RM

DevOps with Ritej

3D Cloud Architecture Platform • devopswithritej.online
Executive Portfolio 15-Week Roadmap
Interactive 3D WebGL Spatial Canvas

Enterprise Cloud Infrastructure in 3D.
Official AWS Service Nodes, Real Architecture & Data Beams.

Explore a realistic three-dimensional spatial cloud topology. Instead of abstract blocks, each node represents an authentic AWS service with high-resolution iconography, status beacons, and live animated traffic beams.

CloudFront & WAF ALB Load Balancer Amazon EKS ElastiCache Redis RDS PostgreSQL
AWS SERVICE TOPOLOGY

Amazon EKS Cluster

Production Kubernetes cluster across 3 Availability Zones with automated Pod autoscaling, cert-manager TLS, and Ingress routing.

Click node to inspect comprehensive engineering dossier
Left Click + Drag to Orbit • Right Click to Pan • Scroll to Zoom
Technical Engineering Specifications

Production Architectural Dossiers

Deep-dive, comprehensive architectural guides. Real production configurations, failure modes, zero-downtime Canary switches, and infrastructure as code implementations.

AWS Compute • Container Orchestration

Amazon EKS Production Topology & Pod Disruption Budgets

Hardened AWS EKS cluster spanning multiple Availability Zones. Implements AWS VPC CNI for native IP routing, topology spread constraints for anti-affinity rack protection, and Horizontal Pod Autoscaling (HPA) integrated with CloudWatch metrics.

High-Availability Control Plane & Worker Nodes

  • Managed EKS Control Plane: Automatic multi-AZ redundancy with automated etcd encryption and Raft quorum consistency across three AWS regions.
  • AWS VPC CNI Plugin: Assigns VPC IP addresses directly to Pod ENIs, eliminating double-NAT packet overhead for microservice inter-communication.
  • Topology Spread Constraints: Uses topologyKey: topology.kubernetes.io/zone with maxSkew: 1 to guarantee even pod distribution across zones.
  • Pod Disruption Budgets (PDB): Guarantees minAvailable: 75% during cluster node upgrades and Karpenter auto-scaling drains.

Lifecycle Probes & Graceful Draining

  • Startup Probe: Guards slow-starting JVM/Node runtimes with failureThreshold: 30 and periodSeconds: 5, preventing premature pod termination.
  • Readiness Probe: Tests endpoint health on /healthz/ready. Removes degraded pods from ALB target groups in under 3 seconds.
  • Graceful Draining Hook: Executes preStop: sleep 15 to allow ALB target groups time to deregister connections before sending SIGTERM.
  • Resource Quotas & Limits: Guarantees Quality of Service (QoS) class Guaranteed for mission-critical core transactional APIs.
k8s/production-deployment.yaml Amazon EKS v1.28+ 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-processing-api
  namespace: production
  labels:
    app.kubernetes.io/name: order-api
    app.kubernetes.io/part-of: cloud-platform
spec:
  replicas: 6
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0
  selector:
    matchLabels:
      app: order-api
  template:
    metadata:
      labels:
        app: order-api
    spec:
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: order-api
      containers:
        - name: app
          image: 60091670961.dkr.ecr.us-east-1.amazonaws.com/order-api:v2.4.1
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
            limits:
              cpu: "2000m"
              memory: "2Gi"
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 3
          livenessProbe:
            httpGet:
              path: /health/live
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 15"]
AWS Networking • Edge Routing

Zero-Downtime Weighted Canary Deployments with AWS ALB

Progressively route user traffic between Blue (Stable) and Green (Canary) fleets using AWS Application Load Balancers. Monitors error rate thresholds and latency to execute automated instantaneous rollbacks in < 2 seconds.

Canary Shift Stages & Rollback Triggers

  • Phase 1 (Synthetic Probe): Deploy Green target group with 0% public traffic. Execute automated integration smoke tests against internal ALB listeners.
  • Phase 2 (5% Canary): Route 5% of incoming live user requests to Green. Monitor HTTP 5xx error rates and P99 latency.
  • Phase 3 (Progressive Expansion): Scale weights to 25%, 50%, and 100% if error rate remains below 0.01% over a 15-minute observation window.
  • Instant Automated Rollback: If CloudWatch alarms fire (HTTP 500 > 1%), ALB listener weight snaps immediately back to 100% Blue in under 2 seconds.

Connection Draining & TLS Termination

  • Deregistration Delay: Setting ALB connection draining to 300 seconds, ensuring in-flight customer checkout transactions finish before container shutdown.
  • Session Affinity (Sticky Sessions): Managed via Application-generated cookies to maintain stateful shopping cart sessions where required.
  • AWS Load Balancer Controller: Automatically maps Kubernetes Ingress manifests to AWS ALB Target Groups with zero manual configuration.
terraform/alb-canary-weighted-routing.tf Terraform AWS Provider v5.x 
resource "aws_lb_listener_rule" "canary_routing" {
  listener_arn = aws_lb_listener.https_443.arn
  priority     = 100

  action {
    type = "forward"
    forward {
      target_group {
        arn    = aws_lb_target_group.blue_stable.arn
        weight = 90
      }
      target_group {
        arn    = aws_lb_target_group.green_canary.arn
        weight = 10
      }
      stickiness {
        enabled  = true
        duration = 300
      }
    }
  }

  condition {
    path_pattern {
      values = ["/api/v1/*"]
    }
  }
}
Infrastructure as Code • Cloud Provisioning

Modular Multi-Region Terraform Architecture with State Locking

Production IaC framework engineered with HashiCorp Terraform and Terragrunt. Isolates blast radiuses by decoupling VPC networks, EKS clusters, and RDS databases into distinct state files locked with Amazon DynamoDB and encrypted with AWS KMS.

State Security & Blast Radius Isolation

  • Decoupled State Files: Never store an entire company's infrastructure in a single monolithic state file. Splitting into networking, compute, and data layers prevents cascading teardowns.
  • DynamoDB Locking: Implements LockID hashing to block concurrent CI/CD pipeline runs from modifying state simultaneously.
  • KMS Server-Side Encryption: Encrypts state buckets at rest with customer-managed keys (CMK) with strict IAM key rotation policies.

Automated Drift Detection & Audit

  • Scheduled Drift Pipelines: Daily cron runners execute terraform plan -detailed-exitcode. Exit code 2 triggers high-priority alerts to Slack.
  • Pre-Commit Checkov & Tfsec: Static analysis checks run before code reviews, rejecting unencrypted S3 buckets or open 0.0.0.0/0 security group rules.
  • Terragrunt DRY Hierarchy: Centralizes root backend configurations and environment variables across dev, staging, and prod.