AWS Eks

AWS EKS Skill

Analyze AWS EKS clusters with parallel execution and anti-hallucination guardrails.

Relationship to other AWS skills:

• aws-eks/ → EKS-specific analysis (clusters, nodegroups, addons, IRSA)
• aws/ → "How to execute" (parallel patterns, throttling, output format)
• k8s/ → In-cluster Kubernetes operations (pods, deployments, services)

CRITICAL: Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

#!/bin/bash
export AWS_PAGER=""

for cluster in $clusters; do
  describe_eks_cluster "$cluster" &
done
wait

Helper Functions

#!/bin/bash
export AWS_PAGER=""

# List all EKS clusters
list_eks_clusters() {
  aws eks list-clusters --output text --query 'clusters[]'
}

# Get cluster details
describe_eks_cluster() {
  local cluster=$1
  aws eks describe-cluster --name "$cluster" \
    --output text \
    --query 'cluster.[name,version,status,platformVersion,endpoint,roleArn]'
}

# List nodegroups for a cluster
list_nodegroups() {
  local cluster=$1
  aws eks list-nodegroups --cluster-name "$cluster" \
    --output text --query 'nodegroups[]'
}

# Get nodegroup details
describe_nodegroup() {
  local cluster=$1 nodegroup=$2
  aws eks describe-nodegroup --cluster-name "$cluster" --nodegroup-name "$nodegroup" \
    --output text \
    --query 'nodegroup.[nodegroupName,status,instanceTypes[0],scalingConfig.[minSize,maxSize,desiredSize],amiType,capacityType]'
}

# List addons for a cluster
list_addons() {
  local cluster=$1
  aws eks list-addons --cluster-name "$cluster" \
    --output text --query 'addons[]'
}

# Get addon details
describe_addon() {
  local cluster=$1 addon=$2
  aws eks describe-addon --cluster-name "$cluster" --addon-name "$addon" \
    --output text \
    --query 'addon.[addonName,addonVersion,status,health.issues[0].code]'
}

# List Fargate profiles
list_fargate_profiles() {
  local cluster=$1
  aws eks list-fargate-profiles --cluster-name "$cluster" \
    --output text --query 'fargateProfileNames[]'
}

Common Operations

1. Cluster Inventory with Version Status

#!/bin/bash
export AWS_PAGER=""
CLUSTERS=$(aws eks list-clusters --output text --query 'clusters[]')
for cluster in $CLUSTERS; do
  aws eks describe-cluster --name "$cluster" \
    --output text \
    --query 'cluster.[name,version,status,platformVersion]' &
done
wait

2. Nodegroup Health and Scaling

#!/bin/bash
export AWS_PAGER=""
CLUSTER=$1
NODEGROUPS=$(aws eks list-nodegroups --cluster-name "$CLUSTER" --output text --query 'nodegroups[]')
for ng in $NODEGROUPS; do
  aws eks describe-nodegroup --cluster-name "$CLUSTER" --nodegroup-name "$ng" \
    --output text \
    --query 'nodegroup.[nodegroupName,status,instanceTypes[0],scalingConfig.minSize,scalingConfig.maxSize,scalingConfig.desiredSize,amiType,capacityType]' &
done
wait

3. Addon Compatibility Check

#!/bin/bash
export AWS_PAGER=""
CLUSTER=$1
ADDONS=$(aws eks list-addons --cluster-name "$CLUSTER" --output text --query 'addons[]')
for addon in $ADDONS; do
  aws eks describe-addon --cluster-name "$CLUSTER" --addon-name "$addon" \
    --output text \
    --query 'addon.[addonName,addonVersion,status,health.issues[0].code,health.issues[0].message]' &
done
wait

4. IRSA (IAM Roles for Service Accounts) Analysis

#!/bin/bash
export AWS_PAGER=""
CLUSTER=$1
OIDC_ISSUER=$(aws eks describe-cluster --name "$CLUSTER" \
  --output text --query 'cluster.identity.oidc.issuer' | sed 's|https://||')

# Find IAM roles that trust this cluster OIDC provider
aws iam list-roles --output text \
  --query "Roles[?contains(AssumeRolePolicyDocument | to_string(@), \`$OIDC_ISSUER\`)].[RoleName,Arn]"

5. Control Plane Logging Status

#!/bin/bash
export AWS_PAGER=""
CLUSTERS=$(aws eks list-clusters --output text --query 'clusters[]')
for cluster in $CLUSTERS; do
  aws eks describe-cluster --name "$cluster" \
    --output text \
    --query 'cluster.[name,logging.clusterLogging[0].enabled,logging.clusterLogging[0].types[]]' &
done
wait

Anti-Hallucination Rules

1. Never assume Kubernetes version - Always query describe-cluster for the actual version. EKS versions lag upstream Kubernetes.
2. Platform version != K8s version - platformVersion (e.g., eks.5) is the EKS platform patch level, not the Kubernetes version.
3. Nodegroup status is not node status - A nodegroup can be ACTIVE while individual nodes are NotReady. Use kubectl for node health.
4. OIDC provider must exist - IRSA requires the cluster OIDC provider to be created in IAM. Check with aws iam list-open-id-connect-providers.
5. Addon versions are cluster-specific - Valid addon versions depend on the cluster K8s version. Use describe-addon-versions to check compatibility.

Output Format

Present results as a structured report:

Aws Eks Report
══════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• EKS API vs kubectl: EKS API manages the control plane and nodegroups. In-cluster resources (pods, services) require kubectl/k8s API.
• Managed vs self-managed nodes: list-nodegroups only returns managed nodegroups. Self-managed nodes (from ASGs) are not visible via EKS API.
• Fargate profiles: Fargate pods do not appear in nodegroups. Check list-fargate-profiles separately.
• CloudWatch statistics syntax: Use spaces not commas: --statistics Average Maximum.
• Cluster endpoint access: Check resourcesVpcConfig.endpointPublicAccess and endpointPrivateAccess to understand API server accessibility.