An Amazon EKS cheat sheet for 2026
A 35-section Amazon EKS cheat sheet has circulated for a few years —
eksctl, aws eks and kubectl one-liners from cluster creation to disaster recovery. About a third of it now does something different from what it says: it maps IAM roles into system:masters through a ConfigMap, creates clusters on Kubernetes 1.18, installs Calico for network policy, lists PodSecurityPolicies that no longer exist, and deploys blue/green through App Mesh, which reached end of support on 30 September 2026.This is the same sheet, rewritten. Every
aws eks command and parameter below was checked against the EKS API model (botocore 1.43.107); kubectl and velero commands against the versions installed here (kubectl 1.33). eksctl commands follow its documentation and were not run. Replace my-cluster and us-west-2 throughout.1. Clusters
1
2
3
4
5
6
7
8
9
10
aws eks list-clusters --region us-west-2
aws eks describe-cluster --name my-cluster --query 'cluster.{v:version,status:status,auth:accessConfig.authenticationMode}'
# Create — pick a version in standard support, and use access entries from day one
eksctl create cluster --name my-cluster --region us-west-2 --version 1.33 \
--without-nodegroup # add Karpenter or managed node groups separately
# Guard rails that did not exist when the original sheet was written
aws eks update-cluster-config --name my-cluster --deletion-protection
aws eks update-cluster-config --name my-cluster --upgrade-policy supportType=STANDARD
upgrade-policy matters more than it looks: new clusters default to extended support, which is billed. A cluster left on an old version keeps running and keeps charging.2. Who can reach the cluster: access entries, not aws-auth
The original's
eksctl create iamidentitymapping --group system:masters edits the aws-auth ConfigMap and hands out a group that no RBAC rule can ever restrict. Use access entries:1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# Switch the cluster to API-only authentication (the ConfigMap stops being read)
aws eks update-cluster-config --name my-cluster --access-config authenticationMode=API
# Give a role cluster admin
aws eks create-access-entry --cluster-name my-cluster \
--principal-arn arn:aws:iam::111122223333:role/platform-admin
aws eks associate-access-policy --cluster-name my-cluster \
--principal-arn arn:aws:iam::111122223333:role/platform-admin \
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
--access-scope type=cluster
# Give a developer edit rights in one namespace only
aws eks associate-access-policy --cluster-name my-cluster \
--principal-arn arn:aws:iam::111122223333:role/dev-team \
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy \
--access-scope type=namespace,namespaces=team-a
aws eks list-access-entries --cluster-name my-cluster
aws eks list-access-policies # the AWS-managed policies you can associate
And the API endpoint:
1
2
eksctl utils update-cluster-endpoints --cluster my-cluster --private-access=true --public-access=true --approve
eksctl utils set-public-access-cidrs --cluster my-cluster --cidrs=203.0.113.0/24 --approve
3. kubeconfig
1
2
3
4
aws eks update-kubeconfig --name my-cluster --region us-west-2 --alias my-cluster
kubectl config current-context
kubectl config use-context my-cluster
kubectl auth whoami # which IAM principal you are, as Kubernetes sees it
4. Nodes: managed node groups, Karpenter, or Auto Mode
1
2
3
4
5
6
7
# A managed node group on AL2023 across three zones
eksctl create nodegroup --cluster my-cluster --name general \
--node-type m7g.large --nodes 3 --nodes-min 3 --nodes-max 6 \
--node-ami-family AmazonLinux2023
eksctl get nodegroup --cluster my-cluster
aws eks describe-nodegroup --cluster-name my-cluster --nodegroup-name general
eksctl scale nodegroup --cluster my-cluster --name general --nodes 4
The original's
--spot node group with one instance type is the easiest way to get interrupted. Spot needs many instance types and an interruption handler; that is what Karpenter does (see Karpenter on AWS ), or EKS Auto Mode does it for you. The API's capacityType values are ON_DEMAND, SPOT and CAPACITY_BLOCK; AMI types include AL2023_x86_64_STANDARD, AL2023_ARM_64_STANDARD, the NVIDIA and Neuron variants, and Bottlerocket.Fargate is still there for pods that should not share a node:
1
eksctl create fargateprofile --cluster my-cluster --name batch --namespace batch
5. Add-ons: managed, not kubectl apply -f <url>
1
2
3
4
5
6
7
aws eks describe-addon-versions --addon-name vpc-cni --kubernetes-version 1.33 \
