Amazon EKS — CI/CD Pipelines for EKS

CI/CD Pipelines for EKS

End-to-end pipeline: code → build → test → container image → deploy to EKS.

---

Pipeline Architecture

CI/CD Pipeline for EKS
┌──────────────────────────────────────────────────┐
│                                                  │
│  CI (Continuous Integration)                     │
│  ┌──────┐  ┌──────┐  ┌──────┐  ┌──────────┐   │
│  │ Code │─▶│Build │─▶│ Test │─▶│ Container│   │
│  │ Push │  │      │  │      │  │  Image   │   │
│  └──────┘  └──────┘  └──────┘  └────┬─────┘   │
│                                      │ push     │
│                                ┌─────▼──────┐   │
│                                │    ECR     │   │
│                                └─────┬──────┘   │
│                                      │          │
│  CD (Continuous Delivery)            │          │
│  ┌──────────┐    ┌──────────┐  ┌────▼─────┐   │
│  │ Update   │───▶│ ArgoCD   │─▶│  EKS     │   │
│  │ manifests│    │ (sync)   │  │ (deploy) │   │
│  └──────────┘    └──────────┘  └──────────┘   │
│                                                  │
└──────────────────────────────────────────────────┘

---

GitHub Actions Example

name: Deploy to EKS
on:
  push:
    branches: [main]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        run: |
          docker build -t ${{ secrets.ECR_REGISTRY }}/myapp:${{ github.sha }} .
          docker push ${{ secrets.ECR_REGISTRY }}/myapp:${{ github.sha }}

      - name: Update kubeconfig
        run: aws eks update-kubeconfig --name demo --region us-east-1

      - name: Deploy
        run: |
          kubectl set image deployment/web web=${{ secrets.ECR_REGISTRY }}/myapp:${{ github.sha }}
          kubectl rollout status deployment/web

---

AWS CodePipeline

# Create pipeline with CodePipeline
# Source: CodeCommit/GitHub
# Build: CodeBuild (Dockerfile)
# Deploy: EKS via kubectl or Helm

$ aws codepipeline create-pipeline --cli-input-json file://pipeline.json

---

Best Practices

Practice	Why
Use image tags (not latest)	Reproducible deployments
Scan images for vulnerabilities	Security
Use IRSA for CI/CD service accounts	Least privilege
Separate CI and CD	CI builds, CD deploys (separation of concerns)
Use GitOps (ArgoCD/Flux) for CD	Auditable, reversible deployments

---

Common Mistakes

Mistake	Impact
Using latest tag	Can’t track what’s deployed
Hardcoded credentials	Security risk
No image scanning	Vulnerable containers in production
CI directly deploys to production	No approval, no audit trail

---

What’s Next?

Practice: Deployments & CI/CD Exercises.