DEV Community

Cover image for Spring Boot Banking Application Deployment using DevSecOps on AWS EKS
Deepanshu
Deepanshu

Posted on • Edited on

Spring Boot Banking Application Deployment using DevSecOps on AWS EKS

#devops #cloud #terraform #cicd

A comprehensive, secure banking web application built with Spring Boot, featuring modern web technologies and enterprise-grade security. This application provides essential banking operations with a user-friendly interface and robust backend architecture.

  • This is a multi-tier bank an application written in Java (Springboot).


Tech stack used in this project:

  • GitHub (Code)
  • Docker (Containerization)
  • Jenkins (CI)
  • OWASP (Dependency check)
  • SonarQube (Quality)
  • Snyk (AI vulnerability)
  • ArgoCD (CD)
  • AWS EKS (Kubernetes)
  • Helm (Monitoring using grafana and prometheus)

Steps to deploy:

Pre-requisites:

  • root user access 
sudo su
Enter fullscreen mode Exit fullscreen mode

[!Note]
This project will be implemented on North Virginia region (us-east-1).

  • Create 1 Master machine on AWS (t3.large) and 25 GB of storage.

  • Open the below ports in security group
    image

  • Create EKS Cluster on AWS

  • IAM user with access keys and secret access keys

  • AWSCLI should be configured

 curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" sudo apt install unzip unzip awscliv2.zip sudo ./aws/install aws configure
Enter fullscreen mode Exit fullscreen mode
  • Install kubectl 
 curl -o kubectl https://amazon-eks.s3.us-west-2.amazonaws.com/1.19.6/2021-01-05/bin/linux/amd64/kubectl chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin kubectl version --short --client
Enter fullscreen mode Exit fullscreen mode
  • Install eksctl 
 curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp sudo mv /tmp/eksctl /usr/local/bin eksctl version
Enter fullscreen mode Exit fullscreen mode
  • Create EKS Cluster 
 eksctl create cluster --name=bankapp \ --region=us-west-1 \ --version=1.30 \ --without-nodegroup
Enter fullscreen mode Exit fullscreen mode
  • Associate IAM OIDC Provider 
 eksctl utils associate-iam-oidc-provider \ --region us-west-1 \ --cluster bankapp \ --approve
Enter fullscreen mode Exit fullscreen mode
  • Create Nodegroup 
 eksctl create nodegroup --cluster=bankapp \ --region=us-east-1 \ --name=bankapp \ --node-type=t3.medium \ --nodes=2 \ --nodes-min=2 \ --nodes-max=2 \ --node-volume-size=25 \ --ssh-access \ --ssh-public-key=eks-nodegroup-key
Enter fullscreen mode Exit fullscreen mode

[!Note]
Make sure the ssh-public-key "eks-nodegroup-key is available in your aws account"

  • Install Jenkins 
sudo apt update -y sudo apt install fontconfig openjdk-17-jre -y sudo wget -O /usr/share/keyrings/jenkins-keyring.asc \ https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key echo "deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc]" \ https://pkg.jenkins.io/debian-stable binary/ | sudo tee \ /etc/apt/sources.list.d/jenkins.list > /dev/null sudo apt-get update -y sudo apt-get install jenkins -y
Enter fullscreen mode Exit fullscreen mode

  • After installing Jenkins, change the default port of jenkins from 8080 to 8081. Because our bankapp application will be running on 8080.

    • Open /usr/lib/systemd/system/jenkins.service file and change JENKINS_PORT environment variable image
    • Reload daemon 
 sudo systemctl daemon-reload
Enter fullscreen mode Exit fullscreen mode
  • Restart Jenkins 
 sudo systemctl restart jenkins
Enter fullscreen mode Exit fullscreen mode
  • Install docker 
sudo apt install docker.io -y sudo usermod -aG docker ubuntu && newgrp docker
Enter fullscreen mode Exit fullscreen mode
  • Install and configure SonarQube 
docker pull sonarqube docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest
Enter fullscreen mode Exit fullscreen mode
  • Install OWASP 
docker pull owasp/dependency-check
Enter fullscreen mode Exit fullscreen mode

[!Note]
OWASP setup take around 10-20min first its download all the vulnerability from there database into you system. With API key your process becomes quit faster. "

You can request you OWASP API key (FREE) Link

  • Install and Configure ArgoCD

    • Create argocd namespace 
 kubectl create namespace argocd
Enter fullscreen mode Exit fullscreen mode
  • Apply argocd manifest 
 kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
Enter fullscreen mode Exit fullscreen mode
  • Make sure all pods are running in argocd namespace 
 watch kubectl get pods -n argocd
Enter fullscreen mode Exit fullscreen mode
  • Install argocd CLI 
 curl --silent --location -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/v2.4.7/argocd-linux-amd64
Enter fullscreen mode Exit fullscreen mode
  • Provide executable permission 
 chmod +x /usr/local/bin/argocd
Enter fullscreen mode Exit fullscreen mode
  • Check argocd services 
 kubectl get svc -n argocd
Enter fullscreen mode Exit fullscreen mode
  • Change argocd server's service from ClusterIP to NodePort 
 kubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "NodePort"}}'
Enter fullscreen mode Exit fullscreen mode
  • Confirm service is patched or not 
 kubectl get svc -n argocd
Enter fullscreen mode Exit fullscreen mode

  • Check the port where ArgoCD server is running and expose it on security groups of a k8s worker node

  • Access it on browser, click on advance and proceed with

 <public-ip-worker>:<port>
Enter fullscreen mode Exit fullscreen mode


  • Fetch the initial password of argocd server 
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d; echo
Enter fullscreen mode Exit fullscreen mode
  • Username: admin
  • Now, go to User Info and update your argocd password
  • Go to Jenkins and click on Manage Jenkins --> Plugins --> Available plugins install the below plugins:
    • OWASP
    • SonarQube Scanner
    • Synk
    • Docker
    • Pipeline: Stage View

  • Configure OWASP, move to Manage Jenkins --> Plugins --> Available pluginsb>
    image

  • After OWASP plugin is installed, Now move to Manage jenkins --> Tools and configure it.