--query 'addons[0].addonVersions[0].addonVersion'
aws eks create-addon --cluster-name my-cluster --addon-name coredns
aws eks create-addon --cluster-name my-cluster --addon-name eks-pod-identity-agent
aws eks create-addon --cluster-name my-cluster --addon-name aws-ebs-csi-driver
aws eks create-addon --cluster-name my-cluster --addon-name amazon-cloudwatch-observability
aws eks list-addons --cluster-name my-cluster
--resolve-conflicts takes OVERWRITE, NONE or PRESERVE. The original's eksctl create addon --force is OVERWRITE: it discards any configuration someone made to the self-managed version. Use PRESERVE when adopting an add-on on a live cluster.6. Pod identity: Pod Identity first, IRSA where you must
1
2
3
4
5
6
7
8
9
# EKS Pod Identity — no OIDC provider, no annotation on the ServiceAccount
aws eks create-pod-identity-association --cluster-name my-cluster \
--namespace default --service-account my-app \
--role-arn arn:aws:iam::111122223333:role/my-app-s3-read
# IRSA, as in the original — still supported, needs the OIDC provider
eksctl utils associate-iam-oidc-provider --cluster my-cluster --approve
eksctl create iamserviceaccount --cluster my-cluster --namespace default --name my-app \
--attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess --approve
The original adds
--override-existing-serviceaccounts; leave it off unless you mean to rewrite a ServiceAccount someone else owns.7. Networking
1
2
3
4
5
6
7
8
# Network policy without Calico: the VPC CNI enforces it
aws eks update-addon --cluster-name my-cluster --addon-name vpc-cni \
--configuration-values '{"enableNetworkPolicy":"true"}'
kubectl get networkpolicy -A
# Load balancers come from the AWS Load Balancer Controller, not the in-tree provider
kubectl annotate svc my-svc service.beta.kubernetes.io/aws-load-balancer-type=external
kubectl annotate svc my-svc service.beta.kubernetes.io/aws-load-balancer-nlb-target-type=ip
The original's
kubectl expose ... --type=LoadBalancer without those annotations asks the legacy in-tree integration for a load balancer, not the controller. Install the controller (Helm, with a Pod Identity role) and annotate Services, or use an Ingress or Gateway.8. Workloads and debugging
1
2
3
4
5
6
7
8
9
kubectl apply -f deployment.yaml
kubectl rollout status deploy/my-app
kubectl rollout restart deploy/my-app # replaces the original's broken 'patch ... date' trick
kubectl set image deploy/my-app my-container=111122223333.dkr.ecr.us-west-2.amazonaws.com/my-app:1.2.3
kubectl scale deploy/my-app --replicas=3
kubectl events --for deploy/my-app
kubectl logs deploy/my-app --previous
kubectl debug -it my-pod --image=busybox:1.36 --target=my-container # distroless images have no /bin/bash
kubectl top pods # needs metrics-server
Kubernetes troubleshooting on EKS has the symptom table these belong to.
9. Security
| need | command or setting |
|---|---|
| Pod Security (the original's kubectl get psp — removed in 1.25) | kubectl label ns my-ns pod-security.kubernetes.io/enforce=restricted |
| control-plane audit logs | aws eks update-cluster-config --name my-cluster --logging '{"clusterLogging":[{"types":["api","audit","authenticator"],"enabled":true}]}' — all five types including controllerManager and scheduler is louder and costs more |
| image vulnerability scanning | Amazon Inspector (inspector2) scanning ECR, not the original's Inspector Classic start-assessment-run |
| runtime threat detection | GuardDuty EKS Protection with runtime monitoring |
| CIS benchmark | kube-bench as a Job using its EKS manifest, which mounts the host paths it needs; the original's kubectl run does not mount them and checks nothing useful |
| secrets | Secrets Manager with the Secrets Store CSI provider or External Secrets |
10. Autoscaling
1
2
kubectl autoscale deploy/my-app --min=2 --max=10 --cpu-percent=70 # needs CPU requests and metrics-server
kubectl get hpa
For nodes, the original's Cluster Autoscaler manifest still works, but on EKS today the choice is Karpenter or Auto Mode — see Karpenter on AWS .
11. Upgrades
1
2
3
4
aws eks list-insights --cluster-name my-cluster # deprecated APIs and blockers, before you start
eksctl upgrade cluster --name my-cluster --version 1.34 --approve # one minor version at a time
aws eks update-addon --cluster-name my-cluster --addon-name vpc-cni --addon-version <version-for-1.34>
eksctl upgrade nodegroup --cluster my-cluster --name general --kubernetes-version 1.34
Order: insights → control plane → add-ons → nodes. Skipping insights is how a removed API takes down a Helm release the morning after.
