AWS EKS Deployment Guide

Prerequisites

Before deploying to Amazon EKS, ensure you have:

• AWS CLI installed and configured
• eksctl installed
• Kubernetes CLI (kubectl) installed
• Helm 3.x installed

Cluster Setup

1. Create an EKS cluster:

eksctl create cluster \
  --name prime-edm-cluster \
  --region us-west-2 \
  --nodes 3 \
  --node-type t3.medium

2. Configure kubectl:

aws eks update-kubeconfig --name prime-edm-cluster --region us-west-2

Installing Prime EDM Charts

1. Add the Helm repository:

helm repo add prime-edm https://charts.acx-sandbox.net --username $USER --password $PASSWORD
helm repo update

2. Create a values file for AWS-specific settings:

# aws-values.yaml
global:
  provider: aws
  region: us-west-2

storage:
  class: gp2
  
serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/EKS_ROLE_NAME

ingress:
  annotations:
    kubernetes.io/ingress.class: alb

3. Install the chart:

helm install prime-edm prime-edm/prime-edm -f aws-values.yaml

AWS-Specific Configuration

Storage Classes

AWS EKS provides several storage class options:

storage:
  # GP2 - General Purpose SSD
  class: gp2
  
  # IO1 - Provisioned IOPS SSD
  # class: io1
  
  # SC1 - Cold Storage
  # class: sc1

Load Balancer

Using AWS Application Load Balancer (ALB):

ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip

IAM Integration

Configure IAM roles for service accounts:

serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/EKS_ROLE_NAME

Secrets Management

AWS Secrets Manager Setup

1. Create an IAM policy for Secrets Manager access:

aws iam create-policy \
  --policy-name prime-edm-secrets-policy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret"
        ],
        "Resource": "*"
      }
    ]
  }'

2. Create IAM role for service account (IRSA):

eksctl create iamserviceaccount \
  --name prime-edm-sa \
  --namespace default \
  --cluster prime-edm-cluster \
  --attach-policy-arn arn:aws:iam::ACCOUNT_ID:policy/prime-edm-secrets-policy \
  --approve

3. Install External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace \
  --set installCRDs=true

4. Create SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-backend
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-west-2
      auth:
        jwt:
          serviceAccountRef:
            name: prime-edm-sa

5. Create ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-backend
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: username
    remoteRef:
      key: prod/db/credentials
      property: username
  - secretKey: password
    remoteRef:
      key: prod/db/credentials
      property: password

Monitoring

CloudWatch Integration

Enable CloudWatch metrics:

monitoring:
  cloudwatch:
    enabled: true
    region: us-west-2
    logGroupName: /aws/eks/prime-edm

Best Practices

1. Use node selectors for workload placement:

nodeSelector:
  eks.amazonaws.com/nodegroup: prime-edm-group

2. Configure resource requests and limits:

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 500m
    memory: 1Gi

3. Enable auto-scaling:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

Troubleshooting

Common issues and solutions:

1. ALB not provisioning:

   • Verify IAM roles
   • Check ALB controller deployment
   • Validate subnet tags

2. Storage issues:

   • Confirm storage class exists
   • Check PVC status
   • Verify IAM permissions

3. Network connectivity:

   • Review security groups
   • Check VPC configuration
   • Validate CoreDNS setup