<p>I am new to Kubernetes and trying to create a AWS CodePipeline to deploy service to EKS stack.</p>
<p>I am following <a href="https://eksworkshop.com/intermediate/220_codepipeline/" rel="nofollow noreferrer">this</a> tutorial
I have followed all the steps including creating a role and adding permissions, so that <strong>CodeBuild</strong> will be able to talk with EKS.</p>
<p>The issue I am facing right now is when CodePipeline runs, it is failing for below command in the <strong>CodeBuild</strong> phase.</p>
<p><code>kubectl apply -f hello-k8s.yml</code></p>
<p>and giving this error</p>
<pre><code>[Container] 2019/12/04 07:41:43 Running command kubectl apply -f hello-k8s.yml 
unable to recognize &quot;hello-k8s.yml&quot;: Unauthorized 
unable to recognize &quot;hello-k8s.yml&quot;: Unauthorized 
</code></pre>
<p>I am not very much sure whether its a credentials issue, because I have used all the steps to add user/role as per tutorial.</p>
<p>Can anyone please help me on this?</p>

<p>Deploying Yaml manifests to Kubernetes from CodeBuild requires these steps:</p>

<p>The high-level process includes the following steps:</p>

<ol>
<li><p>Create an IAM Service role for CodeBuild</p></li>
<li><p>Map the CodeBuild Service role in EKS using “aws-auth” ConfigMap</p></li>
<li><p>Create source files in Code repository</p></li>
<li><p>Create and Start a CodeBuild Project</p></li>
<li><p>Confirm the required objects are created in EKS cluster</p></li>
</ol>

<h3>Create an IAM Service role for CodeBuild (Don't use existing service role as it includes a '/path/')</h3>

<p>Run the following commands to Create a CodeBuild Service Role and attach the required policies:</p>

<pre><code>TRUST = "{   \"Version\": \"2012-10-17\",   \"Statement\": [     {       \"Effect\": \"Allow\",       \"Principal\": {         \"Service\": \"codebuild.amazonaws.com\"       },       \"Action\": \"sts:AssumeRole\"     }   ] }"

$ echo '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "eks:Describe*", "Resource": "*" } ] }' &gt; /tmp/iam-role-policy

$ aws iam create-role --role-name CodeBuildKubectlRole --assume-role-policy-document "$TRUST" --output text --query 'Role.Arn'

$ aws iam put-role-policy --role-name CodeBuildKubectlRole --policy-name eks-describe --policy-document file:///tmp/iam-role-policy

$ aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess

$ aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess
</code></pre>

<h3>Map the CodeBuild Service role in EKS using “aws-auth” ConfigMap</h3>

<p>Edit the ‘aws-auth’ ConfigMap and add the Role Mapping for the CodeBuild service role:</p>

<pre><code>$ vi aws-auth.yaml



apiVersion: v1

kind: ConfigMap

metadata:

  name: aws-auth

  namespace: kube-system

data:

  mapRoles: |

    - rolearn:  arn:aws:iam::AccountId:role/devel-worker-nodes-NodeInstanceRole-14W1I3VCZQHU7

      username: system:node:{{EC2PrivateDNSName}}

      groups:

        - system:bootstrappers

        - system:nodes

    - rolearn: arn:aws:iam::AccountId:role/CodeBuildKubectlRole

      username: build

      groups:

        - system:masters


$ kubectl apply -f aws-auth.yaml
</code></pre>

<h3>Create source files in Code repository</h3>

<p>Create a repository in Github/CodeCommit with sample files as follows:</p>

<pre><code>.
├── buildspec.yml
└── deployment
   └── pod.yaml
</code></pre>

<p>A sample repository is located here: <a href="https://github.com/shariqmus/codebuild-to-eks" rel="noreferrer">https://github.com/shariqmus/codebuild-to-eks</a></p>

<p>Notes:</p>

<ul>
<li><p>The buildspec.yml file installs kubectl, aws-iam-authenticator and configure kubectl in CodeBuild environment</p></li>
<li><p>Update the buildspec.yml file with the correct region and cluster_name on Line 16</p></li>
<li><p>Add the deployment YAML files in the “deployment” directory</p></li>
</ul>

<h3>Create and Start a Build Project</h3>

<ol>
<li><p>Open the CodeBuild console</p></li>
<li><p>Click ‘Create Build Project’ button</p></li>
<li><p>Name the Project</p></li>
<li><p>Use a CodeCommit repository where you have added the attached files : “buildspec.yml” and “pod.yaml”</p></li>
<li><p>Use Managed Image > Ubuntu > Standard 1.0</p></li>
<li><p>In the Role Name, select “CodeBuildKubectlRole”</p></li>
<li><p>Click ‘Create Build Project’ button</p></li>
<li><p>Create ‘Start Build’ button to start a Build</p></li>
</ol>

<h3>Confirm the required objects are created in EKS cluster</h3>

<p>You can confirm this with a simple command, e.g.</p>

<pre><code>$ kubectl get all --all-namespaces
</code></pre>
