Operate · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Cluster access (access entries)
aws eks list-access-entries --cluster-name prod | Principals with cluster access |
aws eks create-access-entry --cluster-name prod --principal-arn <role-arn> | Give an IAM role an entry |
aws eks associate-access-policy --cluster-name prod --principal-arn <role-arn> --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy --access-scope type=namespace,namespaces=shop | Attach a managed access policy, scoped to a namespace |
Pod permissions
aws eks create-pod-identity-association --cluster-name prod --namespace shop --service-account orders --role-arn <role-arn> | Pod Identity: link a ServiceAccount to a role |
aws eks list-pod-identity-associations --cluster-name prod | Existing associations |
kubectl -n shop exec deploy/orders -- aws sts get-caller-identity | Which role does the pod really get? |
Inspect
kubectl get nodepools,ec2nodeclasses | Karpenter configuration |
kubectl get nodeclaims -o wide | Nodes Karpenter launched (type, zone, capacity type) |
kubectl -n kube-system logs deploy/karpenter -f | Why it launched or removed a node (namespace depends on install) |
kubectl get nodes -L karpenter.sh/capacity-type,node.kubernetes.io/instance-type,topology.kubernetes.io/zone | Capacity type, instance type and zone per node |
Protect a workload
karpenter.sh/do-not-disrupt: "true" | Pod annotation: don't voluntarily disrupt this pod's node |
PodDisruptionBudget | Karpenter respects PDBs when draining |
Drivers
aws eks create-addon --cluster-name prod --addon-name aws-ebs-csi-driver | EBS CSI driver (give it a role via Pod Identity) |
aws eks create-addon --cluster-name prod --addon-name aws-efs-csi-driver | EFS CSI driver |
kubectl get csidrivers | ebs.csi.aws.com, efs.csi.aws.com, … |
Tiers
gp3 (WaitForFirstConsumer) | Hot: databases, general RWO volumes |
io2 | Hot and demanding: consistent high IOPS |
EFS (access points) | Shared RWX files across AZs |
S3 (+ Mountpoint CSI) | Cold, large, read-heavy data; backups |
Controller
helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName=prod | Install (after creating its IAM role; eks = https://aws.github.io/eks-charts) |
kubectl -n kube-system logs deploy/aws-load-balancer-controller | Why an LB wasn't created |
kubectl get ingress,svc -A -o wide | LB DNS names on Ingresses and Services |
Subnet tags (required for discovery)
kubernetes.io/role/elb = 1 | Public subnets for internet-facing LBs |
kubernetes.io/role/internal-elb = 1 | Private subnets for internal LBs |
Before
aws eks list-insights --cluster-name prod | Upgrade insights: deprecated APIs, add-on compatibility and more |
aws eks describe-addon-versions --addon-name vpc-cni --kubernetes-version 1.33 --query 'addons[].addonVersions[0].addonVersion' | Latest add-on version for the target Kubernetes version |
kubectl get pdb -A | Budgets that could block node replacement |
Do
aws eks update-cluster-version --name prod --kubernetes-version 1.33 | Upgrade the control plane (or change the version in Terraform) |
aws eks update-addon --cluster-name prod --addon-name coredns --addon-version <v> | Upgrade an add-on |
aws eks update-nodegroup-version --cluster-name prod --nodegroup-name system | Roll a managed node group to the new version |
