<p>I'm using Azure DevOps, to handle PBI, repos, PRS, and builds, but all my infrastructure, including Kubernetes is managed by AWS.</p>

<p>There's not documentation, neither "the right and easy way" of how to deploy to AWS EKS using Azure DevOps Tasks.</p>

<p>I found <a href="https://www.dragonspears.com/blog/a-ci-cd-pipeline-with-azure-devops-and-aws-managed-kubernetes" rel="noreferrer">this solution</a>, its a good solution, but would be awesome to know how you guys resolve it, or if there are more approaches.</p>

David Noreña
<p>After a research and try and failure, I found another way to do it, without messing around with shell scripts.</p>

<p>You just need to apply the following to Kubernetes, It will create a ServiceAccount and bind it to a custom Role, that role will have the permissions to create/delete deployments and pods (tweak it for services permissions).</p>

<p><strong>deploy-robot-conf.yaml</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-robot
automountServiceAccountToken: false
---
apiVersion: v1
kind: Secret
metadata:
  name: deploy-robot-secret
  annotations:
    kubernetes.io/service-account.name: deploy-robot
type: kubernetes.io/service-account-token
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: deploy-robot-role
  namespace: default
rules: # ## Customize these to meet your requirements ##
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["create", "delete"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: global-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: deploy-robot
  namespace: default
roleRef:
  kind: Role
  name: deploy-robot-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>This will have the minimum permissions needed for Azure DevOps be able to deploy to the cluster.</p>

<p><strong>Note:</strong> Please tweak the rules at the role resource to meet your need, for instance services resources permissions.</p>

<p>Then go to your release and create a Kubernetes Service Connection:</p>

<p><a href="https://i.stack.imgur.com/hvPD0.png" rel="noreferrer"><img src="https://i.stack.imgur.com/hvPD0.png" alt="Kubernetes Service Connection"></a></p>

<p>Fill the boxes, and follow the steps required to get your secret from the service account, remember that is <strong>deploy-robot</strong> if you didn't change the yaml file.</p>

<p><a href="https://i.stack.imgur.com/aFwNf.png" rel="noreferrer"><img src="https://i.stack.imgur.com/aFwNf.png" alt="Kubernetes Service Connection"></a></p>

<p>And then just use your Kubernetes Connection:</p>

<p><a href="https://i.stack.imgur.com/yr2se.png" rel="noreferrer"><img src="https://i.stack.imgur.com/yr2se.png" alt="Release with Kubernetes Connection"></a></p>
