Production-grade Django deployment pipeline using AWS EKS, Helm, and GitHub Actions — keyless OIDC auth, automated rollbacks, zero-downtime releases on every git push.
Every git push to main triggers the full pipeline — from code checkout to live deployment on AWS EKS via Helm, with zero manual steps.
name: Deploy Django to EKS on: push: branches: [main] permissions: id-token: write # Required for OIDC contents: read jobs: deploy: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Configure AWS via OIDC # ← No static keys! uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: ${{ secrets.AWS_REGION }} - name: Login to ECR run: | aws ecr get-login-password | docker login \ --username AWS --password-stdin \ ${{ secrets.ECR_REGISTRY }} - name: Build & Push Docker Image run: | IMAGE_TAG=${{ github.sha }} docker build -t $ECR_REGISTRY/$ECR_REPO:$IMAGE_TAG . docker push $ECR_REGISTRY/$ECR_REPO:$IMAGE_TAG - name: Deploy to EKS via Helm run: | aws eks update-kubeconfig \ --name ${{ secrets.EKS_CLUSTER_NAME }} helm upgrade --install django-app ./django-chart \ --set image.tag=$IMAGE_TAG \ --set image.repository=$ECR_REGISTRY/$ECR_REPO \ --namespace production --create-namespace --wait
Full Kubernetes architecture on AWS EKS — AWS Load Balancer routes traffic to Django pods managed by Helm. EBS CSI provides persistent storage. Cert Manager handles TLS certificates automatically.
The django-chart/ Helm chart defines all Kubernetes resources as templates — parameterized, reusable, and version-controlled. One command deploys or upgrades everything.
replicaCount: 2 image: repository:.dkr.ecr.us-east-1.amazonaws.com/saiapp tag: latest # overridden with git SHA by CI pullPolicy: Always service: type: ClusterIP port: 80 targetPort: 8000 resources: requests: {cpu: 100m, memory: 256Mi} limits: {cpu: 500m, memory: 512Mi} autoscaling: enabled: true minReplicas: 1 maxReplicas: 4 targetCPUUtilizationPercentage: 70 ingress: enabled: true className: alb host: your-domain.com tls: true # cert-manager handles this
helm rollback reverts to any previous revision in seconds. 20+ revision history maintained.--set. Same chart works for dev and prod.helm history.# First deploy helm upgrade --install django-app ./django-chart \ --set image.tag=abc1234 \ --namespace production \ --create-namespace --wait # Check release status helm status django-app -n production # View all revisions helm history django-app -n production # REVISION STATUS CHART DESCRIPTION # 1 deployed django-0.1.0 Install # 2 deployed django-0.1.0 Upgrade # Rollback if needed helm rollback django-app 1 -n production # List all deployed releases helm list -A
Instead of storing long-lived AWS access keys as GitHub secrets, this project uses OIDC federation — GitHub Actions requests a short-lived token from AWS on each run. No credentials can be leaked or rotated.
AmazonEKSEditPolicy.Full infrastructure setup guide — provision the EKS cluster once, then all subsequent application deployments happen automatically via GitHub Actions on every git push.
helm history to see all releases.AWS_ROLE_ARN # arn:aws:iam:::role/Github AWS_REGION # us-east-1 ECR_REPOSITORY # saiapp EKS_CLUSTER_NAME # django-cluster DJANGO_SECRET_KEY # django-insecure-... (generate fresh) CSRF_TRUSTED_ORIGINS # https://your-domain.com DJANGO_SUPERUSER_PASSWORD # admin user password POSTGRES_PASSWORD # database password # Note: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are NOT needed. # OIDC handles AWS authentication without any stored credentials.