What creating an EKS cluster takes, drawn step by step — a VPC with public and private subnets in two zones, an internet and a NAT gateway, the cluster role and the node role with only the policies they need, iam:PassRole, the control plane in AWS's own account, its access entries, and one node group of three nodes that join it.
An EKS cluster is a control plane that AWS runs, and nodes that run in our own account.
- The control plane (the API server, etcd, the controllers) runs in an account of AWS's: we never see its
instances.
- The nodes are EC2 instances in our VPC.
- The creation needs, in this order:
- a network for the nodes;
- two IAM roles: one for the control plane, one for the nodes;
- the cluster;
- a node group, which joins the cluster, so it comes last.
Reading the drawing
- Our AWS account, the blue frame: the two IAM roles on the left, the VPC on the right.
- Each role shows whom it trusts, and each policy what it allows. Only the policies the creation needs are drawn.
- The VPC has two zones, each with a public and a private subnet, and each subnet its route to the outside.
- AWS's account, the brown frame: the control plane EKS runs for us, its endpoint, its access entries and the node
group. The nodes themselves are in our account: the cluster spans both.
- A tooltip on each role: what the control plane may do in our account, and which programs on a node use the
node role.
- Our workstation, under them: the AWS CLI commands, and the permissions the creation asks of us.
- The events, far right: each step's explanation.
The permissions
The creation involves three identities, each with permissions of its own.
- The cluster role (
shop-cluster): what the control plane acts as in our account. - The node role (
shop-nodes): what every node acts as. Without any one of its three policies, the nodes start
but never become Ready. - Us: besides the right to create each part,
iam:PassRole on both roles, which lets us hand them to EKS.
IAM decides what each identity may do in AWS. Inside Kubernetes, the cluster's access entries decide it: EKS
adds one for us, the creator, as cluster admin, and one for the node role, so the nodes may join.
The same cluster in the console
Eks Console Walkthrough builds the same network and cluster from the
AWS console, screen by screen.