Listen to this Post
Introduction:
The modern e‑commerce landscape is shifting from static keyword‑based search to intelligent, conversational product discovery. ShopWiseAI is a personal project that embodies this shift, aiming to build an AI‑powered smart shopping platform where users interact with an intelligent assistant rather than scrolling through endless product lists. From a DevOps and platform engineering perspective, the project is equally ambitious, serving as a proving ground for a complete, production‑ready cloud architecture that includes AWS EKS, GitHub Actions CI/CD, ArgoCD GitOps, Helm, Docker, CloudFormation, and a full observability stack with Prometheus and Grafana. This article breaks down the technical stack, provides step‑by‑step implementation guides, and explores the security and operational best practices that make ShopWiseAI a robust, scalable, and secure platform.
Learning Objectives:
- Understand how to architect and deploy a cloud‑native application on AWS EKS using Infrastructure as Code (IaC) with Terraform and CloudFormation.
- Implement a complete GitOps workflow using ArgoCD to achieve continuous, automated, and auditable application deployments.
- Configure enterprise‑grade security controls, including IAM Roles for Service Accounts (IRSA) and OIDC, to enforce least‑privilege access.
- Set up a comprehensive observability stack with Prometheus and Grafana for real‑time monitoring and alerting.
- Build and manage containerized microservices with Docker and Helm, integrated into a CI/CD pipeline powered by GitHub Actions.
- Architecting the Cloud‑Native Foundation: AWS EKS and Infrastructure as Code
The core of ShopWiseAI runs on Amazon Elastic Kubernetes Service (EKS) , a managed Kubernetes service that simplifies running containerized applications at scale. However, provisioning a production‑ready EKS cluster involves much more than clicking a few buttons in the AWS console. You need a dedicated VPC with public and private subnets across multiple Availability Zones, carefully configured security groups, IAM roles with least‑privilege access, managed node groups with autoscaling, and essential add‑ons like the AWS Load Balancer Controller.
To manage this complexity and eliminate configuration drift, ShopWiseAI adopts an Infrastructure as Code (IaC) approach. The infrastructure is defined declaratively using Terraform or AWS CloudFormation, ensuring that every environment—from development to production—is consistent, reproducible, and version‑controlled. Here is a simplified Terraform configuration for provisioning an EKS cluster:
main.tf - Simplified EKS Cluster Provisioning
provider "aws" {
region = var.aws_region
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "5.0.0"
name = "shopwise-vpc"
cidr = "10.0.0.0/16"
azs = ["us-west-2a", "us-west-2b", "us-west-2c"]
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
enable_nat_gateway = true
}
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "19.0.0"
cluster_name = "shopwise-cluster"
cluster_version = "1.28"
vpc_id = module.vpc.vpc_id
subnet_ids = module.vpc.private_subnets
manage_aws_auth_configmap = true
eks_managed_node_groups = {
main = {
desired_capacity = 3
max_capacity = 10
min_capacity = 2
instance_types = ["m5.large"]
}
}
}
Step‑by‑step guide:
- Define the VPC: Create a dedicated VPC with both public and private subnets spanning three Availability Zones for high availability.
- Provision the EKS Cluster: Use the Terraform AWS EKS module to create the cluster, specifying the VPC, subnet IDs, and Kubernetes version.
- Configure Node Groups: Define managed node groups with autoscaling policies to handle varying workloads.
- Apply the Configuration: Run
terraform init,terraform plan, and `terraform apply` to provision the entire infrastructure. - Verify Connectivity: Use `aws eks update-kubeconfig –region
–1ame ` to configure `kubectl` and test connectivity.
2. CI/CD Pipeline Automation with GitHub Actions
Once the infrastructure is in place, the next step is to automate the build, test, and deployment of the ShopWiseAI application. GitHub Actions serves as the CI/CD engine, orchestrating the entire pipeline from code commit to deployment. The workflow typically triggers on every push to the main branch, performing the following steps:
- Build: Compile the application and run unit tests.
- Containerize: Build a Docker image of the application.
- Push: Push the Docker image to a container registry, such as Amazon Elastic Container Registry (ECR) .
- Deploy: Update the Kubernetes manifests with the new image tag and commit the changes back to the Git repository, which ArgoCD will then automatically sync.
Here is an example GitHub Actions workflow file (.github/workflows/deploy.yml):
name: Deploy to EKS
on:
push:
branches: [ main ]
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
<ul>
<li>name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2</p></li>
<li><p>name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1</p></li>
<li><p>name: Build, tag, and push image to Amazon ECR
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
ECR_REPOSITORY: shopwise-app
IMAGE_TAG: ${{ github.sha }}
run: |
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG</p></li>
<li><p>name: Update Kubernetes manifests with new image tag
run: |
sed -i "s|image:.|image: ${{ steps.login-ecr.outputs.registry }}/shopwise-app:${{ github.sha }}|g" k8s/deployment.yaml
git config user.name github-actions
git config user.email [email protected]
git add k8s/deployment.yaml
git commit -m "Update image tag to ${{ github.sha }}"
git push
Step‑by‑step guide:
- Set up GitHub Secrets: Store AWS credentials (
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY) as secrets in your GitHub repository. - Create the Workflow File: Place the YAML above in `.github/workflows/` directory of your repository.
