Home / Platform management / Clusters / Clusters / Create Public Cloud Cluster / Create AWS EKS Cluster

Create AWS EKS Cluster

Amazon Elastic Kubernetes Service (AWS EKS) is a managed service that allows you to easily run Kubernetes across multiple availability zones on AWS without the need to install, operate, or maintain your own Kubernetes control plane or nodes, ensuring high availability. For more information about AWS EKS, please refer to the official documentation .

By using this guide, you can quickly launch an AWS EKS Kubernetes cluster in your AWS account.

Cautions

Currently, this platform cannot create an IPV6-only AWS EKS cluster. If needed, please create an AWS EKS cluster and refer to the documentation: Accessing AWS EKS Cluster .

Preparation

Install a plugin

Before installation, you need to install the AWS EKS Cluster Management Component with one click on the global plugin tab.

Create Role

A role is the permission bearer for users in AWS services. By using roles, users can access resources in other services. You need to create a role and define its permission policies before binding it to users.

Refer to the official documentation and use the console to create a role for AWS services .
In the Select Trusted Entity step, please select the current AWS account.

In the Add Permissions step, select all the policies needed from the table below, and in the Name, View, and Create step, bind the corresponding policies to the role.

Note: The names of these two roles are fixed default role names in cluster-api-provider-aws and cannot be used with other names.

Role	Policy
`eks-controlplane.cluster-api-provider-aws.sigs.k8s.io`	`AmazonEKSClusterPolicy`
`eks-nodegroup.cluster-api-provider-aws.sigs.k8s.io`	- `AmazonEC2ContainerRegistryReadOnly` - `AmazonEKS_CNI_Policy` - `AmazonEKSWorkerNodePolicy` - `AmazonEBSCSIDriverPolicy` - `AmazonEFSCSIDriverPolicy`

Create User

This platform requires access to your AWS account in order to create and manage your Kubernetes cluster in AWS EKS. You need to create a user in your AWS account for this platform and define the content that this user can access.

Tip: For more detailed information about IAM policies for EKS, please refer to the official documentation on AWS EKS IAM policies, roles, and permissions .

Create an IAM policy to define the content that the user has access to in the AWS account. Use a custom policy and follow the steps in the official documentation on creating a policy using the JSON editor to create the IAM policy and attach it to your user.
Follow the steps in the official documentation to create a user, and make sure to select all the policies created above in the Attach directly option under Set permissions.
Follow the steps in the official documentation to create an access key and secret key for the user.

Note: For security reasons, it is recommended to regularly rotate access keys and ciphertext keys. For more information, please refer to the official documentation .

]( https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console) .
Create cloud credentials on this platform here .

(Optional) Create VPC and Subnet

You need to create an Amazon VPC to launch an EKS cluster. VPC allows you to launch AWS resources into a customizable virtual network. You can manually create 1 VPC and 3 subnets with automatically assigned public IPv4 addresses, and use them when creating the cluster. If not created, the platform will automatically create 1 VPC and 3 subnets.

Refer to the official documentation for creating a VPC for your AWS EKS cluster: Creating a VPC with Public and Private Subnets for Your Amazon EKS Cluster .

Create Cluster - Basic Info

In the left navigation pane, click Clusters > Cluster of clusters.
Click on Create a cluster on the right side of the page > Create AWS EKS Cluster.

Parameter	Description
Cloud Credential	Select the cloud credential that has been created, or create a cloud credential and use it.
Region	Select the AWS region where the cluster is located. For more information, please refer to the official documentation .

Create Cluster - EKS Cluster Settings

Parameter	Description
Cluster Address Type	The address type used to access the public cloud cluster. Please ensure that the platform can access the API Server address of the AWS EKS cluster through the public network or private network. When selecting Public Network Address + Private Network Address, the platform will automatically determine the cluster address type.
Public Cloud Network	- Standard: The platform automatically creates 1 VPC and 3 subnets, with each subnet in a different availability zone. - Custom: Select the VPC and subnet that have already been created in the public cloud. The subnet needs to have the Auto-assign Public IPv4 Address feature enabled. AWS EKS requires you to specify at least two subnets in different availability zones to create elastic network interfaces for communication between the cluster and VPC. For more information, please refer to AWS EKS VPC and Subnet Requirements and Considerations
Service CIDR	The IP address range used by Kubernetes Services of type ClusterIP. It must not overlap with the subnet’s IP range.

Add Node Pool

A node pool is a collection of nodes, such as high-performance and on-demand billing node pools. You can add various types of nodes to meet the requirements of different application scenarios.

Add one or more node pools.

