DevSecOps

Central CI/CD Platform

One shared GitLab with a template library and Spot runners on Amazon EKS, deploying into each account with short-lived roles.

A shared delivery platform for many application teams: one GitLab for every team, CI templates owned by a platform team, and shared runners that start one pod per job on Spot capacity. Pipelines deploy with short-lived roles, scoped by project and branch.

merge requestsincludeonboardingCI jobsadds nodesID token → STSShared GitLab · every teamDevelopment account · shared runnersVPCPrivate subnetAmazon EKS clusterNon-production accountProduction accountApp teamsevery teamCode scanningdependency botsCI template libraryplatform-ownedShared GitLabrepos · merge requestsDeveloper portalguidelines · docsAWS Fargaterunner manager · KarpenterAmazon EKSprivate clusterEC2 Spot nodeone pod per jobEC2 Spot nodeadded on demandAmazon ECRimage cacheAmazon S3dependency cacheAmazon CloudWatchrunner logs · metricsDeploy roleGitLab OIDC trustWorkloadsdev · testDeploy roleprotected branch onlyWorkloadsproduction

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

When to use it

  • Many teams on fragmented version control and their own build servers
  • Build capacity that sits idle at night and queues at release time
  • Pipelines that hold long-lived cloud keys

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

DevSecOps