12. Backup and disaster recovery
1
2
3
4
5
6
7
8
velero install --provider aws \
--plugins velero/velero-plugin-for-aws:<version> \
--bucket my-velero-bucket \
--backup-location-config region=us-west-2 \
--snapshot-location-config region=us-west-2 \
--no-secret # credentials from Pod Identity or IRSA, not a key file
velero backup create nightly --include-namespaces my-app --ttl 168h
velero restore create --from-backup nightly
The original omits
--plugins, without which the AWS object store is not available, and its "cross-region replication" is aws eks create-cluster in a second region — an empty cluster, not a replica. Disaster recovery for EKS is a second cluster plus GitOps for manifests plus Velero (or AWS Backup where it covers EKS in your region — check its current resource list) for state. See Kubernetes backup and restore on AWS .13. Multi-architecture: Graviton next to x86
AWS's Deploy a Spring Boot application on a multi-architecture Amazon EKS cluster (2021, marked out of date) builds per-architecture images in two CodeBuild projects and stitches a manifest. The same result today:
1
2
3
docker buildx build --platform linux/amd64,linux/arm64 \
-t 111122223333.dkr.ecr.us-west-2.amazonaws.com/my-app:1.2.3 --push .
docker buildx imagetools inspect 111122223333.dkr.ecr.us-west-2.amazonaws.com/my-app:1.2.3 # both platforms listed?
Every node pulls the variant for its own CPU from the same tag. Add a pipeline step that fails unless both
amd64 and arm64 are listed; demo to production has the failure this prevents.14. Tools from the awesome lists that earn their place on EKS
Two curated lists — Jimmy Song's awesome-cloud-native and run-x's awesome-kubernetes — name hundreds of projects. These are the ones worth installing alongside the AWS services above:
| need | from the lists | AWS-managed default | install it when |
|---|---|---|---|
| a terminal UI | k9s, Lens | the EKS console's resource view | always, for humans |
| multi-pod logs | stern, kail | CloudWatch Logs Insights | debugging live |
| node autoscaling | Karpenter, cluster-autoscaler | EKS Auto Mode | you want control over instance choice |
| backup | Velero (the list's ark) | AWS Backup, where it covers EKS | always, for namespaced state |
| certificates | cert-manager | ACM on the load balancer | TLS terminates inside the cluster |
| secrets | external-secrets | Secrets Manager | always, to keep values out of git |
| policy | Kyverno, Gatekeeper | Pod Security Admission | you need more than the three PSA profiles |
| image scanning | Trivy, Grype | Amazon Inspector on ECR | in CI, before the image reaches ECR |
| CIS checks | kube-bench, kubescape | Security Hub's EKS controls | quarterly |
| cost by namespace | OpenCost, Kubecost | Split Cost Allocation Data for EKS in Cost Explorer | you need per-team showback |
| local dev against the cluster | Telepresence, Tilt | Session Manager port forwarding | inner-loop development |
| GitOps | Argo CD, Flux | the Argo CD EKS capability | always — see Argo CD on AWS |
| service mesh | Istio, Linkerd | VPC Lattice (App Mesh is gone) | see Istio on EKS |
What the original sheet gets wrong today
| original | problem | now |
|---|---|---|
| eksctl create iamidentitymapping ... --group system:masters | edits aws-auth; system:masters bypasses all RBAC and can never be restricted | access entries with AmazonEKSClusterAdminPolicy, and authenticationMode=API |
| eksctl create cluster --version=1.18 | out of support for years | a version in standard support |
| kubectl apply -f .../dashboard/v2.0.0/... | a manifest from 2020 | the EKS console, k9s or Lens |
| kubectl apply -f .../calico.yaml for network policy | a second CNI on top of the VPC CNI | enableNetworkPolicy on the vpc-cni add-on |
| kubectl get psp | PodSecurityPolicy removed in 1.25 | Pod Security Admission labels |
| App Mesh for blue/green; aws appmesh create-mesh | end of support 30 September 2026 | Argo Rollouts or Flagger with the load balancer controller; VPC Lattice for service-to-service routing |
| cert-manager v1.0.0 from jetstack/cert-manager with --validate=false | five years old; the repository moved | a current release from cert-manager/cert-manager |
| aws inspector start-assessment-run | Inspector Classic | Amazon Inspector (inspector2) |
| kubectl run kube-bench ... | no host mounts, so nothing meaningful is checked | the EKS Job manifest |
| kubectl patch ... '"date":"date +'%s'"' | the quoting stops date from running; it sets a literal string, once | kubectl rollout restart |
| velero install without --plugins | no AWS object store plugin | add --plugins velero/velero-plugin-for-aws:<version> |
| "cross-region replication" via aws eks create-cluster | creates an empty cluster | GitOps plus Velero into a standby cluster |
Verified, and not
Against the EKS API model (botocore 1.43.107): every
aws eks operation and flag above — access entries and access policies with cluster or namespace scope, the access-entry types, Pod Identity associations, update-cluster-config with access-config, deletion-protection and upgrade-policy, add-on conflict modes, insights, node group capacity and AMI types, and the five control-plane log types.Against installed tools:
kubectl 1.33 and velero for the commands in sections 8, 10 and 12.Not run:
eksctl is not installed here; its flags follow the eksctl documentation. No cluster was created or changed. App Mesh's end of support, Inspector Classic's status, AWS Backup's EKS coverage and Split Cost Allocation Data are from AWS announcements and documentation — check them for your region.Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article