~/ nmadiraju.com Amazon EKS · Cartwright on EKS
arrow_back Back to nmadiraju
Architecture Explorer · Delivery and operations

Cartwright on EKS: One Enterprise App, End to End

Cartwright is a sample online store with ten services. Click any part to see what it does and what breaks without it, then follow one change from Dana's laptop to prod.

Cartwright in 60 seconds

  • Cartwright is a sample online store. Ten services on Amazon EKS, AWS's managed Kubernetes. Every change ships one way: through Git.
  • Three repos, three jobs. App repos hold code, the config repo says what each environment runs, the IaC (infrastructure as code) repo builds AWS.
  • CI builds, Argo CD deploys. CI tests and signs the image, then commits its tag to Git. Argo CD makes each cluster match Git.
  • Isolation where it counts. Each environment gets its own AWS account and cluster. Each service gets a namespace, a cheap boundary.
  • Only through Git and the gates. Staging after tests, prod after one approval. A hand edit with kubectl is drift; Argo CD undoes it.

1Explore Cartwright

Cartwright on EKS: repos, CI, the shared platform account, two gates and one account and cluster per environment Left, Dana the developer and Lee the release manager. Next, Git with three repos: the orders app repo, the config repo with a tag per environment, and the Terraform IaC repo. In the middle, CI with its checks, the shared platform account with Amazon ECR and the Argo CD hub, and the platform add-ons. Then two gates: tests before staging and Lee's approval before prod. Right, three AWS accounts, each with its own EKS cluster: dev with PR preview namespaces, staging, and prod, with the checkout path inside the cluster: ALB, BFF, orders, inventory and payments, one namespace each. Dana developer Lee release manager GIT · THREE REPOS app repo cartwright-orders config repo what each env should run IaC repo Terraform accounts · VPCs · clusters data stores · ECR · IAM CI · per service last step: a tag commit PLATFORM ACCOUNT Amazon ECR signed, scanned images Argo CD hub syncs dev, staging, prod from the config repo Platform add-ons Karpenter · Pod Identity External Secrets · Kyverno ALB Controller · AMP+AMG Into staging gate: tests pass in dev first Into prod gate: Lee approves DEV ACCOUNT EKS cartwright-dev syncs on every merge PR previews a namespace per PR removed on merge/close STAGING ACCOUNT EKS cartwright-stg tested here before prod PROD ACCOUNT · us-east-1 + eu-west-1 EKS cartwright-prod ×2 one cluster per Region, multi-AZ ONE NAMESPACE PER SERVICE + 6 more services, a namespace each ALB BFF orders inventory payments

    2Trace the change: check yourself

    Check yourself