Phase 2: AWS Infrastructure¶

What This Is¶

This runbook documents how I provisioned the AWS infrastructure for the Online Boutique project: DNS hosted zone, TLS certificate, EKS cluster control plane, bastion host, and self-managed worker nodes. Everything runs on a KodeKloud AWS Playground with SCP restrictions, not a personal AWS account.

This is Phase 2 of a 6-phase project.

At the end of this phase, the EKS cluster is fully operational with worker nodes ready to accept workloads, DNS is delegated, and the ACM certificate is issued for TLS termination in later phases.

What I Did¶

Step 1  Launched the SilverStack dev machine on iximiuz, configured AWS CLI
Step 2  Created a Route 53 public hosted zone for ibtisam.qzz.io
Step 3  Delegated nameservers at the domain registrar (digitalplat.org)
Step 4  Requested a wildcard ACM certificate (*.ibtisam.qzz.io), validated via DNS
Step 5  Cloned silver-stack repo, ran terraform init + apply for EKS
        (VPC, subnets, IGW, NAT, bastion host, EKS control plane)
Step 6  SSH'd into the bastion host from the dev machine
Step 7  Installed client tools on bastion (kubectl, helm, eksctl, aws cli)
Step 8  Configured AWS CLI on bastion, updated kubeconfig
Step 9  Added self-managed worker nodes via CloudFormation
Step 10 Verified: nodes joined, cluster fully operational

Dev Machine¶

I used my SilverStack dev machine on the iximiuz platform as the workstation for this project. It comes pre-installed with all tools needed: aws, terraform, kubectl, helm, eksctl, jq, ssh, and tab completion configured for all of them. No local setup required.

I configured the AWS CLI with the KodeKloud playground credentials:

aws configure
# AWS Access Key ID: <from KodeKloud playground>
# AWS Secret Access Key: <from KodeKloud playground>
# Default region: us-east-1
# Default output format: json

DNS Hosted Zone (Route 53)¶

I created a public hosted zone for ibtisam.qzz.io in Route 53. This is the foundation for all subdomains used in later phases: app.ibtisam.qzz.io (the boutique app), argocd.ibtisam.qzz.io (ArgoCD UI), grafana.ibtisam.qzz.io, kibana.ibtisam.qzz.io, etc.

DOMAIN="ibtisam.qzz.io"

aws route53 create-hosted-zone \
  --name "$DOMAIN" \
  --caller-reference "$(date +%s)" \
  --hosted-zone-config Comment="Public hosted zone for ${DOMAIN}",PrivateZone=false

Route 53 assigned the hosted zone ID Z0210061LY7BBUGRLOK6 and four nameservers. I acquired the qzz.io domain for free from digitalplat.org and updated its nameserver delegation to point ibtisam.qzz.io to these AWS nameservers.

Verified propagation via Google's public resolver:

dig NS "$DOMAIN" @8.8.8.8 +short
# ns-566.awsdns-06.net.
# ns-1701.awsdns-20.co.uk.
# ns-331.awsdns-41.com.
# ns-1359.awsdns-41.org.

All four nameservers resolved correctly. DNS delegation was active.

TLS Certificate (ACM)¶

I requested a wildcard certificate for *.ibtisam.qzz.io via AWS Certificate Manager. This certificate is consumed later by the Gateway API ALB listener for HTTPS termination.

CERT_ARN=$(aws acm request-certificate \
  --domain-name "$DOMAIN" \
  --subject-alternative-names "*.${DOMAIN}" \
  --validation-method DNS \
  --region us-east-1 \
  --query "CertificateArn" \
  --output text)

ACM returned the validation CNAME record. I injected it into Route 53:

aws route53 change-resource-record-sets \
  --hosted-zone-id "$HOSTED_ZONE_ID" \
  --change-batch file:///tmp/acm-validation.json

Then waited for ACM to validate and issue the certificate:

aws acm wait certificate-validated \
  --certificate-arn "$CERT_ARN" \
  --region us-east-1

aws acm describe-certificate \
  --certificate-arn "$CERT_ARN" \
  --query "Certificate.{Status:Status,DomainName:DomainName}" \
  --output table
# +------------------+----------+
# | DomainName       | Status   |
# +------------------+----------+
# | ibtisam.qzz.io   | ISSUED   |
# +------------------+----------+

Certificate ARN: arn:aws:acm:us-east-1:767397778924:certificate/47da9369-a997-4197-9f4b-60b426a112a3

This ARN is referenced later in the Gateway API's LoadBalancerConfiguration for HTTPS listeners (Phase 3).

