<p>I am studying about CI/CD on AWS (CodePipeline/CodeBuild/CodeDeploy) and found it to be a very good tool for managing a pipeline on the cloud with everything managed (don't even need to install Jenkins on EC2).</p>
<p>I am now reading about container building and deployment. For the build phase, CodeBuild supports building container images. For the deploy phase, while I could find a CodeDeploy solution to ECS cluster, it seems there is no direct CodeDeploy solution for EKS (kindly correct if I am wrong).</p>
<p><a href="https://i.stack.imgur.com/pV4iz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pV4iz.png" alt="Code_Deploy_ECS" /></a></p>
<p>May I know if there is a solution to integrate EKS cluster (i.e. the deploy phase can fetch the docker image from ECR or dockerhub and deploy to EKS)? I have come across some ideas using lamda functions to trigger the cluster to perform rolling update of the container image, but I could not find a step-by-step guide on this.</p>
<h1>=========================</h1>
<p>(Update 17 Sep 2020)</p>
<p>Somehow managed to create a lambda function to trigger an update to EKS to perform rolling update of the k8s deployment. Thanks <a href="https://stackoverflow.com/users/9896523/prashanna">Prashanna</a> for the source base.</p>
<p>Just want to share the key setups in the process.</p>
<p>(1) Update the lambda execution role to include permission to describe EKS clusters</p>
<p>Create a policy with describe EKS cluster access, and attach to the role:</p>
<p>Policy snippet:</p>
<pre><code>...
......
&quot;Action&quot;: &quot;eks:Describe*&quot;
...
......
</code></pre>
<p>Or you can create a &quot;EKSFullAccess&quot; policy, and attach to the lambda execution role</p>
<p><a href="https://i.stack.imgur.com/Lv4Wy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Lv4Wy.png" alt="EKSFullAccess" /></a></p>
<p><a href="https://i.stack.imgur.com/UIYMl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UIYMl.png" alt="enter image description here" /></a></p>
<p>(2) Update the k8s ConfigMap, and supplement the lambda execution role ARN to the mapRole section. The corresponding k8s role should be a role that has permission to update container images (say system:masters) used for the k8s deployment</p>
<p>You can edit the map with command like below:</p>
<pre><code>kubectl edit -n kube-system configmap/aws-auth
</code></pre>
<p>You don't have to add/update another ConfigMap even if your deployment is in another namespace. It will take effect as well.</p>
<p><a href="https://i.stack.imgur.com/Xe5GO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Xe5GO.png" alt="Updated_ConfigMap" /></a></p>
<p>Sample lambda function call request and response:</p>
<p><a href="https://i.stack.imgur.com/hHKPi.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hHKPi.png" alt="Lambda_Function_Request" /></a></p>
<p><a href="https://i.stack.imgur.com/h3SZa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/h3SZa.png" alt="Lambda_Function_Response" /></a></p>

<p>Gitab provides the inbuilt integration of EKS and deployment with the help of Helm charts. If you plan to use other tools Using AWS lambda to update the image is the best bet!</p>
<p>I've added my github project.</p>
<p>Setup a lambda with below code and give RBAC access to this lambda in your EKS. Try invoking the lambda by passing the required information like namespace, deployment, image etc</p>
<p><a href="https://github.com/Prashanna313/AWS_Lambda_with_K8s" rel="nofollow noreferrer">Lambda for Kubernetes image update</a></p>
<p>The lambda must require EKS:describecluster policy.</p>
<p>The Lambda role must be provided atleast update image RBAC role in EKS cluster <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">RBAC role setup</a></p>
