DevSecOps

Container Delivery on Amazon ECS and EKS

One webhook router starts the right pipeline; scanned images go blue/green to ECS and by GitOps to EKS.

A reference design for many applications on one delivery path: a webhook router starts the right AWS CodePipeline, CodeBuild produces an image that Trivy scans, CodeDeploy releases it blue/green on Amazon ECS, and workloads on Amazon EKS are deployed by Argo CD from Git, with a manager's approval before higher environments.

pushwebhookimagescanpasseddeployGitOps syncapprovalSourceAWS CloudPipeline · AWS developer toolsVPC · application subnetsAmazon ECS · blue/greenAmazon EKS · GitOpsApplication teamsBitbucketsourceAWS Lambdapicks the pipelineAWS CodePipelineAWS CodeBuildAmazon ECRTrivyimage scanArgo CDGitOpsManager approvalhigher environmentsAWS CodeDeployblue/greenElastic LoadBalancingAmazon ECSblue and green task setsHelmchartsAmazon EKSKubernetes workloadsDatadoglogs and metrics

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

When to use it

  • Many applications that should share one pipeline, not one each
  • A move from VM releases to containers on ECS or EKS
  • Releases that must not stop a 24/7 service

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

DevSecOps