$whoami
← All projects
AWS · EKS · Pulumishipped

Reusable EKS Platform

Golden-path cluster provisioning with reusable Pulumi components, IAM/OIDC, and multi-environment patterns.

View on GitHub →Discuss this project
$cat problem.md

Problem

Each team provisioned EKS clusters differently — inconsistent IAM, tagging, node groups, and onboarding timelines measured in weeks.

$cat solution.md

Solution

Standardized Pulumi component library with self-service portal, environment patterns (dev/stage/prod), and CI/CD validation gates for cluster add-ons.

$cat how-it-works.md

How it works

1

Pick a pattern

Developer selects dev/stage/prod pattern from portal — sizing, networking, and compliance pre-configured.

2

Pulumi deploys

Component stack provisions EKS, OIDC, node groups, and baseline add-ons in one apply.

3

CI validates

GitHub Actions runs conformance checks; cluster registered in platform catalog with runbooks.

System architecture

Dev PortalPulumiCI/CDEKSIAMOIDC

Developer portal → Pulumi component stacks → EKS with standardized IAM/OIDC, node groups, Fargate profiles, and enforced tagging policies.

Operations dashboard

eks-platform · cluster dashboard

Clusters

12

Onboarding

2.1h

Policy pass

100%

Active stacks

platform-team-dev · DEPLOYED

payments-prod · DEPLOYED

analytics-stage · UPDATING

Operational dashboard — request queue, agent status, and audit trail
Deployment flow

01

Portal

Golden path select

02

Pulumi

Component stack

03

EKS

Cluster + OIDC

04

Helm

Add-ons deploy

05

Catalog

Hand off to team

Implementation details

  • Pulumi ComponentResource abstractions for node groups, Fargate, and IRSA roles
  • Cross-account IAM roles with separate state backends per environment
  • Policy-as-code validation at `pulumi preview` using OPA/conftest
  • Platform catalog API tracks cluster metadata, owners, and runbook links

Proof of work

eks-platform.log
$ pulumi up --stack platform-team-dev
→ eks.Cluster: created (v1.29)
→ iam.OidcProvider: configured · IRSA ready
→ node.NodeGroup: 3x m6i.large · SPOT optional
→ addons: vpc-cni, coredns, kube-proxy, aws-lb-controller
→ tags: env=dev team=platform cost-center=eng
preview: 23 resources · policy: PASS
status: DEPLOYED · onboarding: 2.1 hours
Pulumi stack output — standardized EKS cluster with OIDC and add-ons.

Workflow

  1. 1

    Select golden path

    Developer picks environment pattern and team workspace from self-service portal.

  2. 2

    Provision stack

    Pulumi deploys EKS cluster, OIDC provider, node groups, and baseline add-ons (CNI, metrics, ingress).

  3. 3

    Validate & hand off

    CI pipeline runs conformance checks; cluster registered in platform catalog with runbooks.

Golden path design

Environment patterns

Pre-defined dev/stage/prod configs with sizing, networking, and compliance tiers.

Reusable modules

Node groups, Fargate profiles, IAM roles, and OIDC bindings as versioned components.

Multi-account landing

Cross-account roles and state backends for isolated prod vs non-prod workloads.

Design decisions

  • Composable Pulumi components — not monolithic stacks — for team-level customization
  • OIDC federation baked in for IRSA from day one
  • Tagging policy enforced at plan time, not post-hoc
  • Separate state per environment with shared module versions

Inputs

Environment configTeam IAM rolesNetwork CIDRAdd-on catalog

Outputs

EKS clusterOIDC providerStandardized tagsPlatform catalog entry

Tech stack

PulumiAWS EKSGitHub ActionsHelmArgoCD

Impact

Weeks → days

Cluster onboarding time

12

Teams on golden path

0

Manual IAM/OIDC setup steps