- Customize Variables: Adjust the ECR repository name, region, and branch names as needed.
- Commit and Push: Any push to the `main` branch will trigger the workflow automatically.
- Monitor the Pipeline: Check the “Actions” tab in GitHub to view the progress and logs of each run.
3. GitOps and Continuous Deployment with ArgoCD
Traditional deployment models often suffer from configuration drift, where the live cluster state diverges from the declared state in Git. GitOps solves this by making the Git repository the single source of truth. ArgoCD, a Kubernetes‑native GitOps controller, continuously monitors the Git repository and automatically syncs the cluster to match the desired state. ShopWiseAI leverages ArgoCD to achieve a “zero‑touch” deployment loop, where any change merged into the main branch is automatically deployed to the cluster.
Step‑by‑step guide to install and configure ArgoCD:
1. Install ArgoCD on the EKS Cluster:
kubectl create namespace argocd kubectl apply -1 argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
2. Verify the Installation:
kubectl get pods -1 argocd
Ensure all pods are in `Running` state.
3. Access the ArgoCD UI:
- Port‑forward the ArgoCD server service:
kubectl port-forward svc/argocd-server -1 argocd 8080:443
- Retrieve the initial admin password:
kubectl -1 argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d - Access the UI at `https://localhost:8080` and log in with username `admin` and the retrieved password.
4. Create an Application in ArgoCD:
- In the ArgoCD UI, click “New App”.
- Specify the application name (e.g.,
shopwise), project (default), and sync policy (e.g.,Auto). - Set the repository URL to your Git repository containing the Kubernetes manifests.
- Define the path to the manifests (e.g.,
k8s/) and the cluster URL (`https://kubernetes.default.svc`). - Click “Create” to deploy the application.
- Monitor Sync Status: ArgoCD will continuously monitor the repository and automatically sync any changes, ensuring the cluster always matches the desired state.
4. Container Orchestration with Docker and Helm
ShopWiseAI is built as a set of microservices, each containerized using Docker for consistency and portability. Docker ensures that the application runs the same way in development, testing, and production environments. For managing the complex Kubernetes manifests required for these microservices, Helm—the package manager for Kubernetes—is used. Helm charts bundle all the YAML manifests, configurations, and dependencies into a reusable, versioned package.
Example Dockerfile for a ShopWiseAI microservice:
FROM node:18-alpine AS builder WORKDIR /app COPY package.json ./ RUN npm install COPY . . RUN npm run build FROM node:18-alpine WORKDIR /app COPY --from=builder /app/.next ./.next COPY --from=builder /app/public ./public COPY --from=builder /app/package.json ./package.json COPY --from=builder /app/node_modules ./node_modules EXPOSE 3000 CMD ["npm", "start"]
Step‑by‑step guide to create and deploy a Helm chart:
1. Create a New Helm Chart:
helm create shopwise-api
This creates a directory structure with templates for Kubernetes resources.
- Customize the Chart: Edit the `values.yaml` file to define configurable parameters such as image repository, tag, replica count, and service types.
values.yaml image: repository: <your-ecr-repo>/shopwise-api tag: latest pullPolicy: IfNotPresent replicaCount: 3 service: type: ClusterIP port: 80
-
Template the Manifests: Use Helm to generate the final Kubernetes YAML files for validation:
helm template shopwise-api ./shopwise-api
4. Install the Chart:
helm install shopwise-api ./shopwise-api --1amespace shopwise --create-1amespace
- Upgrade the Release: When you update the chart or values, use:
helm upgrade shopwise-api ./shopwise-api --1amespace shopwise
5. Observability and Monitoring with Prometheus and Grafana
A production platform is only as reliable as its monitoring. ShopWiseAI integrates a full observability stack using Prometheus for metrics collection and alerting, and Grafana for rich, customizable dashboards. The `kube-prometheus-stack` Helm chart provides a one‑stop deployment of Prometheus, Alertmanager, Grafana, and various exporters (Node Exporter, Kube State Metrics).
Step‑by‑step guide to deploy the monitoring stack:
1. Add the Prometheus Community Helm Repository:
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm repo update
2. Create a Custom `values.yaml` for the Stack:
monitoring-values.yaml grafana: service: type: NodePort nodePort: 30094 adminUser: admin adminPassword: admin prometheus-1ode-exporter: service: type: NodePort nodePort: 30095 kube-state-metrics: service: type: NodePort nodePort: 30096
3. Install the `kube-prometheus-stack`:
helm install prometheus prometheus-community/kube-prometheus-stack \ --version 77.6.0 \ --1amespace monitoring \ --create-1amespace \ -f monitoring-values.yaml
4. Access Grafana:
- Port‑forward the Grafana service:
kubectl port-forward svc/prometheus-grafana -1 monitoring 3000:80
- Open
http://localhost:3000` and log in with the credentials from thevalues.yaml`.
