Prima – Senior SRE Tech Challenge (2026)

Overview

This repository contains a reliability-focused implementation of the Prima Senior SRE Tech Challenge. The solution was tested on WSL/Ubuntu24.04LTS.

The system exposes a simple UI powered by React, a simple user management API backed by DynamoDB and S3, designed with scalability, security, and operational reliability in mind.

prerequisites

You need to have a Linux Distribution to run the solution, if you are using Windows, you can choose WSL/Ubuntu(,which is my primary work environment). Please check whether you have installed the followings:

• Python
• Docker
• kubectl
• minikube
• Helm CLI
• Flux CLI
• MiniKube
• LocalStack
• nvm, node 20.0

I chose VS code for editor.

Architecture

High-Level Architecture

Client
  ↓
Kubernetes Service (Ingress)
  ↓
Python API (FastAPI)
  ↓
AWS Services
   ├─ DynamoDB (user metadata)
   └─ S3 (avatar storage)

Infrastructure is provisioned via Terraform and deployed into Kubernetes using Helm.

---

I did not design a LoadBalancer because I am using Minikube for K8s. All services in K8s are exposed via ClusterIP using Port-forward

Design Decisions

• FastAPI was chosen for its async support, performance, and built-in OpenAPI documentation.
• DynamoDB provides fully managed, highly available storage with no operational overhead.
• S3 ensures durable and scalable object storage for user avatars.
• Docker enables immutable builds and reproducible deployments.
• Kubernetes + Helm provide scalability, self-healing, and configuration management.
• FluxCD provide GitOps workflow to achive reconciliation automatically
• OpenTofu provide integration seamlessly with existing GitOps workflow
• LocalStack provide a local, free cost environment for DynamoDB, S3 simulation

API Endpoints

GET /users

Returns a list of all users.

Example response:

[
  {
    "name": "Test User",
    "email": "test-user@prima.it",
    "avatar_url": "https://..."
  }
]

POST /user

Creates a new user and uploads an avatar image.

• Multipart form data
• Fields: name, email, avatar

DELETE /user

Deletes a new user

• Fields: email

Local Development with Docker

Prerequisites

• Docker
• Docker Compose
• Python 3.11+
• Terraform
• Localstack

Run locally with Docker

First, you need to run a Localstack with Docker.

docker pull localstack/localstack

docker run -d \
  --name localstack \
  -p 4566:4566 \
  -p 4571:4571 \
  localstack/localstack

docker logs -f localstack

Simply run the follwing commands to run the Solution.

- make setup                    # Running setup
- make up                       # Starting services
- make down                     # Stopping services
- make clean                    # Cleaing up

I created several commmands to simplify the development.

- make dev-tools                # One time but to install dev tools
- make format                   # Format python code
- make lint                     # Lint python code
- make test                     # Run test for python code
- tf-init-localstack            # Running terraform init (localstack)  
- tf-validate-localstack        # Running terraform validate (localstack)
- tf-plan-localstack            # Running terraform plan (localstack)

Local Development with Minikube(K8s)

Prerequisites

• Minikube
• Kubectl
• Helm CLI
• Flux CLI

Run Minikube

First, you need to run Minkube

minikube start --driver=docker --profile=flux-cluster --cpus 4 --memory 8196

Second, Flux bootstrap for GitHub (GitOps workflow)

export GITHUB_TOKEN=[GITHUB_PAT_TOKEN]

flux bootstrap github \
      --token-auth \
      --owner=[GITHUB_ACCOUNT] \
      --repository=gitops-terraform-workflow \
      --branch=main \
      --path=clusters/local \
      --personal

Third, install TF-Controller

kubectl apply -f https://raw.githubusercontent.com/flux-iac/tofu-controller/main/docs/release.yaml

kubectl apply -f cluster/dev/github-repository-secret.yaml

kubectl apply -f cluster/dev/ingress.yaml

kubectl apply -f cluster/dev/dev-iac-automation.yaml

Finally, you need to create a custom Docker image to run the TF-controller.

docker build -f ./Docker/Dockerfile.tfcontroller -t <savagame>/gitops-terraform:tf_az_cli_1_1 .

docker push <savagame>/gitops-terraform:tf_az_cli_1_1

After that, you need to do the following to experiment the solution.

• kubectl port-forward svc/prima-api-prima-api 8000:8000 # expose APIs
• kubectl port-forward svc/prima-api-prima-api-frontend 8080:80 # expose Front-end
• kubectl port-forward svc/localstack 4566:4566 -n localstack # expose localstack

Infrastructure as Code

Terraform provisions:

• DynamoDB table for users
• S3 bucket for avatars
• IAM roles and policies
• IAM Roles for Service Accounts (IRSA) for Kubernetes

Why IRSA?

Using IRSA avoids static AWS credentials and follows AWS security best practices by granting least-privilege permissions to the pod.

Kubernetes Deployment

The application is deployed using a custom Helm chart.

Features

• Deployment with configurable replicas
• Liveness & readiness probes
• Horizontal Pod Autoscaler (HPA)
• Resource requests & limits
• Environment-based configuration

CI/CD Pipeline

A YAML-based CI/CD pipeline is provided using GitHub Actions.

Pipeline Stages

1. Lint and test Python code
2. Build Docker image
3. Security scanning (optional)
4. Helm chart validation and change tag of values.yaml with the latest image

Design Rationale

• Shift-left testing improves reliability
• Immutable Docker images reduce deployment risk
• YAML-based workflows ensure transparency and portability

Production Considerations

The following improvements would be implemented in a real production environment:

• HTTPS via Ingress + cert-manager
• WAF and rate limiting
• Centralized logging (ELK / CloudWatch)
• Metrics with Prometheus & Grafana
• Distributed tracing (OpenTelemetry)
• Blue/Green or Canary deployments

Conclusion

This project demonstrates a reliability-driven approach to application delivery, focusing on automation, scalability, security, and operational excellence. All components are designed to be production-ready while remaining simple and maintainable.