础设施细节。

标签：AWS EKS, ECS, GitOps, Helm, MITM代理, Terraform, 子域名突变