Amazon EKS - User Guide

1 Amazon EKSUser GuideAmazon EKS User GuideAmazon EKS: User GuideCopyright 2018 Amazon Web Services, Inc. and/or its affiliates. All rights 's trademarks and trade dress may not be used in connection with any product or service that is not Amazon 's, in any mannerthat is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon . All other trademarks notowned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored EKS User GuideTable of ContentsWhat Is Amazon EKS?

2 1 How Does Amazon EKS Work? .. 2 Getting Started .. 3 Amazon EKS Prerequisites .. 3 Create your Amazon EKS Service Role .. 3 Create your Amazon EKS Cluster VPC .. 3 Install and Configure kubectl for Amazon EKS .. 4(Optional) Download and Install the Latest AWS CLI .. 6 Step 1: Create Your Amazon EKS Cluster .. 7 Step 2: Configure kubectl for Amazon EKS .. 9 Step 3: Launch and Configure Amazon EKS Worker Nodes .. 10 Step 4: Launch a Guest Book Application.. 12 Step 5: Cleaning Up Guest Book Objects.

3 15 Clusters.. 16 Creating a Cluster .. 16 Deleting a Cluster.. 19 Platform Versions .. 20 Worker Nodes .. 21 Amazon EKS-Optimized AMI .. 21 Amazon EKS-Optimized AMI Build Scripts .. 22 Amazon EKS-Optimized AMI with GPU Support .. 22 Partner AMIs .. 24 Launching Amazon EKS Worker Nodes .. 25 Storage Classes.. 28 Load Balancing.. 30 Networking .. 31 Cluster VPC Considerations.. 31 VPC Tagging Requirement .. 31 Subnet Tagging Requirement .. 32 Private Subnet Tagging Requirement for Internal Load Balancers.

4 32 Cluster Security Group Considerations .. 32 Pod Networking .. 33 CNI Configuration Variables .. 35 External SNAT .. 36 CNI Custom Networking .. 39 CNI Upgrades.. 40 Installing Calico on Amazon EKS .. 41 Stars Policy Demo .. 42 Managing Cluster Authentication.. 46 Installing kubectl.. 46 MacOS .. 47 Linux.. 48 Windows .. 48 Configure kubectl for Amazon EKS .. 49 Create a kubeconfig for Amazon EKS .. 51 Managing Users or IAM Roles for your Cluster .. 54 Service Limits.

5 58 IAM Policies, Roles, and Permissions .. 59 Policy Structure .. 59 Policy Syntax .. 59 Actions for Amazon EKS .. 60 Testing Permissions .. 60 Creating IAM Policies .. 61 Amazon EKS Service IAM Role .. 62iiiAmazon EKS User GuideCheck for an Existing AWSS erviceRoleForAmazonEKS Role .. 62 Creating the AWSS erviceRoleForAmazonEKS role .. 62 Tutorial: Deploy Kubernetes Dashboard .. 64 Prerequisites .. 65 Step 1: Deploy the Dashboard .. 66 Step 2: Create an eks-admin Service Account and Cluster Role Binding.

6 67 Step 3: Connect to the Dashboard .. 68 Step 4: Next Steps .. 69 Tutorial: Creating a VPC for Amazon EKS .. 70 Step 1: Create an Elastic IP Address for Your NAT Gateway .. 70 Step 2: Run the VPC Wizard .. 70 Step 3: Create Additional Subnets .. 71 Step 4: Tag your Private Subnets .. 71 Step 5: Create a Control Plane Security Group .. 72 Next Steps .. 72 CloudTrail .. 73 Amazon EKS Information in CloudTrail .. 73 Understanding Amazon EKS Log File Entries.

7 74 Shared Responsibility .. 75 Troubleshooting .. 76 Insufficient Capacity .. 76aws-iam-authenticator Not Found .. 76 Worker Nodes Fail to Join Cluster .. 76hostname doesn't match.. 76 CNI Log Collection Tool .. 76 Document History .. 78 AWS Glossary .. 80ivAmazon EKS User GuideWhat Is Amazon EKS? Amazon Elastic Container Service for Kubernetes ( Amazon EKS) is a managed service that makes it easyfor you to run Kubernetes on AWS without needing to stand up or maintain your own Kubernetes controlplane.

8 Kubernetes is an open-source system for automating the deployment, scaling, and managementof containerized EKS runs Kubernetes control plane instances across multiple Availability Zones to ensure highavailability. Amazon EKS automatically detects and replaces unhealthy control plane instances, and itprovides automated version upgrades and patching for EKS is also integrated with many AWS services to provide scalability and security for yourapplications, including the following: Elastic Load Balancing for load distribution IAM for authentication Amazon VPC for isolationAmazon EKS runs up-to-date versions of the open-source Kubernetes software, so you can use all theexisting plugins and tooling from the Kubernetes community.

9 Applications running on Amazon EKS arefully compatible with applications running on any standard Kubernetes environment, whether runningin on-premises data centers or public clouds. This means that you can easily migrate any standardKubernetes application to Amazon EKS without any code modification EKS User GuideHow Does Amazon EKS Work?How Does Amazon EKS Work?Getting started with Amazon EKS is , create an Amazon EKS cluster in the AWS Management Console or with the AWS CLI or one ofthe AWS , launch worker nodes that register with the Amazon EKS cluster.

10 We provide you with an AWSC loudFormation template that automatically configures your your cluster is ready, you can configure your favorite Kubernetes tools (such as kubectl) tocommunicate with your and manage applications on your Amazon EKS cluster the same way that you would with anyother Kubernetes more information about creating your required resources and your first Amazon EKS cluster, seeGetting Started with Amazon EKS (p. 3).2 Amazon EKS User GuideAmazon EKS PrerequisitesGetting Started with Amazon EKSThis getting started Guide helps you to create all of the required resources to get started with EKS PrerequisitesBefore you can create an Amazon EKS cluster, you must create an IAM role that Kubernetes can assumeto create AWS resources.