Pulumi EKS

The Pulumi EKS library provides a high-level Pulumi component designed to create and manage the resources required for an Amazon Elastic Kubernetes Service (EKS) cluster. It implements the 'Crosswalk for AWS' functionality, simplifying the orchestration of complex Kubernetes infrastructure.

Key managed resources include:

• EKS Cluster Control Plane: The managed Kubernetes API server.
• Worker Nodes: Configured as node groups and managed by an AWS Auto Scaling Group.
• AWS CNI Plugin (aws-k8s-cni): Manages pod networking within the Kubernetes cluster.

The pulumi-eks repository provides a variety of examples demonstrating different ways to provision, configure, and secure Amazon EKS clusters. These examples cover networking, identity and access management (IAM), security, and node management patterns.

Available example patterns include:

- **Cluster Provisioning**: Default clusters, clusters with custom VPCs/subnet tagging, and clusters with AWS resource tags.
- **Node Management**: AWS Managed NodeGroups, NodeGroups via CloudFormation, Fargate managed nodes, and zero-downtime node group migration.
- **Security & RBAC**: Using AWS Roles for RBAC, using AWS Named Profiles/Providers, and securing etcd secrets using Envelope Encryption with KMS.
- **Networking & Storage**: Custom Kubernetes Storage Classes, managing security groups, and EFA support.
- **Identity**: Using OIDC providers with Service Accounts for Pod IAM roles.

An EKS Node Group provisions and optionally updates an Auto Scaling Group of Kubernetes worker nodes compatible with Amazon EKS. This component allows you to manage the lifecycle of worker nodes that join your EKS cluster.

For detailed AWS-specific behavior regarding how these nodes are managed, refer to the EKS User Guide.

In EKS v3, vpc-cni, coredns, and kube-proxy are configured as EKS managed addons. This automates updates and removes the dependency on kubectl.

If you need to manage these components manually, you can disable them in the cluster component configuration.

VPC CNI Specific Changes:

• The enableIpv6 property is removed; the component now automatically detects the IP version based on the cluster mode.
• The image, initImage, and nodeAgentImage properties are removed; the component now automatically selects the appropriate regional image registry.

Introduced in version 0.42.0, NodeGroupV2 is a newer version of the Node Group resource. Unlike the standard Node Group, NodeGroupV2 uses Launch Templates instead of Launch Configurations, and Auto Scaling Groups instead of CloudFormation Stacks. This is intended to become the default in future releases.

Key features of NodeGroupV2 include:

• Support for launchTemplateTagSpecifications (added in 1.0.0).
• Ability to pass a Cluster instance directly to the resource (added in 1.0.0).

// Conceptual usage of NodeGroupV2
const nodeGroup = new eks.NodeGroupV2("my-node-group", {
    cluster: myCluster,
    // ... other options
});