Why build a real platform
Anyone can follow a tutorial and deploy a hello-world to Kubernetes. I wanted something different: a platform that is actually automated and actually observable, so that every claim on my portfolio can be checked by anyone. Golden Path runs on Azure AKS, deployed entirely through CI/CD and GitOps. The cluster runs on demand: started for demos, stopped afterwards, a deliberate trade-off that keeps the bill near zero on a student budget.
The stack, end to end
Terraform provisions the Azure resources — AKS cluster, networking, and identity. GitHub Actions is the CI/CD engine: on every push to main it builds the container image, scans it with Trivy, and deploys. ArgoCD watches the Git repository and syncs the cluster to the declared state — drift is corrected automatically. Prometheus scrapes cluster metrics and Grafana visualizes them.
No long-lived cloud credentials
The most security-relevant decision: GitHub Actions authenticates to Azure with OIDC federation instead of storing a service principal secret. The pipeline requests a short-lived token at deploy time. There are no cloud credentials sitting in repository secrets, which is exactly the kind of practice I want to be judged on.
Everything as code
Infrastructure, deployment manifests, and configuration all live in Git. A change flows: commit → pipeline → registry → ArgoCD sync → deployed. If a deploy drifts, ArgoCD brings it back. If the cluster dies, Terraform state knows how to rebuild it.
What I learned
GitOps is not just a workflow: it changes how you debug. When something breaks in production, the first question is "what is the declared state, and where does reality differ?", and the answer is usually visible in Git and Grafana. Also: observability pays for itself the first time you actually need it. And working within a limited Azure credit budget is a great forcing function for cost-conscious infrastructure.
What is next
Publishing the repository, adding more phases (ingress hardening, secret management, CI security gates), and writing follow-up posts on specific pieces — Terraform modules, OIDC setup, and Grafana dashboards.