Built a multi-stage Jenkins pipeline integrating Sonar- Qube (static code analysis), Trivy (filesystem and Docker image security scanning), Docker image build/tag/push, and automated deployment to a Terraform-provisioned EKS cluster with an ALB load balancer; monitored full application stack using Prometheus and Grafana.
Automated CI/CD pipeline that takes application code from GitHub commit all the way to production deployment on AWS EKS, with security scanning, code quality checks, and monitoring.
| Category | Tools |
|---|---|
| CI/CD | Jenkins |
| Security Scan | Trivy (filesystem + image) |
| Code Quality | SonarQube |
| Build | Maven |
| Containerization | Docker |
| Registry | Docker Hub (private repo) |
| Infrastructure | Terraform |
| Orchestration | AWS EKS (Kubernetes) |
| Monitoring | Prometheus + Grafana |
| Artifact Store | Nexus |
- Developer pushes code to GitHub
- Jenkins pipeline triggers automatically via webhook
- Code compiled with Maven (catches syntax errors early)
- Unit tests executed
- Trivy scans filesystem for vulnerabilities
- SonarQube checks code quality and coverage
- Maven builds JAR file
- Docker image built
- Trivy scans Docker image for CVEs
- Image pushed to private Docker Hub repository
- Application deployed to AWS EKS cluster
- Deployment verified with health check stage
- Email notification sent on success/failure
- VPC with CIDR
- 2 public subnets
- Internet Gateway + Route Tables
- EKS Cluster (control plane managed by AWS)
- Node Group with 1 worker node (t3.medium)
- IAM Roles for cluster and node group
- Security Groups for cluster and nodes
- Deployment with 2 pod replicas
- LoadBalancer service (AWS NLB provisioned automatically)
- Service Account + RBAC for Jenkins to authenticate to EKS
- Image pull secret (regcred) for private Docker Hub access
- App exposed on port 80 → pod port 8080
- Prometheus scrapes metrics every 15 seconds
- Grafana dashboards for CPU, memory, request rate
- Blackbox exporter for endpoint uptime monitoring
- AWS Account with appropriate IAM permissions
- Jenkins server running
- Docker installed
- Terraform installed
- kubectl installed
cd terraform/ terraform init terraform plan terraform apply
aws eks --region eu-central-1 update-kubeconfig --name
- Add credentials: Docker Hub, SonarQube token, K8s service account token
- Install plugins: SonarQube Scanner, Kubernetes, Docker Pipeline, Maven
Trigger Jenkins pipeline — it runs all stages automatically
- Implemented DevSecOps — security scanning at both code and image level, not as an afterthought
- Used Terraform for reproducible infrastructure — entire EKS cluster can be recreated with one command
- RBAC-based Jenkins-to-Kubernetes authentication using service account tokens — no hardcoded credentials
- Private image registry with Kubernetes image pull secrets