Parameter	Description
AMI Type	List of AMI images supported by EKS, refer to the official documentation .
Capacity Billing Method	The billing method for instances, for more details please refer to the official documentation . - On-Demand: Use on-demand instances, you pay for capacity by the second without any long-term commitments. - Spot: Amazon EC2 Spot instances provide spare Amazon EC2 capacity at a discounted price compared to on-demand instances.
Instance Type	For more information about the instance types used by the VM nodes in a node pool, see [AWS Instance Type Inventory] ( https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/instance-types.html) . Note: Since EBS does not support ‘a1.medium’, ‘a1.large’, ‘a1.xlarge’, ‘a1.2xlarge’, ‘a1.4xlarge’, if you need to use EBS, please select a different instance type.
Disk Size	Select the size of the attached EBS volume for each node.
Node Pool Scaling Configuration	Desired Nodes: Specifies the current number of nodes that the managed node group should maintain at startup. Minimum Nodes: Specifies the minimum number of nodes that the managed node group can scale down to. Maximum Nodes: Specifies the maximum number of nodes that the managed node group can scale up to.
Kubernetes Labels	Labels are key-value pairs attached to nodes, used to define attributes of the nodes.
Taints	Taints are a node property that allows nodes to reject running certain Pods or even evict Pods.

Click Create to view the progress of cluster creation.

Relevant operations

You can click on the on the right side of the cluster on the list page, or click on the Actions in the upper right corner on the details page to update the resource configuration of the nodes under the cluster or delete the clusters that are no longer in use as needed.

Operation	Description
Update	Update the created cluster configuration in Update Public Cloud Cluster Configuration, and the updated configuration will take effect in AWS EKS simultaneously.
Delete	When deleting a cluster, the resources in AWS EKS nodes will be released simultaneously. Please make sure to backup or migrate the applications in the projects that are bound to the cluster before deleting it.

Custom Policy

controllers-eks.cluster-api-provider-aws.sigs.k8s.io

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "eks:CreateFargateProfile",
                "eks:DeleteFargateProfile",
                "eks:DescribeFargateProfile",
                "eks:DeleteAddon",
                "eks:TagResource",
                "eks:UpdateAddon",
                "eks:CreateAddon",
                "eks:ListAddons",
                "eks:DescribeAddonVersions",
                "ec2:AssociateVpcCidrBlock",
                "eks:DescribeAddon",
                "ec2:DisassociateVpcCidrBlock"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:*:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "eks.amazonaws.com"
                }
            }
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:*:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "eks-nodegroup.amazonaws.com"
                }
            }
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/eks-fargate-pods.amazonaws.com/AWSServiceRoleForAmazonEKSForFargate",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "eks-fargate.amazonaws.com"
                }
            }
        },
        {
            "Sid": "VisualEditor4",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "eks.amazonaws.com"
                }
            }
        },
        {
            "Sid": "VisualEditor5",
            "Effect": "Allow",
            "Action": "iam:GetPolicy",
            "Resource": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
        },
        {
            "Sid": "VisualEditor6",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:CreateGrant"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringLike": {
                    "kms:ResourceAliases": "alias/cluster-api-provider-aws-*"
                }
            }
        },
        {
            "Sid": "VisualEditor7",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "eks:UpdateClusterVersion",
                "eks:DisassociateIdentityProviderConfig",
                "eks:UntagResource",
                "eks:UpdateClusterConfig",
                "eks:CreateNodegroup",
                "ssm:GetParameter",
                "eks:DeleteCluster",
                "eks:UpdateNodegroupVersion",
                "eks:DescribeNodegroup",
                "eks:DescribeIdentityProviderConfig",
                "eks:AssociateEncryptionConfig",
                "iam:ListAttachedRolePolicies",
                "eks:DeleteNodegroup",
                "eks:TagResource",
                "eks:UpdateNodegroupConfig",
                "eks:DescribeCluster",
                "eks:ListIdentityProviderConfigs",
                "eks:AssociateIdentityProviderConfig"
            ],
            "Resource": [
                "arn:*:ssm:*:*:parameter/aws/service/eks/optimized-ami/*",
                "arn:*:iam::*:role/*",
                "arn:*:eks:*:*:cluster/*",
                "arn:*:eks:*:*:nodegroup/*/*/*"
            ]
        },
        {
            "Sid": "VisualEditor8",
            "Effect": "Allow",
            "Action": [
                "eks:ListClusters",
                "eks:CreateCluster"
            ],
            "Resource": [
                "arn:*:eks:*:*:cluster/*",
                "arn:*:eks:*:*:nodegroup/*/*/*"
            ]
        }
    ]
}