- Import Dashboards: Grafana provides pre‑built dashboards for Kubernetes monitoring. Import the official “Kubernetes / Compute Resources / Cluster” dashboard (ID: 6417) to visualize cluster health.
6. Security Hardening: IAM, OIDC, and IRSA
Security is paramount in any cloud‑native architecture. ShopWiseAI implements a zero‑trust security model by leveraging AWS IAM Roles for Service Accounts (IRSA) . IRSA allows you to associate an IAM role with a Kubernetes service account, granting fine‑grained, pod‑level permissions to AWS services. This eliminates the need to store long‑lived AWS credentials in pods and follows the principle of least privilege.
How IRSA works:
- The EKS cluster exposes an OpenID Connect (OIDC) issuer URL.
- An IAM role is created with a trust policy that allows the OIDC provider to assume the role for a specific Kubernetes service account.
- The service account is annotated with the IAM role ARN (
eks.amazonaws.com/role-arn). - An admission controller injects temporary AWS credentials into the pod via environment variables (
AWS_ROLE_ARNandAWS_WEB_IDENTITY_TOKEN_FILE).
Step‑by‑step guide to configure IRSA using `eksctl`:
- Associate an IAM OIDC Provider with the EKS Cluster:
eksctl utils associate-iam-oidc-provider --cluster=shopwise-cluster --approve
2. Create an IAM Role and Service Account:
eksctl create iamserviceaccount \ --cluster=shopwise-cluster \ --1ame=shopwise-s3-access \ --1amespace=shopwise \ --attach-policy-arn=arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \ --approve
3. Verify the Service Account:
kubectl describe sa shopwise-s3-access -1 shopwise
The output should show the annotation with the IAM role ARN.
- Deploy a Pod Using the Service Account: In your Kubernetes deployment YAML, specify
serviceAccountName: shopwise-s3-access. The pod will automatically receive the IAM role’s permissions.
7. AI Integration and Personalized Recommendations
The intelligence behind ShopWiseAI comes from integrating a GPT‑powered AI chatbot and a personalized recommendation engine. The chatbot uses OpenAI’s retrieval‑augmented generation to understand user queries and provide contextual product suggestions. The recommendation engine ranks products based on user behavior vectors using cosine similarity, delivering fast and relevant results.
From a platform engineering perspective, integrating AI services requires careful consideration of API security, cost management, and latency. The AI components are designed to be serverless and lightweight, using services like MongoDB Atlas for data storage and the OpenAI API for natural language processing. This approach minimizes infrastructure overhead and allows the platform to scale efficiently.
Key considerations for AI integration:
- API Key Management: Store OpenAI API keys securely using AWS Secrets Manager or Kubernetes secrets.
- Cost Optimization: Monitor API usage and implement caching to reduce costs. The ShopWiseAI prototype achieved only 1.08 g CO₂ per 1,000 API calls, demonstrating a sustainable approach.
- Performance: The platform achieved a mobile Largest Contentful Paint of 0.8 seconds and reduced average search time by 31%.
What Undercode Say:
- Key Takeaway 1: Building a production‑grade AI platform is as much about the underlying infrastructure as it is about the AI itself. A robust DevOps and security foundation is essential for reliability and scalability.
- Key Takeaway 2: GitOps with ArgoCD transforms deployment from a manual, error‑prone process into an automated, auditable, and self‑healing workflow. It ensures that the cluster state is always in sync with the declared state in Git, eliminating configuration drift.
The ShopWiseAI project exemplifies the convergence of AI and modern cloud engineering. By leveraging AWS EKS, GitHub Actions, ArgoCD, Helm, and a full observability stack, it demonstrates how to build a secure, scalable, and intelligent e‑commerce platform. The integration of a GPT‑powered chatbot and a personalized recommendation engine highlights the potential of AI to transform user experiences, while the DevOps practices ensure that the platform remains reliable and cost‑effective. This project serves as a blueprint for developers and engineers looking to build similar AI‑driven applications in the cloud.
Prediction:
- +1 AI‑powered shopping assistants will become the norm in e‑commerce within the next 3–5 years, reducing product discovery time by over 30% and significantly improving user satisfaction.
- +1 The adoption of GitOps and Infrastructure as Code will continue to accelerate, with more organizations embracing declarative, version‑controlled infrastructure to achieve faster, more reliable deployments.
- -1 The complexity of managing AI APIs, including cost, latency, and security, will pose significant challenges for smaller teams, potentially widening the gap between large enterprises and startups.
- -1 As AI models become more integrated into platforms, the risk of data privacy breaches and adversarial attacks will increase, necessitating even more robust security controls and compliance measures.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Subhasmita Das – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
