Author: sourav kundu

HAProxy dynamic backend discovery with Auto Scaling Group and Lambda using Terraform

~ sourav kundu ~ Leave a comment

In the previous two notes, I showed how to set up HAProxy to route traffic using the round-robin algorithm and distribute load based on a CPU agent running on backend Amazon EC2 instances. In both cases, the HAProxy configuration file contained the backend instances' private IPs at the time of creation. However, in production, workloads … Continue reading HAProxy dynamic backend discovery with Auto Scaling Group and Lambda using Terraform

CPU-based routing with HAProxy agent-check on Amazon EC2

~ sourav kundu ~ Leave a comment

This note continues the previous one, where I set up HAProxy on an Amazon EC2 instance to route traffic to backend compute instances using Terraform. In that note, the algorithm was round-robin. HAProxy internally manages this as weighted round-robin, and since nothing was configured for the weights, traffic was split evenly across both instances. In … Continue reading CPU-based routing with HAProxy agent-check on Amazon EC2

Manage GitHub Repositories using the Terraform GitHub Provider

~ sourav kundu ~ Leave a comment

GitHub has become the standard platform for hosting code. In organizations practicing GitOps, the repository is the single source of truth for application code, infrastructure, configuration, and deployment workflows. However, the repositories themselves are often created manually. Each new repository depends on whoever creates it to enable the right settings: branch protection, vulnerability alerts, secret … Continue reading Manage GitHub Repositories using the Terraform GitHub Provider

Create an HAProxy load balancer with Amazon EC2 and Terraform

~ sourav kundu ~ 2 Comments

Load balancers route traffic to backend servers using algorithms such as round-robin, least-connections, or weighted routing based on server capacity. As of June 2026, AWS provides managed Application and Network Load Balancers, which abstract away routing logic so software engineering teams can focus on application development. However, engineering teams sometimes need full control over traffic … Continue reading Create an HAProxy load balancer with Amazon EC2 and Terraform

Enforce Pod Security Standards on Amazon EKS

~ sourav kundu ~ Leave a comment

By default, every pod deployed to an Amazon EKS cluster can run as root, mount host paths, and escalate privileges. Most teams don't realize this until a security review surfaces it. While certain system-level workloads genuinely need elevated access (Karpenter, for example, requires host-level permissions to manage nodes), application pods rarely do. Without restrictions, a … Continue reading Enforce Pod Security Standards on Amazon EKS

Integrate AWS Secrets Manager with Amazon EKS using the Secrets Store CSI Driver

~ sourav kundu ~ Leave a comment

Containerized workloads on Amazon EKS often need access to sensitive credentials. A pod running a backend service might need a database connection string. A payment processor might require API keys. A message consumer might need authentication tokens for an external queue. In each case, the workload needs a way to retrieve secrets securely at runtime … Continue reading Integrate AWS Secrets Manager with Amazon EKS using the Secrets Store CSI Driver

Configure EKS Pod Identity for Secure AWS Access using Terraform

~ sourav kundu ~ 1 Comment

Containerized workloads running on Amazon EKS frequently need to interact with other AWS services. A pod running a web application might need to read secrets from AWS Secrets Manager. A monitoring agent might push metrics to CloudWatch. An autoscaler like Karpenter needs permissions to launch and terminate EC2 instances. In each case, the pod needs … Continue reading Configure EKS Pod Identity for Secure AWS Access using Terraform

Secure EKS API Access with Authentication and Authorization Controls using Terraform

~ sourav kundu ~ Leave a comment

Amazon EKS hosts containerized workloads, but any entity that needs to communicate with the cluster, whether to install addons, deploy applications via Helm, or check pod statuses with kubectl, must first have access to the cluster. By default, the IAM principal that creates the cluster receives implicit administrative access. However, for subsequent operations, a different … Continue reading Secure EKS API Access with Authentication and Authorization Controls using Terraform

Deploy Karpenter and Metrics Server on Amazon EKS using Terraform and Helm

~ sourav kundu ~ 1 Comment

Amazon EKS manages the control plane, but managing the data plane, the EC2 instances on which pods run, is the customer's responsibility. To provision data plane capacity, you create managed node groups backed by Auto Scaling Groups (ASGs), with a launch template that locks in instance types, capacity type (on-demand or spot), and scaling limits. … Continue reading Deploy Karpenter and Metrics Server on Amazon EKS using Terraform and Helm

Deploy AWS Load Balancer Controller with Multi-Configuration Terraform and Helm

~ sourav kundu ~ 5 Comments

Amazon EKS excels at running containerized workloads, but getting traffic to them requires thoughtful load-balancer architecture. The AWS Load Balancer Controller bridges this gap by automatically provisioning Application Load Balancers (ALBs) and Network Load Balancers (NLBs) based on Kubernetes resource definitions, eliminating manual infrastructure management. In this article, I'll deploy the AWS Load Balancer Controller using … Continue reading Deploy AWS Load Balancer Controller with Multi-Configuration Terraform and Helm