Building a GitOps platform on EKS for a national media and events company
84 ECS services, two clusters, one Git repo: how a media company went from click-ops to self-service pull request environments.
Industry: Media and events
Company size: 200-500 employees
Services: Platform engineering, Kubernetes, GitOps, migrations
The Challenge
A national media and events company had grown into 84 services on ECS Fargate spread across AWS accounts. Secrets were managed by hand, every pull request that needed a test environment went through the platform team, and there was no regular patching cadence. Engineers were waiting on infrastructure instead of shipping.
Our Approach
We built a two-cluster EKS platform, non-production and production, managed entirely from one Git repository with Flux. Cluster provisioning is CloudFormation applied by GitHub Actions; everything above the cluster reconciles from Git in ordered dependency layers.
Platform foundation
- Karpenter for right-sized nodes, KEDA for event-driven scaling, Kyverno for policy as code
- Sealed Secrets and External Secrets so nothing sensitive lives outside Git or AWS
- Traefik ingress with SSO forward-auth, Harbor as a private registry with peer-to-peer image distribution
- Managed MySQL and PostgreSQL through the Percona Everest operator
- Prometheus, Loki, and Grafana for observability, with one Grafana serving both clusters
Self-service for developers
- Ephemeral per-pull-request environments: a Helm chart, a Go Kubernetes operator with a custom resource, and a dashboard for logs, restarts, and teardown
- Time-limited sandbox namespaces with guardrails, so experiments clean up after themselves
- A library of a dozen reusable GitHub Actions workflows and self-hosted runners
Operations you can hand to an agent
Read-only endpoints for cluster state, Flux status, and Grafana sit behind an IP-restricted internal load balancer, so both engineers and AI assistants can answer "what's deployed and is it healthy" without cluster credentials.
The Results
- Pull request environments in minutes, created and destroyed by developers without a ticket
- Every change reviewable in Git, from cluster add-ons to database instances
- Recurring audits for CVEs and version drift, with fixes flowing through the same GitOps pipeline
- Cost work in the open: a single-AZ consolidation of non-prod identified in the $600 to $750 per month range from cross-zone traffic alone
Key Takeaway
A platform pays for itself when developers stop waiting. GitOps gave this team an audit trail for free; the operator and sandboxes gave them their afternoons back.
Related guide: ECS vs EKS: when moving is worth it, and what it actually saves
Related case study: One login for every internal tool: Authentik as the front door to a Kubernetes platform
Outgrowing ECS or click-ops?
We'll show you what a GitOps platform would look like for your services, and what the migration order should be.