Eks Cluster

EKS Cluster

What This Skill Produces

Generate Terraform for:

• EKS control plane
• cluster IAM role and required policies
• OIDC provider for workload identity integrations
• system managed node group
• outputs needed by downstream node, ECR, GPU Operator, and validation skills

Do not create compute or GPU workload node groups here; use eks-nodes. Do not install Kubernetes add-ons with Helm here; use later skills.

Inputs

Required:

Optional:

Generation Rules

• Read aws-tf-conventions before generating Terraform.
• Use private subnets for the system node group.
• Keep node group labels stable:

system: node-type=system

• Ensure cluster outputs support later scripts:

output "cluster_name" {
  value = aws_eks_cluster.this.name
}

output "cluster_endpoint" {
  value = aws_eks_cluster.this.endpoint
}

output "cluster_oidc_issuer_url" {
  value = aws_eks_cluster.this.identity[0].oidc[0].issuer
}

Apply Handoff

After Terraform apply succeeds, update kubeconfig:

aws eks update-kubeconfig --name "$CLUSTER_NAME" --region "$AWS_REGION" --alias "$CLUSTER_NAME"
kubectl --context "$CLUSTER_NAME" get nodes

Name Collision Check

Before creating a fresh cluster, check for existing resources:

aws eks describe-cluster --name "$CLUSTER_NAME" --region "$AWS_REGION"

If the cluster exists, stop and ask whether to adopt, clean up, or choose a new cluster name.

Validation Checklist

• EKS cluster is created in private subnets from aws-iam-vpc.
• OIDC provider is enabled.
• System node group uses stable node-type=system label.
• Kubeconfig handoff command uses --alias "$CLUSTER_NAME".
• No compute/GPU node groups, Helm releases, image mirrors, or runtime components are created here.