K
Q

How to include AWS EKS with CI/CD?

9/14/2020

I am studying about CI/CD on AWS (CodePipeline/CodeBuild/CodeDeploy) and found it to be a very good tool for managing a pipeline on the cloud with everything managed (don't even need to install Jenkins on EC2).

I am now reading about container building and deployment. For the build phase, CodeBuild supports building container images. For the deploy phase, while I could find a CodeDeploy solution to ECS cluster, it seems there is no direct CodeDeploy solution for EKS (kindly correct if I am wrong).

Code_Deploy_ECS

May I know if there is a solution to integrate EKS cluster (i.e. the deploy phase can fetch the docker image from ECR or dockerhub and deploy to EKS)? I have come across some ideas using lamda functions to trigger the cluster to perform rolling update of the container image, but I could not find a step-by-step guide on this.

=========================

(Update 17 Sep 2020)

Somehow managed to create a lambda function to trigger an update to EKS to perform rolling update of the k8s deployment. Thanks Prashanna for the source base.

Just want to share the key setups in the process.

(1) Update the lambda execution role to include permission to describe EKS clusters

Create a policy with describe EKS cluster access, and attach to the role:

Policy snippet:

...
......
"Action": "eks:Describe*"
...
......

Or you can create a "EKSFullAccess" policy, and attach to the lambda execution role

EKSFullAccess

enter image description here

(2) Update the k8s ConfigMap, and supplement the lambda execution role ARN to the mapRole section. The corresponding k8s role should be a role that has permission to update container images (say system:masters) used for the k8s deployment

You can edit the map with command like below:

kubectl edit -n kube-system configmap/aws-auth

You don't have to add/update another ConfigMap even if your deployment is in another namespace. It will take effect as well.

Updated_ConfigMap

Sample lambda function call request and response:

Lambda_Function_Request

Lambda_Function_Response

-- Patrick C.
amazon-eks
aws-code-deploy
aws-codebuild
aws-codepipeline
kubernetes

Similar Questions

Kubernetes - pod FailedScheduling due to "No nodes are available that match all of the predicates: MatchInterPodAffinity (1)."
Kubernetes is not re-pulling an image with ImagePullPolicy: Always
kubectl exec does not work with kubectl proxy
Kubernetes ExternalName service does not resolve
Is there a way to rollout a deployment by modify Kubernetes Object Deployment?

2 Answers

9/14/2020

Gitab provides the inbuilt integration of EKS and deployment with the help of Helm charts. If you plan to use other tools Using AWS lambda to update the image is the best bet!

I've added my github project.

Setup a lambda with below code and give RBAC access to this lambda in your EKS. Try invoking the lambda by passing the required information like namespace, deployment, image etc

Lambda for Kubernetes image update

The lambda must require EKS:describecluster policy.

The Lambda role must be provided atleast update image RBAC role in EKS cluster RBAC role setup

-- Prashanna
Source: StackOverflow
9/14/2020

Since there's no built-in CI/CD for EKS at the moment, this is going to be a showcase of success/failure stories of a 3rd-party CI/CDs in EKS :) My take: https://github.com/fluxcd/flux

Pros:

  • Quick to set up initially (until you get into multiple teams/environments)
  • Tracks and deploys image releases out of box
  • Possibility to split what to auto-deploy in dev/prod using regex. E.g. all versions to dev, only minor to prod. Or separate tag prefixes for dev/prod.
  • All state is in git - a good practice to start with

Cons:

  • Getting complex for further pipeline expansion, e.g. blue-green, canary, auto-rollbacks, etc.
  • The dashboard is proprietary (weave works product)
  • Not for on-demand parametrized job runs like traditional CIs.

Setup:

  • Setup an automated image build (looks like you've already figured out)
  • Setup flux and helm-operator into the cluster, point them to your "gitops repo"
  • For each app, create a HelmRelease object that describes a regex of image tag to track

Done. A newly published image tag that falls into regex will be auto-deployed to the cluster and the new version is committed to a gitops repo.

-- Max Lobur
Source: StackOverflow