Terminal session: 01_dns_and_ssl_certificate_setup.txt

EKS Cluster Provisioning (Terraform)¶

The upstream microservices-demo repo contains Terraform code for GCP. I did not use it. I cloned my own infrastructure repo, silver-stack, which contains reusable, tested Terraform configurations. The EKS code lives at terraform/aws/eks-kodekloud/.

Terraform Init and Apply¶

git clone https://github.com/ibtisam-iq/silver-stack.git
cd silver-stack/terraform/aws/eks-kodekloud/

terraform init    # downloads VPC module, EC2 module, AWS provider
terraform apply   # creates VPC, subnets, IGW, NAT, bastion, EKS control plane

Terraform created:

The EKS control plane took approximately 10 minutes to provision. No worker nodes yet. The KodeKloud SCP blocks managed node groups, so self-managed nodes are added in a later step.

Terminal session: 01a_cluster_provisioning_with_terraform.txt

Terraform source: silver-stack/terraform/aws/eks-kodekloud/

Bastion Host Access and Tool Installation¶

Once Terraform completed, the control plane and bastion host were ready. I SSH'd into the bastion from the iximiuz dev machine using the private key Terraform generated:

ssh -i silver-stack-eks-bastion-key.pem ubuntu@<bastion-public-ip>

All remaining phases (cluster add-ons, ArgoCD, application deployment, observability, autoscaling) were performed from the bastion host. I installed the necessary client tools:

After installing the tools, I configured the AWS CLI on the bastion using the same KodeKloud credentials used on the dev machine, then updated the kubeconfig:

aws configure
aws eks update-kubeconfig --name silver-stack-eks --region us-east-1
kubectl get nodes
# No nodes yet (control plane only)

Self-Managed Worker Nodes¶

The KodeKloud SCP blocks EKS managed node groups. I added self-managed nodes via CloudFormation, following the procedure documented in the EKS runbook.

After the CloudFormation stack completed and the aws-auth ConfigMap was updated, the nodes joined the cluster:

kubectl get nodes
# NAME                          STATUS   ROLES    AGE   VERSION
# ip-10-0-1-xxx.ec2.internal    Ready    <none>   2m    v1.32.x
# ip-10-0-2-xxx.ec2.internal    Ready    <none>   2m    v1.32.x

The cluster was fully operational: control plane + worker nodes + bastion host access.

Terminal session: 02_bastion_access_tool_installation_and_self_managed_nodes.txt

Final State¶

At the end of Phase 2, the following AWS resources were provisioned and operational:

Route 53
  └── ibtisam.qzz.io (public hosted zone, delegated from registrar)

ACM
  └── *.ibtisam.qzz.io (wildcard cert, ISSUED, DNS-validated)

VPC
  ├── 3 public subnets (bastion, NAT, ALB)
  ├── 3 private subnets (EKS nodes)
  ├── Internet Gateway
  └── NAT Gateway

EKS Cluster (silver-stack-eks)
  ├── Control plane (API server)
  ├── 2 self-managed worker nodes (CloudFormation)
  └── Bastion host (SSH access from dev machine)

All subsequent phases operate from the bastion host via kubectl and helm.

Terminal Sessions and Evidence¶

Every step in this phase was recorded. The terminal sessions capture the exact commands, outputs, and errors encountered.

Next Phase¶

Phase 3: Cluster Add-ons and Gateway API covers installing the AWS Load Balancer Controller, EBS CSI Driver, Gateway API CRDs, GatewayClass, Gateway, and ExternalDNS.