DevSecOps Mega Project

.
├── api/                        # Node.js backend
│   ├── Dockerfile
│   ├── Jenkinsfile             # CI pipeline for the API
│   ├── routes/                 # authRoutes.js, userRoutes.js
│   ├── controllers/            # authController.js, userController.js
│   ├── models/                 # Sequelize models
│   ├── migrations/             # DB schema migrations
│   └── seeders/                # Initial data (admin user)
│
├── client/                     # React frontend
│   ├── Dockerfile              # Multi-stage: build React → serve with nginx
│   ├── Jenkinsfile             # CI pipeline for the frontend
│   ├── default.conf            # nginx config (proxies /api to backend)
│   └── src/
│       ├── pages/              # Login, Register, Dashboard
│       └── context/            # AuthContext (JWT management)
│
├── kubernetes/
│   ├── base/                   # Shared K8s manifests (no env-specific values)
│   │   ├── api-manifests/      # API Deployment + ClusterIP Service
│   │   ├── client-manifests/   # Client Deployment + ClusterIP Service
│   │   ├── mysql-db/           # ConfigMap, ExternalName Service, Migration Job
│   │   ├── aws-sm/             # ServiceAccount + SecretProviderClass (AWS SM)
│   │   └── ingress/            # Ingress resource (path-based routing)
│   │
│   ├── overlays/
│   │   ├── dev/                # EKS overlay: RDS, AWS SM, Traefik, Let's Encrypt
│   │   └── local/              # Kind overlay: MySQL pod, Vault, nginx, self-signed TLS
│   │
│   └── infra/                  # Cluster-level prereqs (cert-manager issuers, ESO stores)
│
└── jenkins/
    ├── Jenkins-agent.yaml      # CI agent pod template (nodejs, sonar, trivy, buildkitd, etc.)
    ├── Jenkins-agent-cd.yaml   # CD agent pod template (kubectl only, no PVC dependency)
    ├── Jenkinsfile-cd-local    # CD pipeline: deploy CI-built image to local Kind cluster
    └── setup/                  # One-shot deployment for local CI/CD stack
        ├── deploy.sh           # Idempotent script: deploys SonarQube + Jenkins
        ├── jenkins-values.yaml # Jenkins Helm values (JCasC, plugins, ingress)
        ├── sonarqube-values.yaml # SonarQube Community Helm values (ingress, TLS)
        ├── kustomization.yaml  # RBAC, buildkitd, certs stub, NVD PVC
        ├── rbac.yaml           # ClusterRole for Jenkins agent pods + local namespace deploy
        ├── buildkitd.yaml      # BuildKit daemon for rootless image builds
        ├── dependency-check-pvc.yaml  # 5Gi PVC — persists NVD database between builds
        └── credentials-template.yaml  # Template for jenkins-credentials Secret

User Browser
     │
     │  HTTPS  (port 443)
     ▼
┌─────────────────────────────────────────────────────┐
│              Ingress Controller (nginx)              │
│          cert-manager TLS termination                │
│                  host: app.local                     │
└────────────────┬────────────────────────────────────┘
                 │
        ┌────────┴────────┐
        │  Path routing   │
        │                 │
   path: /api/*      path: /
        │                 │
        ▼                 ▼
  ┌──────────┐      ┌──────────────┐
  │api-service│      │client-service│
  │ port 5000 │      │   port 80    │
  └─────┬─────┘      └──────┬───────┘
        │                   │
        ▼                   ▼
  ┌──────────┐      ┌──────────────┐
  │  API Pod  │      │  Client Pod  │
  │ (Node.js) │      │   (nginx)    │
  └─────┬─────┘      └──────────────┘
        │
        ▼
  ┌───────────┐
  │mysql-db   │  ← ClusterIP Service (local: selects MySQL pod)
  │  Service  │    (dev: ExternalName → AWS RDS endpoint)
  └─────┬─────┘
        │
        ▼
  ┌───────────┐
  │  MySQL    │
  │  Pod/RDS  │
  └───────────┘

HashiCorp Vault
  (secret/app: DB_USER, DB_PASSWORD, JWT_SECRET)
        │
        │  HTTP API (token auth)
        ▼
External Secrets Operator
  (ClusterSecretStore: vault-backend)
        │
        │  creates / refreshes every 1h
        ▼
  K8s Secret: app-secrets  (namespace: local)
        │
        │  envFrom: secretRef
        ▼
  API Pod  +  Migration Job
  (reads DB_USER, DB_PASSWORD, JWT_SECRET as env vars)

cert-manager ClusterIssuer (selfsigned-issuer / letsencrypt)
        │
        │  issues certificate for app.local / your-domain.com
        ▼
  K8s Secret: app-tls-local  (type: kubernetes.io/tls)
        │
        │  referenced by Ingress spec.tls
        ▼
  Ingress Controller  →  terminates TLS for all inbound HTTPS

git push
    │
    ▼
Stage 1: Checkout          — pull source from Git (dev branch)
Stage 2: Compilation       — syntax check all .js files
Stage 3: Gitleaks          — scan for leaked secrets
Stage 4: SCA               — OWASP Dependency-Check (CVE audit, cached NVD DB via PVC)
Stage 5: SAST              — SonarQube static analysis
Stage 6: Quality Gate      — fail build if SonarQube gate fails
Stage 7: Docker Build      — buildx multi-arch build via BuildKit, push to DockerHub
Stage 8: Trivy Scan        — scan pushed image for OS/library CVEs
Stage 9: Deploy            — trigger deploy-to-local with BUILD_NUMBER (wait: false)

deploy-to-local(API_IMAGE_TAG=<build_number>)
    │
    ▼
Stage 1: Checkout           — pull latest manifests from main branch
Stage 2: Update Image Tags  — sed-patch kustomization.yaml with new tag
Stage 3: Deploy             — kubectl delete old migration job
                              kubectl apply -k kubernetes/overlays/local
Stage 4: Verify Rollout     — rollout status + API /health + /live check

git push (dev branch)
    ↓
api-ci (Stage 1-8)  →  amitactive2008/api:<BUILD_NUMBER> pushed to DockerHub
    ↓ Stage 9 (wait: false)
deploy-to-local (Stage 1-4)  →  kustomization.yaml patched
                                  kubectl apply -k overlays/local
                                  Pods rolling update in local namespace

https://sonarqube.kind.local/admin/webhooks → Create
  Name: jenkins
  URL:  http://jenkins.jenkins.svc.cluster.local:8080/sonarqube-webhook/