ML-MLOps-Portfolio: Skill for Claude Code

Deploy to EKS

Authorization Protocol

This skill enforces the Agent Behavior Protocol (AGENTS.md).

Env	Mode	What the agent does
dev	AUTO	Execute all steps
staging	CONSULT	Show diff + image tag + namespace, wait for approval before kubectl apply
prod	STOP	Never apply directly. Require merge to main + GitHub Environment production approval

On prod invocation, emit:

[AGENT MODE: STOP]
Operation: Direct kubectl apply to EKS production
Reason: Prod deploys flow through GitHub Actions with required_reviewers (ADR-002)

and halt.

Pre-Flight Checklist

• Verify context: kubectl config current-context must be EKS cluster
• Docker image built and pushed to ECR
• Kustomize overlay patched with correct image tag
• Terraform applied for any new infrastructure
• Model artifact uploaded to S3
• All tests passing in CI

Step 1: Verify Cluster Context

kubectl config current-context
# Expected: arn:aws:eks:{REGION}:{ACCOUNT}:cluster/{CLUSTER_NAME}

Switch context:

aws eks update-kubeconfig --name {CLUSTER} --region {REGION}

Step 2: Build and Push Image

export VERSION=v{X.Y.Z}
export SHA=$(git rev-parse --short HEAD)
export REGISTRY={ACCOUNT}.dkr.ecr.{REGION}.amazonaws.com/{REPO}

# Authenticate to ECR
aws ecr get-login-password --region {REGION} | docker login --username AWS --password-stdin ${REGISTRY}

docker build -t ${REGISTRY}/{service}:${VERSION} -t ${REGISTRY}/{service}:sha-${SHA} .
docker push ${REGISTRY}/{service}:${VERSION}
docker push ${REGISTRY}/{service}:sha-${SHA}

Step 3: Update Kustomize Overlay

# k8s/overlays/aws-{env}/kustomization.yaml  (env = dev | staging | production)
images:
  - name: {service}-predictor
    newName: {ACCOUNT}.dkr.ecr.{REGION}.amazonaws.com/{REPO}/{service}
    newTag: {VERSION}

Step 4: Apply Manifests

# Apply the overlay matching the target environment.
# Production deploys are gated by the dev → staging → prod chain (ADR-011);
# manual application here is for dev iteration or emergency only.
kubectl apply -k k8s/overlays/aws-{env}/    # env = dev | staging | production
kubectl rollout status deployment/{service}-predictor -n {namespace} --timeout=300s