  • After Synk plugin is installed, Now move to Manage --> Tools and configure it.

  • Login to SonarQube server and create the credentials for jenkins to integrate with SonarQube
    • Navigate to Administration --> Security --> Users --> Token and paste into inside your jenkins credentials
  • Now, go to Manage Jenkins --> credentials and add Sonarqube credentials: image
  • Go to Manage Jenkins --> Tools and search for SonarQube Scanner installations: image
  • Go to Manage Jenkins --> credentials and add Docker credentials to push updated the updated docker image to dockerhub. image
  • Go to Manage Jenkins --> System and search for SonarQube installations: image
  • Login to SonarQube server, go to Administration --> Webhook and click on create image image

  • Go to Master Machine and add our own eks cluster to argocd for application deployment using cli

    • Login to argoCD from CLI 
 argocd login 52.53.156.187:32738 --username admin
Enter fullscreen mode Exit fullscreen mode

[!Tip]
52.53.156.187:32738 --> This should be your argocd url

image

  • Check how many clusters are available in argocd 
 argocd cluster list
Enter fullscreen mode Exit fullscreen mode

image

  • Get your cluster name 
 kubectl config get-contexts
Enter fullscreen mode Exit fullscreen mode
  • Add your cluster to argocd 
 argocd cluster add bankapp-cluster.us-east-1.eksctl.io --name bankapp-eks-cluster
Enter fullscreen mode Exit fullscreen mode

[!Tip] > bankapp-cluster.us-east-1.eksctl.io --> This should be your EKS Cluster Name.

image

  • Once your cluster is added to argocd, go to argocd console Settings --> Clusters and verify it image
  • Go to Settings --> Repositories and click on Connect repo image

[!Note]
Connection should be successful

  • Create BankApp-CI job image

  • Create BankApp-CD job, same as CI job.
  • Provide permission to docker socket so that docker build and push command do not fail 
chmod 777 /var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode

image

  • Now, go to Applications and click on New App

image

[!Important]
Make sure to click on the Auto-Create Namespace option while creating argocd application

image

  • Congratulations, your application is deployed on AWS EKS Cluster
    image

  • Open port 30080 on worker node and Access it on browser

<worker-public-ip>:30080
Enter fullscreen mode Exit fullscreen mode

How to monitor EKS cluster, kubernetes components and workloads using prometheus and grafana via HELM (On Master machine)

  • Install Helm Chart

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
Enter fullscreen mode Exit fullscreen mode 
chmod 700 get_helm.sh
Enter fullscreen mode Exit fullscreen mode 
./get_helm.sh
Enter fullscreen mode Exit fullscreen mode
  • Add Helm Stable Charts for Your Local Client 
helm repo add stable https://charts.helm.sh/stable
Enter fullscreen mode Exit fullscreen mode
  • Add Prometheus Helm Repository 
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
Enter fullscreen mode Exit fullscreen mode
  • Create Prometheus Namespace 
kubectl create namespace prometheus
Enter fullscreen mode Exit fullscreen mode 
kubectl get ns
Enter fullscreen mode Exit fullscreen mode
  • Install Prometheus using Helm 
helm install stable prometheus-community/kube-prometheus-stack -n prometheus
Enter fullscreen mode Exit fullscreen mode
  • Verify prometheus installation 
kubectl get pods -n prometheus
Enter fullscreen mode Exit fullscreen mode
  • Check the services file (svc) of the Prometheus 
kubectl get svc -n prometheus
Enter fullscreen mode Exit fullscreen mode
  • Expose Prometheus and Grafana to the external world through Node Port > [!Important] > change it from Cluster IP to NodePort after changing make sure you save the file and open the assigned nodeport to the service.


kubectl edit svc stable-kube-prometheus-sta-prometheus -n prometheus
Enter fullscreen mode Exit fullscreen mode

image
image

  • Verify service 
kubectl get svc -n prometheus
Enter fullscreen mode Exit fullscreen mode
  • Now,let’s change the SVC file of the Grafana and expose it to the outer world 
kubectl edit svc stable-grafana -n prometheus
Enter fullscreen mode Exit fullscreen mode

image

  • Check grafana service 
kubectl get svc -n prometheus
Enter fullscreen mode Exit fullscreen mode
  • Get a password for grafana 
kubectl get secret --namespace prometheus stable-grafana -o jsonpath="{.data.admin-password}" | base64 --decode ; echo
Enter fullscreen mode Exit fullscreen mode

[!Note]
Username: admin

  • Now, view the Dashboard in Grafana



Clean Up

  • Delete eks cluster 
eksctl delete cluster --name=bankapp --region=us-east-1
Enter fullscreen mode Exit fullscreen mode

📚 Additional Resources

Happy Coding! 🏦💳

Top comments (0)