{"id":"eks","name":"eks","summary":"AWS EKSのクラスタ、ノードグループ、ワークロード向けKubernetes管理。クラスタの作成、IRSAの設定、ノードグループの管理、アプリケーションの展開、AWSサービスとの統合などに利用します。","body":"# AWS EKS\n\nAmazon Elastic Kubernetes Service (EKS) runs Kubernetes without installing and operating your own control plane. EKS manages the control plane and integrates with AWS services.\n\n## Table of Contents\n\n- [Core Concepts](#core-concepts)\n- [Common Patterns](#common-patterns)\n- [CLI Reference](#cli-reference)\n- [Best Practices](#best-practices)\n- [Troubleshooting](#troubleshooting)\n- [References](#references)\n\n## Core Concepts\n\n### Control Plane\n\nManaged by AWS. Runs Kubernetes API server, etcd, and controllers across multiple AZs.\n\n### Node Groups\n\n| Type | Description |\n|------|-------------|\n| **Managed** | AWS manages provisioning, updates |\n| **Self-managed** | You manage EC2 instances |\n| **Fargate** | Serverless, per-pod compute |\n\n### IRSA (IAM Roles for Service Accounts)\n\nAssociates Kubernetes service accounts with IAM roles for fine-grained AWS permissions.\n\n### Add-ons\n\nOperational software: CoreDNS, kube-proxy, VPC CNI, EBS CSI driver.\n\n## Common Patterns\n\n### Create a Cluster\n\n**AWS CLI:**\n\n```bash\n# Create cluster role\naws iam create-role \\\n  --role-name eks-cluster-role \\\n  --assume-role-policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"Service\": \"eks.amazonaws.com\"},\n      \"Action\": \"sts:AssumeRole\"\n    }]\n  }'\n\naws iam attach-role-policy \\\n  --role-name eks-cluster-role \\\n  --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy\n\n# Create cluster\naws eks create-cluster \\\n  --name my-cluster \\\n  --role-arn arn:aws:iam::123456789012:role/eks-cluster-role \\\n  --resources-vpc-config subnetIds=subnet-12345678,subnet-87654321,securityGroupIds=sg-12345678\n\n# Wait for cluster\naws eks wait cluster-active --name my-cluster\n\n# Update kubeconfig\naws eks update-kubeconfig --name my-cluster --region us-east-1\n```\n\n**eksctl (Recommended):**\n\n```bash\n# Create cluster with managed node group\neksctl create cluster \\\n  --name my-cluster \\\n  --region us-east-1 \\\n  --version 1.29 \\\n  --nodegroup-name standard-workers \\\n  --node-type t3.medium \\\n  --nodes 3 \\\n  --nodes-min 1 \\\n  --nodes-max 5 \\\n  --managed\n```\n\n### Add Managed Node Group\n\n```bash\n# Create node role\naws iam create-role \\\n  --role-name eks-node-role \\\n  --assume-role-policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"Service\": \"ec2.amazonaws.com\"},\n      \"Action\": \"sts:AssumeRole\"\n    }]\n  }'\n\naws iam attach-role-policy --role-name eks-node-role --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy\naws iam attach-role-policy --role-name eks-node-role --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly\naws iam attach-role-policy --role-name eks-node-role --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy\n\n# Create node group\naws eks create-nodegroup \\\n  --cluster-name my-cluster \\\n  --nodegroup-name standard-workers \\\n  --node-role arn:aws:iam::123456789012:role/eks-node-role \\\n  --subnets subnet-12345678 subnet-87654321 \\\n  --instance-types t3.medium \\\n  --scaling-config minSize=1,maxSize=5,desiredSize=3 \\\n  --ami-type AL2_x86_64\n```\n\n### Configure IRSA\n\n```bash\n# Enable OIDC provider\neksctl utils associate-iam-oidc-provider \\\n  --cluster my-cluster \\\n  --approve\n\n# Create IAM role for service account\neksctl create iamserviceaccount \\\n  --cluster my-cluster \\\n  --namespace default \\\n  --name my-app-sa \\\n  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \\\n  --approve\n```\n\n**Manual IRSA setup:**\n\n```bash\n# Get OIDC issuer\nOIDC_ISSUER=$(aws eks describe-cluster --name my-cluster --query \"cluster.identity.oidc.issuer\" --output text)\nOIDC_ID=${OIDC_ISSUER##*/}\n\n# Create trust policy\ncat > trust-policy.json << EOF\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Principal\": {\n      \"Federated\": \"arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/${OIDC_ID}\"\n    },\n    \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n    \"Condition\": {\n      \"StringEquals\": {\n        \"oidc.eks.us-east-1.amazonaws.com/id/${OIDC_ID}:sub\": \"system:serviceaccount:default:my-app-sa\",\n        \"oidc.eks.us-east-1.amazonaws.com/id/${OIDC_ID}:aud\": \"sts.amazonaws.com\"\n      }\n    }\n  }]\n}\nEOF\n\naws iam create-role --role-name my-app-role --assume-role-policy-document file://trust-policy.json\n```\n\n### Kubernetes Service Account\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: default\n  annotations:\n    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/my-app-role\n```\n\n### Install Add-ons\n\n```bash\n# CoreDNS\naws eks create-addon \\\n  --cluster-name my-cluster \\\n  --addon-name coredns \\\n  --addon-version v1.11.1-eksbuild.4\n\n# VPC CNI\naws eks create-addon \\\n  --cluster-name my-cluster \\\n  --addon-name vpc-cni \\\n  --addon-version v1.16.0-eksbuild.1\n\n# kube-proxy\naws eks create-addon \\\n  --cluster-name my-cluster \\\n  --addon-name kube-proxy \\\n  --addon-version v1.29.0-eksbuild.1\n\n# EBS CSI Driver\naws eks create-addon \\\n  --cluster-name my-cluster \\\n  --addon-name aws-ebs-csi-driver \\\n  --addon-version v1.27.0-eksbuild.1 \\\n  --service-account-role-arn arn:aws:iam::123456789012:role/ebs-csi-role\n```\n\n### Deploy Application\n\n```yaml\n# deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: my-app\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: my-app\n  template:\n    metadata:\n      labels:\n        app: my-app\n    spec:\n      serviceAccountName: my-app-sa\n      containers:\n      - name: app\n        image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest\n        ports:\n        - containerPort: 8080\n        resources:\n          requests:\n            cpu: 100m\n            memory: 128Mi\n          limits:\n            cpu: 500m\n            memory: 512Mi\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: my-app\n  annotations:\n    service.beta.kubernetes.io/aws-load-balancer-type: nlb\nspec:\n  type: LoadBalancer\n  ports:\n  - port: 80\n    targetPort: 8080\n  selector:\n    app: my-app\n```\n\n## CLI Reference\n\n### Cluster Management\n\n| Command | Description |\n|---------|-------------|\n| `aws eks create-cluster` | Create cluster |\n| `aws eks describe-cluster` | Get cluster details |\n| `aws eks update-cluster-config` | Update cluster settings |\n| `aws eks delete-cluster` | Delete cluster |\n| `aws eks update-kubeconfig` | Configure kubectl |\n\n### Node Groups\n\n| Command | Description |\n|---------|-------------|\n| `aws eks create-nodegroup` | Create node group |\n| `aws eks describe-nodegroup` | Get node group details |\n| `aws eks update-nodegroup-config` | Update node group |\n| `aws eks delete-nodegroup` | Delete node group |\n\n### Add-ons\n\n| Command | Description |\n|---------|-------------|\n| `aws eks create-addon` | Install add-on |\n| `aws eks describe-addon` | Get add-on details |\n| `aws eks update-addon` | Update add-on |\n| `aws eks delete-addon` | Remove add-on |\n\n## Best Practices\n\n### Security\n\n- **Use IRSA** for pod-level AWS permissions\n- **Enable cluster encryption** with KMS\n- **Use private endpoint** for API server\n- **Enable audit logging** to CloudWatch\n- **Use security groups for pods**\n- **Implement network policies**\n\n```bash\n# Enable secrets encryption\naws eks create-cluster \\\n  --name my-cluster \\\n  --encryption-config '[{\n    \"provider\": {\"keyArn\": \"arn:aws:kms:us-east-1:123456789012:key/...\"},\n    \"resources\": [\"secrets\"]\n  }]' \\\n  ...\n```\n\n### High Availability\n\n- **Deploy across multiple AZs**\n- **Use managed node groups**\n- **Set pod disruption budgets**\n- **Configure horizontal pod autoscaling**\n\n### Cost Optimization\n\n- **Use Spot instances** for non-critical workloads\n- **Right-size nodes and pods**\n- **Use Fargate** for variable workloads\n- **Implement cluster autoscaler**\n- **Use Karpenter** for efficient scaling\n\n## Troubleshooting\n\n### Cannot Connect to Cluster\n\n```bash\n# Verify kubeconfig\naws eks update-kubeconfig --name my-cluster --region us-east-1\n\n# Check IAM identity\naws sts get-caller-identity\n\n# Verify cluster status\naws eks describe-cluster --name my-cluster --query 'cluster.status'\n```\n\n### Nodes Not Joining\n\n**Check:**\n- Node IAM role has required policies\n- Security groups allow node-to-control-plane communication\n- Nodes have network access to API server\n\n```bash\n# Check node status\nkubectl get nodes\n\n# Check aws-auth ConfigMap\nkubectl describe configmap aws-auth -n kube-system\n\n# Check node logs (SSH to node)\njournalctl -u kubelet\n```\n\n### Pod Cannot Access AWS Services\n\n```bash\n# Verify IRSA setup\nkubectl describe sa my-app-sa\n\n# Check pod environment\nkubectl exec my-pod -- env | grep AWS\n\n# Test credentials\nkubectl exec my-pod -- aws sts get-caller-identity\n```\n\n### DNS Issues\n\n```bash\n# Check CoreDNS pods\nkubectl get pods -n kube-system -l k8s-app=kube-dns\n\n# Test DNS resolution\nkubectl run test --image=busybox:1.28 --rm -it -- nslookup kubernetes\n\n# Check CoreDNS logs\nkubectl logs -n kube-system -l k8s-app=kube-dns\n```\n\n## References\n\n- [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/)\n- [EKS API Reference](https://docs.aws.amazon.com/eks/latest/APIReference/)\n- [EKS CLI Reference](https://docs.aws.amazon.com/cli/latest/reference/eks/)\n- [eksctl](https://eksctl.io/)\n- [EKS Best Practices Guide](https://aws.github.io/aws-eks-best-practices/)","author":"@itsmostafa","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/itsmostafa/aws-agent-skills/tree/main/skills/eks","license":"MIT","category":"document","lang":"en","tokens":2542,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[{"path":"cluster-setup.md","size":8714,"sha256":"2501966da47ff4c1267bd1d80517f8790797e5cb173feed0d51777cc2252e807"}],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["aws.github.io","docs.aws.amazon.com","eksctl.io"]}}