feat: add optional AWS CDK deployment for self-hosted Lightdash on EKS

[vivshri]

Adds a self-contained CDK application under deploy/aws-cdk that provisions VPC, EKS, RDS PostgreSQL, S3, IAM and Secrets Manager resources, then installs the published lightdash chart against them.

The chart is consumed from https://lightdash.github.io/helm-charts by version and is not modified, vendored or patched. Nothing under charts/ changes, and helm install into an existing cluster is unaffected.

Credentials are generated into Secrets Manager and read from inside the cluster by the External Secrets Operator, so the only credential dynamic reference in the template is the RDS master password. S3 access uses IRSA rather than access keys.

Deployed and destroyed end to end in us-west-2 before submission, which caught five things that synth, helm template and a kind install all passed over:

• postgresVersion is the major family rather than a pinned minor, because RDS had already retired the minor the default named.
• The helm release waits 13 minutes rather than 15. Fifteen is exactly the timeout of the Lambda CDK runs kubectl in, so the Lambda was killed mid-wait and the retry found the release pending-install, which no redeploy clears.
• The cluster runs in API_AND_CONFIG_MAP and adminRoleArn produces an access entry. Under CONFIG_MAP alone kubectl refuses the credentials that created the cluster and there is no way to add them.
• The release depends on the load balancer controller and the namespace on the node group. Without that the controller can be torn down before the Ingress whose finalizer only it removes, leaving the namespace Terminating, the load balancer running and the VPC undeletable.
• PGSSLMODE is no-verify rather than require. The value reaches node-postgres rather than libpq, so require left Node verifying the RDS chain against a trust store with no Amazon root and every start failed before migrating.

Closes #143

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	aws-cdk-lib@​2.265.0
	@​aws-cdk/​lambda-layer-kubectl-v31@​2.1.0
	@​types/​node@​20.19.43
	constructs@​10.8.1
	ts-node@​10.9.2
	typescript@​5.6.3
	aws-cdk@​2.1136.0

View full report