Cloud Base
Terraform provisions GKE and IAM foundations.
deniskachar.com
NENMP Platform Overview
This page documents the full solution in this repository: Terraform infrastructure, application packaging, Kubernetes deployment, Cert-Manager TLS setup, and CI/CD delivery.
App Delivery
Pipeline builds and pushes a new container image, then rolls it out.
Secure Access
Short-lived identity and managed secrets keep credentials out of source code.
Infrastructure
Cloud setup is automated and repeatable.
Terraform creates the core cloud baseline for this platform.
Application
A lightweight static site runs inside an NGINX container.
Built from nginx:alpine. Build metadata is injected at image build time.
Kubernetes
Kubernetes keeps service uptime and routes traffic.
Deployment and pods run behind a ClusterIP service, with ingress handling HTTPS routing.
Cert-Manager
HTTPS certificates are issued and renewed automatically.
Let's Encrypt ACME uses a Cloudflare DNS challenge. The resulting certificate is stored in the deniskachar-com-tls Kubernetes Secret.
CI/CD
Each code update can publish a new container and deploy it automatically.
The workflow builds the image, pushes it, authenticates to GCP, and updates the Kubernetes deployment.
Identity and Secrets
Access is short-lived, scoped, and keyless by design.
GitHub OIDC exchanges for temporary Google credentials. Docker and Cloudflare values stay in managed secret stores.
Release Flow
A code update triggers the pipeline, publishes a new image, and updates the running deployment.
Health is confirmed by Kubernetes during rollout, while GitHub Actions waits on kubectl rollout status before marking the job successful.