Deploying to EKS

llms.txt lists every page for an agent

Optional: hand this page to your coding agentThe steps work by hand too.

Read https://intentius.io/chant/lexicons/aws/eks-kubernetes/.
Set up the cross-lexicon project the page describes: the aws lexicon for the cluster and its IAM roles, the k8s lexicon for the workloads, with the CloudFormation outputs flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built template and manifests.
List the deploy steps (`npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/lexicons/aws/eks-kubernetes/.
Set up the cross-lexicon project the page describes: the aws lexicon for the cluster and its IAM roles, the k8s lexicon for the workloads, with the CloudFormation outputs flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built template and manifests.
List the deploy steps (`npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Optional: hand this page to your coding agent

Read https://intentius.io/chant/lexicons/aws/eks-kubernetes/.
Set up the cross-lexicon project the page describes: the aws lexicon for the cluster and its IAM roles, the k8s lexicon for the workloads, with the CloudFormation outputs flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built template and manifests.
List the deploy steps (`npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

AWS infrastructure and Kubernetes workloads can live in the same src/ directory. The AWS lexicon produces a CloudFormation template; the K8s lexicon produces kubectl-ready YAML.

Architecture

┌─────────────────────────────────────┐
│  AWS Lexicon (CloudFormation)       │
│  ┌──────────┐  ┌──────────────┐    │
│  │ VPC/Nets │  │ EKS Cluster  │    │
│  └──────────┘  └──────┬───────┘    │
│  ┌──────────┐         │            │
│  │ IAM Roles│ ←── OIDC Provider    │
│  └────┬─────┘                      │
│  ┌────┴─────────────────────┐      │
│  │ Add-ons: vpc-cni, ebs,  │      │
│  │ coredns, kube-proxy     │      │
│  └──────────────────────────┘      │
└───────┼─────────────────────────────┘
        │ ARNs flow down via .env
┌───────▼─────────────────────────────┐
│  K8s Lexicon (kubectl apply)        │
│  ┌────────────┐  ┌──────────────┐  │
│  │ Namespace  │  │ IRSA SA      │  │
│  │ + Quotas   │  │ (role-arn)   │  │
│  └────────────┘  └──────────────┘  │
│  ┌────────────┐  ┌──────────────┐  │
│  │ Autoscaled │  │ ALB Ingress  │  │
│  │ Service    │  │ (cert-arn)   │  │
│  └────────────┘  └──────────────┘  │
│  ┌────────────┐  ┌──────────────┐  │
│  │ EBS Storage│  │ FluentBit    │  │
│  │ Class      │  │ + ADOT       │  │
│  └────────────┘  └──────────────┘  │
└─────────────────────────────────────┘

Cross-lexicon value flow

CloudFormation stack outputs map to K8s composite props via .env:

CF Output	K8s Composite Prop
`appRoleArn`	`IrsaServiceAccount({ iamRoleArn })`
`externalDnsRoleArn`	`ExternalDnsAgent({ iamRoleArn })`
`fluentBitRoleArn`	`FluentBitAgent({ iamRoleArn })`
`adotRoleArn`	`AdotCollector({ iamRoleArn })`
ACM cert ARN	`AlbIngress({ certificateArn })`
Cluster name	`FluentBitAgent({ clusterName })`, `AdotCollector({ clusterName })`

Values pass from .env to config.ts to the K8s source files. npm run load-outputs refreshes .env after any infra deploy.

K8s composites used

The K8s lexicon provides EKS-specific composites for the workload side:

IrsaServiceAccount — ServiceAccount with IAM role annotation for IRSA
AlbIngress — Ingress with ALB Controller annotations, SSL redirect, shared ALB groups
EbsStorageClass — gp3 encrypted StorageClass via EBS CSI
EfsStorageClass — ReadWriteMany StorageClass via EFS CSI
FluentBitAgent — DaemonSet for CloudWatch logging
ExternalDnsAgent — Route53 DNS record management
AdotCollector — CloudWatch/X-Ray metrics and traces

See the EKS Composites reference for full API details.

Deploy workflow

npm run build          # Build CF template + K8s manifests
npm run deploy-infra   # Deploy CloudFormation stack
npm run configure-kubectl  # Set up kubeconfig
npm run load-outputs   # Write real ARNs to .env
npm run build:k8s      # Rebuild K8s with real values
npm run apply          # kubectl apply