At the Container meeting of AWSKRUG (AWS Korea Users Group), I presented a number of tips on customizing eksctl.

1. DIY Amazon EKS with eksctl
요리조리 eksctl
SA 임지훈

2. CONTENTS
01.
Intro
02.
Basic
03.
Advanced

3. Intro
1

4. eksctl
What is eksctl?
5

5. weaveworks/eksctl
https://github.com/weaveworks/eksctl/tree/main/examples
6

6. Record of intent
A Kubernetes object is a "record of intent"
7

7. Basic
2

8. Default command
eksctl: Amazon EKS Cluster with One Command
9

9. Understanding the Shared Responsibility Model
https://aws.github.io/aws-eks-best-practices/security/docs/
10

10. Default command
CloudFormation – Outputs (Cluster)
11

11. Default command
CloudFormation – Outputs (Nodegroup)
12

12. Architecture (default)
13
Public subnet
Virtual Private Cloud (192.169.0.0/16)
AWS Cloud
Availability Zone 1 Availability Zone 2
Auto Scaling group
Instance Instance
NAT gateway
Private subnet Private subnet
Internet gateway
ServiceRole
NodeInstance
Role
Public subnet
ControlPlane SG
ClusterSharedNode SG
In : X
Out : All
In : Self All, Cluster
Out : All
Cluster SG
In : Self All,
ClusterSharedNode All
Out : All

13. Security Groups (default)
https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/sec-group-reqs.html
14

14. EKS Cluster Architecture
https://aws.amazon.com/ko/blogs/containers/de-mystifying-cluster-networking-for-amazon-eks-worker-nodes/
15

15. Advanced
3

16. Architecture (3-Tier)
17
Instance
Private subnet
Private subnet
Public subnet
Virtual Private Cloud (10.0.0.0/16)
AWS Cloud
Availability Zone 1 Availability Zone 2
Instance
NAT gateway
Internet gateway
ServiceRole
NodeInstance
Role
Private subnet
Private subnet
Public subnet
NAT gateway
Auto Scaling group

17. Unmanaged
18
! When placing nodegroups inside a private subnet,
privateNetworking must be set to true on the nodegroup

18. Unmanaged – Customizing kubelet config
19

19. Dry Run (Cheat Sheet)
https://eksctl.io/usage/schema/
20
apiVersion: eksctl.io/v1alpha5
iam:
vpcResourceControllerPolicy: true
withOIDC: false
kind: ClusterConfig
metadata:
name: demo
region: ap-northeast-2
version: "1.22"
nodeGroups:
- amiFamily: AmazonLinux2
containerRuntime: dockerd
desiredCapacity: 1
disableIMDSv1: false
disablePodIMDS: false
iam:
withAddonPolicies:
albIngress: false
appMesh: null
appMeshPreview: null
autoScaler: false
awsLoadBalancerController: false
certManager: false
cloudWatch: false
ebs: false
efs: false
externalDNS: false
fsx: false
imageBuilder: false
xRay: false
instanceSelector: {}
instanceType: t3.micro
labels:
alpha.eksctl.io/cluster-name: demo
alpha.eksctl.io/nodegroup-name: my-nodegroup
name: my-nodegroup
privateNetworking: false
securityGroups:
withLocal: true
withShared: true
ssh:
allow: false
subnets:
- subnet-0659aa123b16fe5dd
- subnet-0dd2698a32d1014ea
volumeIOPS: 3000
volumeSize: 80
volumeThroughput: 125
volumeType: gp3
privateCluster:
enabled: false
skipEndpointCreation: false
vpc:
clusterEndpoints:
privateAccess: true
publicAccess: true
id: vpc-01439c15c75bd816c
manageSharedNodeSecurityGroupRules: true
nat:
gateway: Disable
subnets:
private:
private1:
az: private1
id: subnet-0659aa123b16fe5dd
private2:
az: private2
id: subnet-0dd2698a32d1014ea

20. $ eksctl create nodegroup -f <filename>.yaml
$ eksctl delete nodegroup --cluster=demo --name=managed-ng
Managed
https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateNodegroup.html
21

21. Managed – Spot, On-Demand
22

22. Managed – Custom AMI
23

23. Managed – Custom AMI
https://eksctl.io/announcements/nodegroup-override-announcement/
24
! Bare minimum
override command

24. Managed – Custom Launch Template
25

25. Launch Template support for Managed
26

26. https://eksctl.io/usage/launch-template-support/
27
Launch Template support for Managed
Custom LT
Made by EKS

27. Fargate
https://eksctl.io/usage/fargate-support/
28

28. Monitoring
https://eksctl.io/usage/cloudwatch-cluster-logging/
29

29. IAM
https://eksctl.io/usage/iam-policies/
https://eksctl.io/usage/iamserviceaccounts/
30
`--dry-run` 대신 `--approve` 옵션 제공
$ eksctl delete iamserivceaccount
--cluster <Cluster Name>
--name <ServiceAccount Name>
# OIDC는 삭제 명령어 없음

30. Add-ons
https://eksctl.io/usage/addons/
31
$ eksctl delete addon --cluster <Cluster Name> --name <Addon Name>

31. Upgrade / Update
https://eksctl.io/usage/cluster-upgrade/
https://eksctl.io/usage/addon-upgrade/
32

32. Q & A

33. More is more
cloudplayer@gsneotek.com