A company wants to run a containerized application on an Amazon Elastic Kubernetes Service (Amazon...

When deploying to a private Amazon EKS cluster, the Kubernetes API server endpoint is not accessible from the public internet, meaning standard CodePipeline deploy actions that use public endpoints cannot directly connect to the cluster. The correct approach is to use AWS CodeBuild running inside a VPC that has connectivity to the private EKS cluster. CodeBuild runs kubectl commands to apply Kubernetes manifests or Helm charts to update the application. Authentication credentials, specifically a kubeconfig file containing the cluster endpoint, certificate authority data, and an authentication token or exec plugin configuration, should be stored securely in AWS Secrets Manager and retrieved by the CodeBuild build environment at runtime. This approach provides secure, auditable, and repeatable deployments without exposing the EKS API server publicly. Options B and D incorrectly assume CodePipeline has a native action that can reach private EKS endpoints directly.

================