Scenario
You are the DevOps Engineer.
Jules is your Software Developer.
Ask Jules to create a professional website for a product of your choice. Jules is responsible for application development. You are responsible for the entire DevOps lifecycle.
The final result must be:
https://yourdomain.com
Enter fullscreen mode Exit fullscreen mode
The browser must display the name of your product.
Part 1 — Application Development
Jules acts as the developer.
The application must have:
Professional homepage
Product name
Multiple sections
Responsive design
Working application
Enter fullscreen mode Exit fullscreen mode
Application code must eventually be stored in your own GitHub repository.
Architecture begins:
Jules
↓
Application Code
↓
GitHub Repository
Enter fullscreen mode Exit fullscreen mode
Part 2 — AWS Infrastructure
Create a production-style AWS environment.
VPC
10.0.0.0/16
├── Public Subnet — us-east-1a
├── Public Subnet — us-east-1b
│
├── Private Subnet — us-east-1a
└── Private Subnet — us-east-1b
Enter fullscreen mode Exit fullscreen mode
The architecture must support:
Internet
↓
Internet Gateway
↓
Application Load Balancer
↓
Public Subnets
↓
Target Group
↓
ECS
↓
Private Subnets
Enter fullscreen mode Exit fullscreen mode
Private workloads must have appropriate outbound connectivity.
Create:
VPC
Public/private subnets
Route tables
Internet Gateway
NAT/outbound connectivity
Security groups
ECR repository
ECS cluster
ECS task definition
ECS service
Target group
Application Load Balancer
Enter fullscreen mode Exit fullscreen mode
Part 3 — Continuous Integration (CI)
CI starts when application code changes.
Use GitHub Actions for Continuous Integration.
Developer
↓
git push
↓
GitHub
↓
GitHub Actions
Checkout
↓
Install Dependencies
↓
Test
↓
SonarQube
↓
Docker Build
↓
Trivy Scan
↓
Authenticate to AWS
↓
Push Docker Image
↓
Amazon ECR
Enter fullscreen mode Exit fullscreen mode
CI responsibility
CI answers:
Is this application safe and ready to deploy?
The CI pipeline must perform:
Source code checkout
Dependency installation
Application tests
SonarQube code-quality analysis
Docker image build
Trivy vulnerability scanning
Docker image tagging
AWS authentication
ECR authentication
Push image to ECR
Enter fullscreen mode Exit fullscreen mode
Use versioned/immutable image tags such as:
product-name:a83fd91
Enter fullscreen mode Exit fullscreen mode
or:
product-name:v1.0.0
Enter fullscreen mode Exit fullscreen mode
Do not depend only on:
latest
Enter fullscreen mode Exit fullscreen mode
CI finishes here
GitHub
↓
GitHub Actions
↓
SonarQube
↓
Docker
↓
Trivy
↓
ECR
Enter fullscreen mode Exit fullscreen mode
Do not deploy to ECS inside the CI section.
Part 4 — Continuous Deployment (CD)
CD begins after a validated container image exists in ECR.
Use Jenkins for Continuous Deployment.
Amazon ECR
↓
Jenkins CD Pipeline
↓
New ECS Task Definition Revision
↓
ECS Service Update
↓
ECS Rolling Deployment
↓
Target Group Health Check
↓
Application Load Balancer
Enter fullscreen mode Exit fullscreen mode
CD responsibility
CD answers:
How do we safely release the approved application to the environment?
The Jenkins deployment should use the specific image produced by CI.
For example:
ECR
product-name:a83fd91
↓
Jenkins
↓
ECS Task Definition :7
↓
ECS Service
↓
Rolling Deployment
Enter fullscreen mode Exit fullscreen mode
During deployment, observe:
OLD VERSION
Task 1 → v1
Task 2 → v1
DEPLOYMENT STARTS
Task 1 → v1
Task 2 → v1
Task 3 → v2
HEALTH CHECK PASSES
Task 1 → v2
Task 2 → v2
OLD TASKS TERMINATED
Enter fullscreen mode Exit fullscreen mode
Students must observe the deployment instead of simply clicking Update and considering the lab finished.
Part 5 — ALB
The Application Load Balancer must be Internet-facing.
ALB:
Public Subnet 1A
+
Public Subnet 1B
Enter fullscreen mode Exit fullscreen mode
ECS:
Private Subnet 1A
+
Private Subnet 1B
Enter fullscreen mode Exit fullscreen mode
Traffic:
Customer
↓
ALB
↓
Listener
↓
Target Group
↓
ECS Service
↓
Container
Enter fullscreen mode Exit fullscreen mode
The target group must report:
Healthy
Enter fullscreen mode Exit fullscreen mode
Part 6 — Domain and HTTPS
Configure:
Domain
↓
DNS
↓
ALB
Enter fullscreen mode Exit fullscreen mode
Request/configure an SSL/TLS certificate and configure the ALB HTTPS listener.
Final traffic:
https://yourdomain.com
↓
DNS
↓
ALB :443
↓
Target Group
↓
ECS Service
↓
Container
Enter fullscreen mode Exit fullscreen mode
The browser must show a valid HTTPS connection and display your product name.
Final Architecture
DEVELOPER
│
Jules
│
▼
GitHub
│
┌─────────▼─────────┐
│ CI │
│ GitHub Actions │
└─────────┬─────────┘
│
SonarQube
│
Docker Build
│
Trivy Scan
│
▼
ECR
│
CI ENDS ───┼─── CD STARTS
│
▼
Jenkins
│
▼
ECS Task Revision
│
▼
ECS Service
Private Subnets
│
▼
Target Group
│
▼
ALB
Public Subnets
│
▼
HTTPS :443
│
▼
Domain
│
▼
Customer
Enter fullscreen mode Exit fullscreen mode
Lab is successful when
CI
GitHub push triggers GitHub Actions
SonarQube analysis passes
Docker image builds
Trivy scans the image
Versioned image reaches ECR
CD
Jenkins deploys the ECR image
New ECS task definition revision is created
ECS performs a rolling deployment
New tasks become healthy
Old tasks terminate
Target group reports healthy
PRODUCTION
ALB is public
ECS workload is private
Domain points to ALB
HTTPS works
https://yourdomain.com opens successfully
Product name appears in the browser
Enter fullscreen mode Exit fullscreen mode
The most important boundary for students to understand is:
CI = Code → tested/scanned container image in ECR
CD = ECR image → running application in ECS → ALB → HTTPS → customer.