Chapter 80: DevOps Projects Part 10: Jenkins Agents Freestyle Pipeline Webhook Sonar ECR EKS Approval Libraries Backup

80.7 Project 73: Deploy to EKS from Jenkins

By Ravindra Bagale Last updated: 28 October 2026

Friends, the image is in ECR; now pods must move. Today we kubeconfig to EKS, set the Deployment image to the git SHA, roll out, and wait for healthy pods.

What you will build in this project

Authenticate kubectl to the EKS cluster.
Update Deployment image to the SHA tag.
Rollout status until ready.
Smoke curl the service.

1. Start from a real company story

At Flipkart in Bengaluru, a Jenkins job applied YAML with :latest and mixed old and new pods during Big Billion Days prep.

Rough cost: about ₹60 lakh in cart errors that evening.

Priya forced image: SHA from the same build that pushed to ECR.

Today we deploy that way.

Picture 1: Jenkins → aws eks update-kubeconfig → kubectl set image → rollout status

Ravindra Bagale's Tip

Students keep a long-lived kubeconfig with admin in Jenkins home. Use short-lived roles and least privilege. Keep that habit.

2. Start and prepare

Step 1: Why from Jenkins

Why: Same build that pushed should deploy. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'One pipeline: build push deploy with the same GIT_SHA'

You will see:

One pipeline: build push deploy with the same GIT_SHA

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/jen73 && echo 'Today: kubeconfig, set image, rollout, smoke'

You will see:

Today: kubeconfig, set image, rollout, smoke

What it means: Scope.

Example 3: a3

Type this:

echo 'Never type a different tag than the one just pushed'

You will see:

Never type a different tag than the one just pushed

What it means: Rule.

Step 2: Kubeconfig stage

Why: aws eks update-kubeconfig. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: auth tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' '    stage(\'Kubeconfig\') {' '      steps {' '        sh \'aws eks update-kubeconfig --name shop-eks --region ap-south-1\'' '      }' '    }' > /tmp/jen73/KUBE.txt && cat /tmp/jen73/KUBE.txt

You will see:

stage('Kubeconfig') {

What it means: Kube.

Example 5: b2

Type this:

echo 'Agent IAM role needs eks:DescribeCluster and matching RBAC'

You will see:

Agent IAM role needs eks:DescribeCluster and matching RBAC

What it means: IAM.

Example 6: b3

Type this:

echo 'kubectl auth can-i get pods -n shop'

You will see:

kubectl auth can-i get pods -n shop

What it means: RBAC check.

Step 3: Manifest tip

Why: Deployment name. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'namespace: shop' 'deployment: cart' 'container: cart' > /tmp/jen73/NAMES.txt && cat /tmp/jen73/NAMES.txt

You will see:

deployment: cart

What it means: Names.

Example 8: c2

Type this:

echo 'Keep base manifests in git; only image tag changes in CI'

You will see:

Keep base manifests in git; only image tag changes in CI

What it means: GitOps bridge.

Example 9: c3

Type this:

echo 'Project 85 will move this to Argo CD; learn kubectl first'

You will see:

Project 85 will move this to Argo CD; learn kubectl first

What it means: Later.

3. Build the main pieces

Step 4: Set image

Why: Point to SHA. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl set image. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '    stage(\'Deploy\') {' '      steps {' '        sh \'kubectl -n shop set image deploy/cart cart=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/$REPO:$GIT_SHA\'' '      }' '    }' > /tmp/jen73/DEPLOY.txt && cat /tmp/jen73/DEPLOY.txt

You will see:

stage('Deploy') {

What it means: Deploy.

Example 11: d2

Type this:

echo 'GIT_SHA must be the env from the Build stage of this run'

You will see:

GIT_SHA must be the env from the Build stage of this run

What it means: Same SHA.

Example 12: d3

Type this:

echo 'If the name is wrong, set image fails fast — good'

You will see:

If the name is wrong, set image fails fast — good

What it means: Fail fast.

Step 5: Rollout status

Why: Block until ready. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: wait. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '    stage(\'Wait\') {' '      steps {' '        sh \'kubectl -n shop rollout status deploy/cart --timeout=180s\'' '      }' '    }' > /tmp/jen73/WAIT.txt && cat /tmp/jen73/WAIT.txt

You will see:

stage('Wait') {

What it means: Wait.

Example 14: e2

Type this:

echo 'Timeout fails the stage so you do not smoke a half rollout'

You will see:

Timeout fails the stage so you do not smoke a half rollout

What it means: Timeout.

Example 15: e3

Type this:

echo 'Watch events: kubectl -n shop describe deploy/cart | tail'

You will see:

Watch events: kubectl -n shop describe deploy/cart | tail

What it means: Events.

Step 6: Smoke

Why: curl the service. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: smoke stage. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' '    stage(\'Smoke\') {' '      steps {' '        sh \'kubectl -n shop get svc cart -o wide\'' '        sh \'curl -fsS --max-time 5 http://cart.shop.svc.cluster.local/ | head -1\'' '      }' '    }' > /tmp/jen73/SMOKE.txt && head -6 /tmp/jen73/SMOKE.txt

You will see:

stage('Smoke') {

What it means: Smoke.

