deploy-aws

Deploy to EKS

Authorization Protocol

This skill enforces the Agent Behavior Protocol (AGENTS.md).

Env	Mode	What the agent does
dev	AUTO	Execute all steps
staging	CONSULT	Show diff + image tag + namespace, wait for approval before kubectl apply
prod	STOP	Never apply directly. Require merge to main + GitHub Environment production approval

On prod invocation, emit:

[AGENT MODE: STOP]
Operation: Direct kubectl apply to EKS production
Reason: Prod deploys flow through GitHub Actions with required_reviewers (ADR-002)

and halt.

Pre-Flight Checklist

• Verify context: kubectl config current-context must be EKS cluster
• Docker image built and pushed to ECR
• Kustomize overlay patched with correct image tag
• Terraform applied for any new infrastructure
• Model artifact uploaded to S3
• All tests passing in CI

Step 1: Verify Cluster Context

kubectl config current-context
# Expected: arn:aws:eks:{REGION}:{ACCOUNT}:cluster/{CLUSTER_NAME}

Switch context:

aws eks update-kubeconfig --name {CLUSTER} --region {REGION}

Step 2: Build and Push Image

export VERSION=v{X.Y.Z}
export SHA=$(git rev-parse --short HEAD)
export REGISTRY={ACCOUNT}.dkr.ecr.{REGION}.amazonaws.com/{REPO}

# Authenticate to ECR
aws ecr get-login-password --region {REGION} | docker login --username AWS --password-stdin ${REGISTRY}

docker build -t ${REGISTRY}/{service}:${VERSION} -t ${REGISTRY}/{service}:sha-${SHA} .
docker push ${REGISTRY}/{service}:${VERSION}
docker push ${REGISTRY}/{service}:sha-${SHA}

Step 3: Update Kustomize Overlay

# k8s/overlays/aws-{env}/kustomization.yaml  (env = dev | staging | production)
images:
  - name: {service}-predictor
    newName: {ACCOUNT}.dkr.ecr.{REGION}.amazonaws.com/{REPO}/{service}
    newTag: {VERSION}

Step 4: Apply Manifests

# Apply the overlay matching the target environment.
# Production deploys are gated by the dev → staging → prod chain (ADR-011);
# manual application here is for dev iteration or emergency only.
kubectl apply -k k8s/overlays/aws-{env}/    # env = dev | staging | production
kubectl rollout status deployment/{service}-predictor -n {namespace} --timeout=300s