controllers.cluster-api-provider-aws.sigs.k8s.io

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:AttachNetworkInterface",
                "ec2:DetachNetworkInterface",
                "ec2:AllocateAddress",
                "ec2:AssignIpv6Addresses",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses",
                "ec2:AssociateRouteTable",
                "ec2:AttachInternetGateway",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateInternetGateway",
                "ec2:CreateEgressOnlyInternetGateway",
                "ec2:CreateNatGateway",
                "ec2:CreateNetworkInterface",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:CreateVpc",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DeleteEgressOnlyInternetGateway",
                "ec2:DeleteNatGateway",
                "ec2:DeleteRouteTable",
                "ec2:ReplaceRoute",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:DeleteVpc",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAddresses",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeEgressOnlyInternetGateways",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeImages",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeNetworkInterfaceAttribute",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVolumes",
                "ec2:DescribeTags",
                "ec2:DetachInternetGateway",
                "ec2:DisassociateRouteTable",
                "ec2:DisassociateAddress",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:ModifySubnetAttribute",
                "ec2:ReleaseAddress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "tag:GetResources",
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:ConfigureHealthCheck",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:RemoveTags",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeInstanceRefreshes",
                "ec2:CreateLaunchTemplate",
                "ec2:CreateLaunchTemplateVersion",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:DeleteLaunchTemplate",
                "ec2:DeleteLaunchTemplateVersions",
                "ec2:DescribeKeyPairs",
                "ec2:ModifyInstanceMetadataOptions"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "autoscaling:CreateAutoScalingGroup",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:CreateOrUpdateTags",
                "autoscaling:StartInstanceRefresh",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:DeleteTags"
            ],
            "Resource": [
                "arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*"
            ],
            "Effect": "Allow"
        },
        {
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "autoscaling.amazonaws.com"
                }
            },
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
            ],
            "Effect": "Allow"
        },
        {
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
                }
            },
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
            ],
            "Effect": "Allow"
        },
        {
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "spot.amazonaws.com"
                }
            },
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "secretsmanager:CreateSecret",
                "secretsmanager:DeleteSecret",
                "secretsmanager:TagResource"
            ],
            "Resource": [
                "arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*"
            ],
            "Effect": "Allow"
        }
    ]
}

nodes.cluster-api-provider-aws.sigs.k8s.io

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:AssignIpv6Addresses",
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:CreateTags",
                "ec2:DescribeTags",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeInstanceTypes",
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:DescribeRepositories",
                "ecr:ListImages",
                "ecr:BatchGetImage"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "secretsmanager:DeleteSecret",
                "secretsmanager:GetSecretValue"
            ],
            "Resource": [
                "arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ssm:UpdateInstanceInformation",
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel",
                "s3:GetEncryptionConfiguration"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        }
    ]
}

FAQ

Using EKS Cluster Created by this Platform, “Your current IAM principal doesn’t have access to Kubernetes objects on this cluster.” Prompted on EKS Cluster Details Page

Description of the problem: After encountering the above error, users may not be able to view Kubernetes resources under the “Resources” tab and nodes under the “Compute” tab. This is because the user accessing the AWS page may not have the necessary permissions to access Kubernetes resources in the current EKS cluster. Please refer to the official troubleshooting guide for more information.

The solution: You need to manually edit the ConfigMap file by executing kubectl edit n kube-system configmaps aws-auth, and add the mapUsers field to map AWS users to Kubernetes groups. After completing this operation, the current user will be able to use the corresponding identity to operate Kubernetes resources. For detailed steps, please refer to the third step in the Required Permissions section of the AWS official documentation .

Which EKS Cluster Logs will not be Collected by Platform?

The platform currently does not collect the following logs:

Note: If you need assistance, please contact technical support for a solution.

Logs related to API requests in the cluster.
Accessing cluster-related logs through the Kubernetes API.
Logs related to authentication requests for the cluster.
Logs related to the status of the cluster controller.
Decision-making related logs.

Will this Platform Deploy Plugins on EKS Cluster?

Currently, this platform deploys the recommended versions of the following plugins on the EKS cluster:

Tip: If you need to deploy more plugins or want to adjust plugin versions, you can contact technical support for a solution.

kubeproxy: Enables service networking within the cluster.
CoreDNS: Enables service discovery in the cluster.
Amazon VPC CNI: Enables pod networking within the cluster.
EBS-Driver: The Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI) driver allows the Amazon Elastic Kubernetes Service (AWS EKS) cluster to manage the lifecycle of Amazon EBS volumes for persistent volumes.
EFS-Driver: Amazon Elastic File System (Amazon EFS) provides serverless, fully elastic file storage, allowing you to share file data without provisioning or managing storage capacity and performance.