Build · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Inspect a cluster
aws eks list-clusters | Clusters in the region |
aws eks describe-cluster --name prod --query 'cluster.[version,status,endpoint,resourcesVpcConfig.endpointPublicAccess,resourcesVpcConfig.endpointPrivateAccess]' | Version, status, endpoint access |
aws eks update-kubeconfig --name prod --region eu-west-1 | Add the cluster to your kubeconfig |
aws eks list-addons --cluster-name prod | Installed EKS add-ons |
aws eks list-nodegroups --cluster-name prod | Managed node groups |
State
terraform init -backend-config=backend-prod.hcl | Initialise against an environment's backend |
terraform state list | Resources tracked in state |
terraform state show module.eks.aws_eks_cluster.this[0] | One resource's recorded attributes |
terraform force-unlock <lock-id> | Remove a stale lock (only when sure nobody is running!) |
Plans & drift
terraform plan -var-file=prod.tfvars -out=prod.plan | Plan and save it |
terraform apply prod.plan | Apply exactly what was planned |
terraform plan -detailed-exitcode | Exit 0 = no changes, 2 = changes (drift), 1 = error |
Patterns
exec { command = "aws" args = ["eks", "get-token", …] } | Fresh tokens during long applies |
data "terraform_remote_state" "cluster" { … } | Read the cluster layer's outputs from another stack |
terraform apply -target=module.eks | Emergency only: bootstrap one part first |
Useful commands
aws eks get-token --cluster-name prod | jq -r .status.expirationTimestamp | When does this token expire? |
terraform providers | Which providers each module uses |
Inspect
kubectl -n kube-system get ds aws-node -o jsonpath='{.spec.template.spec.containers[0].env}' | jq | VPC CNI settings (env vars) |
kubectl get nodes -o custom-columns=NAME:.metadata.name,PODS:.status.allocatable.pods | Max pods per node |
aws ec2 describe-subnets --subnet-ids <id> --query 'Subnets[].AvailableIpAddressCount' | Free IPs left in a subnet |
Key settings
ENABLE_PREFIX_DELEGATION=true | Assign /28 prefixes to ENIs (more pods per node) |
AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG=true | Pods use subnets from ENIConfig (e.g. a secondary CIDR) |
WARM_IP_TARGET / WARM_PREFIX_TARGET | How many spare IPs/prefixes each node keeps ready |
