Skip to main content

Provisioning EKS cluster

Amazon EKS (Elastic Kubernetes Service) is a managed Kubernetes service provided by AWS. It allows you to run Kubernetes — an open-source container orchestration system — without having to install, operate, or maintain your own Kubernetes control plane or nodes manually.

This page covers three steps:

  1. Creating the EKS cluster
  2. Creating a Node Group
  3. Enabling the OIDC Provider

Prerequisites​

Before you begin, ensure the following are in place:

  • The VPC and security groups from Configuring virtual network are fully configured.
  • Your AWS IAM user or role has sufficient permissions to create EKS clusters, IAM roles, and node groups.
  • You are working in the correct AWS region where your VPC was created.

Step 1: Create the EKS Cluster​

Steps​

  1. In the AWS Console, navigate to EKS → Clusters and click Add Cluster → Create.
  2. Under configuration options, select Custom configuration.
  3. EKS Auto Mode — Toggle "Use EKS Auto Mode" to turn it on. EKS Auto Mode automates compute, storage, and networking management for your cluster.
  4. Enter a Cluster name (e.g., Adeptia_EKS_AC4).
  5. Create the Cluster IAM Role— This role allows EKS to manage AWS resources on your behalf:
    1. Click Create Recommended Role.
    2. Trusted entity type: keep AWS service selected.
    3. Use case: keep EKS selected → select EKS - Cluster.
    4. Click Next. Verify that AmazonEKSClusterPolicy and AmazonEKSServicePolicy are listed under Permissions policies.
    5. Click Next, give the role a suitable name, and click Create Role.
    6. Return to the EKS creation wizard and select the newly created role.
  6. Kubernetes version — Select the latest stable version.
  7. Upgrade policy — Select Standard.
  8. Leave Cluster access and Envelope encryption as default.
  9. ARC Zonal Shift — Enable this to allow traffic to be shifted away from an impaired Availability Zone. This can also be changed later.
  10. Enable Deletion protection to prevent accidental cluster deletion.
  11. Add tags if required, then click Next.
  12. Select the VPC and subnets on which you want to deploy the application. These should have been created as part of Configuring virtual network.
  13. Select the default security group. Leave all other networking settings as default.
  14. Under Cluster endpoint access, select Private and click Next.
  15. Metrics — If you want Prometheus or CloudWatch monitoring, enable it here. Otherwise, leave everything as-is and click Next.
  16. On the Add-onsscreen, search for and select the following add-ons by checking the box next to each one, then configure them:
    1. External DNS
    2. EFS CSI Driver
    3. Amazon VPC CNI
    4. Also install the following add-ons (keep default settings for each):
      • CoreDNS
      • kube-proxy
      • (Optional): Node monitoring agent
      • Metrics Server
      • Amazon EKS Pod Identity Agent
      • (Optional): Fluent Bit
  17. Under Configure selected add-ons settings, keep defaults and click Next.
  18. Review the configuration and click Create to create the EKS cluster.

Cluster creation typically takes 10–15 minutes. Wait until the cluster status shows Active before proceeding to Step 2.

Step 2: Create a Node Group​

A Node Group provisions the EC2 instances (worker nodes) that run your Kubernetes workloads. Node groups use EC2 Auto Scaling groups to manage compute capacity.

Steps​

  1. Once the cluster is active, open it and go to the Compute tab.
  2. Click Add Node Group.
  3. Enter a Node group name (e.g., AC4_NodeGroup).
  4. Create the Node IAM Role— This role allows EC2 instances to join the EKS cluster and interact with AWS services:
    1. Click Create Recommended Role.
    2. Trusted entity type: keep AWS service selected.
    3. Use case: keep EC2 selected.
    4. Click Next. Search for and select the following permissions policies:
      • AdministratorAccess
      • AmazonEC2ContainerRegistryReadOnly
      • AmazonEKS_CNI_Policy
      • AmazonEKSWorkerNodePolicy
    5. Click Next, give the role a suitable name, and click Create Role.
    6. Return to the Node Group creation wizard and select the newly created role.
  5. Add labels, taints, and tags if required. Otherwise, leave defaults and click Next.
  6. AMI type — Select Amazon Linux.

Note: In AWS EKS version 1.33, only Amazon Linux is available as an AMI type when creating a Node Group. Ubuntu is not available.

  1. Capacity type — Select On-Demand for better availability.
  2. Instance type — Choose an instance type with a minimum of 8 cores and 32 GB memory.
  3. Disk size — Set to 80 GB.
  4. Node group scaling configuration:
    • Desired size — The number of nodes the group launches with initially.
    • Minimum size — The minimum number of nodes the group can scale in to.
    • Maximum size — The maximum number of nodes the group can scale out to.
  5. Node group update configuration — Set the maximum number or percentage of unavailable nodes to tolerate during a node group version update. Keep the update strategy as Default.
  6. Node auto repair — Enable this. When enabled, Amazon EKS continuously monitors node health and automatically detects and replaces nodes when issues occur.
  7. Click Next and select the subnets — public or private, depending on your application availability requirements.
  8. Review the configuration and click Create.

Verification​

Once the node group is created, go to the Compute tab of your cluster. The node group should appear with status Active and the desired number of nodes in a Ready state.

Step 3: Enable the OIDC Provider​

Why OIDC is Required​

By default, applications running in Kubernetes that need access to AWS services (such as EFS, DynamoDB, or SQS) would either need IAM user credentials stored in pods (insecure) or rely on node-level IAM roles (where all pods on a node share the same permissions).

OIDC (OpenID Connect) integrates IAM with Kubernetes service accounts, enabling fine-grained, per-pod permissions. This is required for add-ons like the EFS CSI Driver to function correctly.

Steps​

  1. Open AWS CloudShell by clicking the CloudShell icon in the top bar of the AWS Console.
  2. Run the following command to associate the OIDC provider with your cluster:

Code

eksctl utils associate-iam-oidc-provider --cluster <name of EKS> --region <region-name> --approve

Verification​

To confirm the OIDC provider is successfully associated, run:

Code

aws eks describe-cluster --name <name of EKS> --region <region-name> --query "cluster.identity.oidc.issuer" --output text

You should receive output similar to: https://oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED123456789

If this command returns no output, the OIDC provider is missing. Proceed to the Troubleshooting section below.

Troubleshooting​

eksctl: command not found​

If you receive this error when running the eksctl command, install eksctl in AWS CloudShell:

  1. Download the latest eksctl binary:

Code

curl --silent --location "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_Linux_amd64.tar.gz" | tar xz -C /tmp
  1. Move the binary to a location in your PATH:

Code

sudo mv /tmp/eksctl /usr/local/bin
  1. Verify the installation:

Code

eksctl version
  1. Re-run the OIDC association command:

Code

eksctl utils associate-iam-oidc-provider --cluster <name of EKS> --region <region-name> --approve
  1. Verify the association was successful by running:

Code

[Code]  aws eks describe-cluster --name <name of EKS> --region <region-name> --query "cluster.identity.oidc.issuer" --output text

You should see output like https://oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED123456789 3. If still no output, navigate to IAM Console → Identity providers and confirm an entry like oidc.eks.us-east-1.amazonaws.com/id/XYZ exists. If it does not, contact your AWS administrator.

The next step is to set up the EFS.