⚙️ CI/CD Pipeline — AWS EKS Deployment

An end-to-end CI/CD pipeline that builds, scans, and deploys a Spring Boot application to Kubernetes on AWS.
Jenkins · Docker · Trivy · Kubernetes · AWS EKS

---

Overview

A production-grade CI/CD pipeline that automates the entire software delivery lifecycle — from source code to a running application on AWS EKS. The pipeline integrates security scanning as a first-class step, failing the build on HIGH/CRITICAL vulnerabilities before any image reaches production.

Built to demonstrate DevOps best practices: infrastructure as code, container security, automated deployments, and zero-downtime rollouts.

---

Pipeline Architecture

┌──────────────┐     Webhook      ┌──────────────────────────────────────────────┐
│   GitHub     │ ────────────────▶│              Jenkins Server                  │
│   (Source)   │                  │              (AWS EC2)                        │
└──────────────┘                  │                                              │
                                  │  ┌─────────┐  ┌─────────┐  ┌────────────┐  │
                                  │  │ Stage 1  │  │ Stage 2  │  │  Stage 3   │  │
                                  │  │ Checkout │─▶│  Maven   │─▶│  Docker    │  │
                                  │  │  Source  │  │  Build   │  │  Build     │  │
                                  │  └─────────┘  └─────────┘  └─────┬──────┘  │
                                  │                                    │         │
                                  │  ┌─────────┐  ┌─────────────────┐ │         │
                                  │  │ Stage 5  │  │    Stage 4      │ │         │
                                  │  │  Push    │◀─│  Trivy Scan     │◀┘         │
                                  │  │ DockerHub│  │  (Security)     │           │
                                  │  └────┬─────┘  └─────────────────┘           │
                                  └───────┼──────────────────────────────────────┘
                                          │
                                          ▼
                                  ┌───────────────┐
                                  │  Docker Hub   │
                                  │  (Registry)   │
                                  └───────┬───────┘
                                          │
                                          ▼
                                  ┌───────────────────────────────┐
                                  │        AWS EKS Cluster        │
                                  │  ┌─────────────────────────┐  │
                                  │  │  Deployment (1 replica)  │  │
                                  │  │  ┌───────────────────┐   │  │
                                  │  │  │  Spring Boot App  │   │  │
                                  │  │  │  (Port 8080)      │   │  │
                                  │  │  └───────────────────┘   │  │
                                  │  └─────────────────────────┘  │
                                  │  ┌─────────────────────────┐  │
                                  │  │  Service (LoadBalancer) │  │
                                  │  │  Port 80 → 9966        │  │
                                  │  └─────────────────────────┘  │
                                  └───────────────────────────────┘

---

CI/CD Workflow

Stage	Tool	Action
1. Checkout	Git	Pull source code from GitHub via webhook trigger
2. Build	Maven	Compile Java source and package as JAR (mvn clean package)
3. Containerize	Docker	Build production image with Eclipse Temurin JRE 21
4. Security Scan	Trivy	Scan image for vulnerabilities — fail on HIGH/CRITICAL
5. Push	Docker Hub	Push verified image to container registry
6. Deploy	kubectl	Apply Kubernetes manifests to AWS EKS cluster

Security Gate

The pipeline enforces a two-tier vulnerability scan:

✅ LOW + MEDIUM  →  Logged as warnings (build continues)
🚫 HIGH + CRITICAL →  Build fails immediately (image never pushed)

This ensures no container with known critical vulnerabilities reaches production.

---

Tech Stack

Component	Technology	Purpose
Application	Java 21, Spring Boot	REST API (Spring Petclinic)
CI Server	Jenkins	Pipeline orchestration
Containerization	Docker	Application packaging
Security	Trivy (Aqua Security)	Container vulnerability scanning
Registry	Docker Hub	Image storage and distribution
Orchestration	Kubernetes (AWS EKS)	Container orchestration
Cloud	AWS EC2 + EKS	Infrastructure hosting
Build Tool	Maven	Java dependency management and build

---

Project Structure

├── Jenkinsfile              # Declarative CI pipeline (5 stages)
├── Dockerfile               # Multi-stage Docker image (JRE 21)
├── k8s/
│   ├── deployment.yaml      # Kubernetes Deployment (1 replica)
│   └── service.yaml         # LoadBalancer Service (port 80 → 9966)
├── diagrams/
│   └── cicd-architecture.png
└── screenshots/
    ├── jenkins-pipeline-success.png
    ├── trivy-scan-stage.png
    └── swagger-ui-running.png

---

Pipeline Stages in Detail

Jenkinsfile Highlights

// Security scan — blocks deployment on critical vulnerabilities
stage('Trivy Image Scan') {
    steps {
        sh """
          // Pass: LOW & MEDIUM (informational only)
          trivy image --exit-code 0 --severity LOW,MEDIUM ${IMAGE}

          // Fail: HIGH & CRITICAL (blocks pipeline)
          trivy image --exit-code 1 --severity HIGH,CRITICAL ${IMAGE}
        """
    }
}

Kubernetes Deployment

• Deployment: Single replica with rolling update strategy
• Service: LoadBalancer type exposing port 80 externally
• Image Pull: Pulls from Docker Hub on every deployment

---

Screenshots

Jenkins Pipeline — All Stages Passed

Trivy Security Scan

Application Running on EKS

---

Setup & Usage

Prerequisites

• AWS Account with EKS cluster configured
• Jenkins server (EC2 instance) with:
  • Docker installed
  • Maven installed
  • Trivy installed
  • kubectl configured for EKS
• Docker Hub account

Run the Pipeline

# 1. Fork/clone this repository
git clone https://github.com/pratheep-bit/ci-cd-pipeline.git

# 2. Configure Jenkins:
#    - Add Docker Hub credentials (ID: dockerhub-creds)
#    - Create pipeline job pointing to this repo
#    - Enable GitHub webhook trigger

# 3. Push code to trigger pipeline:
git push origin main

# 4. Deploy to EKS (after pipeline succeeds):
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml

# 5. Access the application:
kubectl get svc petclinic-service
# → Use the EXTERNAL-IP from LoadBalancer

---

Key Engineering Decisions

Decision	Rationale
Eclipse Temurin JRE 21	Lightweight, production-grade JRE — smaller attack surface than full JDK
Trivy as security gate	Open-source, fast, CI-native scanner with exit code control
Two-tier scan policy	Pragmatic approach — don't block on LOW/MEDIUM, hard-fail on critical
LoadBalancer service	Direct external access via AWS ELB — production-ready ingress
Declarative Jenkinsfile	Version-controlled pipeline, reproducible across environments

---

Future Enhancements

• Helm Charts — Templatize Kubernetes manifests for multi-environment deployments
• ArgoCD — GitOps-based continuous deployment with drift detection
• Horizontal Pod Autoscaler — Auto-scale based on CPU/memory thresholds
• Slack/Email Notifications — Alert on pipeline failures
• Multi-branch Pipeline — Separate CI for feature branches vs. main
• Terraform — Infrastructure as Code for EKS cluster provisioning

---

Built with precision by Pratheep