Example 17: f2

Type this:

echo 'From outside the cluster use the ingress host instead'

You will see:

From outside the cluster use the ingress host instead

What it means: Ingress.

Example 18: f3

Type this:

printf '%s\n' 'Acceptance: rollout status OK and curl 200' > /tmp/jen73/ACCEPT.txt && cat /tmp/jen73/ACCEPT.txt

You will see:

Acceptance: rollout status OK and curl 200

What it means: Gate.

4. Automate and verify

Step 7: Undo practice

Why: Muscle memory. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: rollout undo. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'kubectl -n shop rollout undo deploy/cart'

You will see:

kubectl -n shop rollout undo deploy/cart

What it means: Undo.

Example 20: g2

Type this:

echo 'kubectl -n shop rollout status deploy/cart --timeout=180s'

You will see:

kubectl -n shop rollout status deploy/cart --timeout=180s

What it means: Wait undo.

Example 21: g3

Type this:

echo 'Record why you undid in the Jenkins build description'

You will see:

Record why you undid in the Jenkins build description

What it means: Note.

Step 8: Namespace RBAC

Why: Least privilege. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: role tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

printf '%s\n' 'Jenkins agent Role: get,list,watch,update on deployments,services,pods in shop' 'No cluster-admin for CI' > /tmp/jen73/RBAC.txt && cat /tmp/jen73/RBAC.txt

You will see:

No cluster-admin for CI

What it means: RBAC.

Example 23: h2

Type this:

echo 'Separate roles for staging and production namespaces'

You will see:

Separate roles for staging and production namespaces

What it means: Split.

Example 24: h3

Type this:

echo 'Approval before prod comes in project 74'

You will see:

Approval before prod comes in project 74

What it means: Bridge.

Step 9: ImagePullSecrets

Why: Private ECR. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: pull secret tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

echo 'EKS nodes with the right IAM role pull ECR without a dockerconfig secret'

You will see:

EKS nodes with the right IAM role pull ECR without a dockerconfig secret

What it means: Node IAM.

Example 26: i2

Type this:

echo 'If you must use a pull secret, rotate it with External Secrets later'

You will see:

If you must use a pull secret, rotate it with External Secrets later

What it means: Later.

Example 27: i3

Type this:

echo 'ImagePullBackOff usually means wrong tag or missing IAM'

You will see:

ImagePullBackOff usually means wrong tag or missing IAM

What it means: Debug.

5. Harden and accept

Step 10: Story Flipkart

Why: latest mix. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At Flipkart in Bengaluru, Jenkins applied :latest and mixed pods during Big Billion Days prep.' 'Priya forced image SHA from the same build that pushed to ECR.' > /tmp/jen73/STORY.txt && wc -l /tmp/jen73/STORY.txt

You will see:

2 /tmp/jen73/STORY.txt

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹60 lakh in cart errors that evening'

You will see:

Rough cost: about ₹60 lakh in cart errors that evening

What it means: Cost.

Example 30: j3

Type this:

echo 'Priya: PASS'

You will see:

Priya: PASS

What it means: Sign-off.

Step 11: Proof

Why: Stage files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

ls /tmp/jen73

You will see:

ACCEPT.txt\nDEPLOY.txt\nKUBE.txt\nNAMES.txt\nRBAC.txt\nSMOKE.txt\nSTORY.txt\nWAIT.txt

What it means: Tree.

Example 32: k2

Type this:

grep GIT_SHA /tmp/jen73/DEPLOY.txt

You will see:

sh 'kubectl -n shop set image deploy/cart cart=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/$REPO:$GIT_SHA'

What it means: SHA deploy.

Example 33: k3

Type this:

echo 'Next: Approval before production project 74'

You will see:

Next: Approval before production project 74

What it means: Bridge.

Step 12: Acceptance

Why: SHA live on EKS. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'rollout status OK'

You will see:

rollout status OK

What it means: Rollout.

Example 35: z2

Type this:

echo 'curl smoke 200'

You will see:

curl smoke 200

What it means: Smoke.

Example 36: z3

Type this:

echo 'undo practiced once'

You will see:

undo practiced once

What it means: Undo.

Check yourself

Q1. Who fixed Flipkart latest mix?

Priya

Q2. Cluster API?

EKS

Q3. Image tag?

git SHA

Q4. Wait command?

rollout status

Q5. Undo command?

rollout undo

Q6. Smoke tool?

curl

Friends, you deployed a SHA image to EKS from Jenkins. Did you understand? Let us try it once more. Roll back to the previous ReplicaSet with kubectl rollout undo and watch pods return.

Lab: try at home

Wire kubeconfig stage.
set image to SHA.
Wait rollout.
Smoke and undo practice.

Recap

Same SHA from push.
rollout status blocks.
Least privilege kube.
Undo is muscle memory.
Smoke after deploy.