AWS EKS Starter

EKS Setup Process

EKS will setup and manage our Kubernetes clusters:

In short, you will get an EKS control plane and you'll just need to setup the worker nodes in the availability zones.

The from the laptop, you can use kubectl to talk to AWS.

There is also deep integration with AWS:

EKS Use cases

The Course

EKS Architecture

EKS Architecture

EKS itself will manage all the load and master nodes and etcd as needed.

Basic EKS Setup

Basic setup

Setup for the EKS cluster

IAM User roles

IAM user and permissions

To be able to run through this course your IAM user needs to have certain privileges to e.g. create all the required resources and objects. According AWS Best Practices you should never use your root account for working with AWS services. E.g. to demonstrate the Hands-On lectures, the user eks-course has been used.

There are 2 attempts to follow:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["eks:*"],
      "Resource": "*"
    }
  ]
}
copy

CloudFormation-Admin-policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["cloudformation:*"],
      "Resource": "*"
    }
  ]
}
copy

Finally, assign the following policies to your IAM user you are going to use throughout the course:

Create IAM role

Create keypair

Create API Access key/-secret

AWS-console => IAM => Users => <your user> => tab _Security credentials_ => button _Create access key_
copy

Create base AWS infrastructure

Create VPC, subnets and security group for your K8s cluster

AWS EKS Cluster setup

To create a VPC there is a prepared CloudFormation template to use. It creates a VPC including 3 Subnets At the moment EKS is only available in the following 2 regions:

Working on the console

# eks-course-vpc.yaml
---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS EKS course'

Parameters:
  VpcBlock:
    Type: String
    Default: 192.168.0.0/16
    Description: CIDR range for VPC

  Subnet01Block:
    Type: String
    Default: 192.168.64.0/18
    Description: CIDR for first subnet within VPC

  Subnet02Block:
    Type: String
    Default: 192.168.128.0/18
    Description: CIDR for second subnet within VPC

  Subnet03Block:
    Type: String
    Default: 192.168.192.0/18
    Description: CIDR for third subnet within VPC

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-VPC'

  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'

  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Public Subnets
        - Key: Network
          Value: Public

  Route:
    DependsOn: VPCGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  Subnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone:
        Fn::Select:
          - '0'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: Subnet01Block
      VpcId:
        Ref: VPC
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-Subnet1'

  Subnet02:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone:
        Fn::Select:
          - '1'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: Subnet02Block
      VpcId:
        Ref: VPC
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-Subnet2'

  Subnet03:
    Type: AWS::EC2::Subnet

    Properties:
      AvailabilityZone:
        Fn::Select:
          - '2'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: Subnet03Block
      VpcId:
        Ref: VPC
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-Subnet3'

  Subnet01RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet01
      RouteTableId: !Ref RouteTable

  Subnet02RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet02
      RouteTableId: !Ref RouteTable

  Subnet03RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet03
      RouteTableId: !Ref RouteTable

  ControlPlaneSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Cluster communication with worker nodes
      VpcId: !Ref VPC

Outputs:
  SubnetIds:
    Description: Your subnets
    Value: !Join [',', [!Ref Subnet01, !Ref Subnet02, !Ref Subnet03]]

  SecurityGroups:
    Description: SecGroup for communication betw controlplane and workernodes
    Value: !Join [',', [!Ref ControlPlaneSecurityGroup]]

  VpcId:
    Description: The VPC Id
    Value: !Ref VPC
copy

Setting stack name

Continuing on

Creating the EKS control plane

Via CLI

aws eks create-cluster --name prod --role-arn arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-J7ONKE3BQ4PI --resources-vpc-config subnetIds=subnet-6782e71e,subnet-e7e761ac,securityGroupIds=sg-6979fe18
copy

Via GUI

EKS Control Plane

Kubernetes API server is a AWS service, hence it doesn't need dedicated EC2 instances to run.

Populate the following fields:

Then for creation:

Click on your clustername, and record the API server endpoint and Certificate authority values to configure kubectl in the next Hands-On Part IV: install & configure kubectl.

Setting up local kubectl for EKS

Recap on the kubectl setup

Install kubectl & aws-iam_authenticator

Configure kubectl

in this step we are creating a configuration file for the binary kubectl, which is the main tool to interact with Kubernetes later on.

Use template file kube-config-eks and copy it to:

apiVersion: v1
clusters:
  - cluster:
      server: <endpoint-url>
      certificate-authority-data: <base64-encoded-ca-cert>
    name: kubernetes
contexts:
  - context:
      cluster: kubernetes
      user: aws
    name: aws
current-context: aws
kind: Config
preferences: {}
users:
  - name: aws
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1alpha1
        command: aws-iam-authenticator
        args:
          - 'token'
          - '-i'
          - 'EKS-course-cluster'
copy

Now you successfully talked to the K8s control plane on AWS