The invisible work
that keeps you live.

# eks-cluster.tf — Production clusterresource "aws_eks_cluster" "fintrack_prod" {  name     = "fintrack-prod-v2"  role_arn = aws_iam_role.eks_master.arn  version  = "1.28"  vpc_config {    subnet_ids              = module.vpc.private_subnets    endpoint_private_access = true    endpoint_public_access  = false    security_group_ids      = [aws_security_group.eks_control.id]  }  enabled_cluster_log_types = [    "api", "audit", "authenticator"  ]}# Blue-green node groups for zero-downtime rotationresource "aws_eks_node_group" "blue" {  cluster_name    = aws_eks_cluster.fintrack_prod.name  node_group_name = "prod-blue"  instance_types  = ["t3.xlarge"]    scaling_config {    desired_size = 4    max_size     = 12    min_size     = 2  }}

# .github/workflows/deploy.ymlname: Deploy → Productionon:  push:    branches: [main]jobs:  build-and-push:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4            - name: Build & push image        run: |          docker build -t $ECR_REPO:$GITHUB_SHA .          aws ecr get-login-password | docker login --username AWS \            --password-stdin $ECR_REPO          docker push $ECR_REPO:$GITHUB_SHA  deploy:    needs: build-and-push    steps:      - name: ArgoCD sync        run: |          argocd app sync fintrack-prod \            --revision $GITHUB_SHA \            --timeout 300            - name: Smoke test        run: ./scripts/smoke-test.sh $DEPLOY_URL

# pipeline-foundation.tfmodule "ci_runner_fleet" {  source = "./modules/github-runners"    runner_count   = 4  instance_type  = "c6a.2xlarge"  spot_enabled   = true  spot_max_price = "0.12"    labels = ["self-hosted", "linux", "x64", "production"]    autoscaling = {    min     = 2    max     = 8    scale_in_cooldown  = 300    scale_out_cooldown = 60  }}# Artifact registry with lifecycle policiesresource "aws_ecr_repository" "services" {  for_each = toset(var.service_names)  name     = "claros/${each.key}"    image_scanning_configuration {    scan_on_push = true  }}

# Staged rollout with canary analysisdeploy:  strategy: canary  steps:    - name: Deploy 5% canary      run: kubectl set image deploy/api \        api=$IMAGE:$TAG          - name: Analyze canary (10 min)      uses: datadog/synthetics-action@v1      with:        api_key: ${{ secrets.DD_API_KEY }}        test_ids: "abc-123,def-456"            - name: Promote to 100%      if: steps.canary.outputs.passed == 'true'      run: |        kubectl annotate deploy/api \          kubernetes.io/change-cause="$TAG"        kubectl rollout status deploy/api