Skip to content

Commit 7a590b3

Browse files
daniil-millwooddaniil-millwood
authored
New CLI examples for EKS (aws#9576)
1 parent c08b619 commit 7a590b3

16 files changed

+603
-0
lines changed

‎awscli/examples/eks/associate-access-policy.rst‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
**To associate an access policy and its scope to the access entry of the cluster**
2+
3+
The following ``associate-access-policy`` associates an access policy and its scope to the access entry of the specified cluster. ::
4+
5+
aws eks associate-access-policy \
6+
--cluster-name eks-customer \
7+
--principal-arn arn:aws:iam::111122223333:role/Admin \
8+
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy \
9+
--access-scope type=namespace,namespaces=default
10+
11+
Output::
12+
13+
{
14+
"clusterName": "eks-customer",
15+
"principalArn": "arn:aws:iam::111122223333:role/Admin",
16+
"associatedAccessPolicy": {
17+
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy",
18+
"accessScope": {
19+
"type": "namespace",
20+
"namespaces": [
21+
"default"
22+
]
23+
},
24+
"associatedAt": "2025-05-24T15:59:51.981000-05:00",
25+
"modifiedAt": "2025-05-24T15:59:51.981000-05:00"
26+
}
27+
}
28+
29+
For more information, see `Associate access policies with access entries <https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/create-access-entry.rst‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
**Example 1: To create the access entry for EKS cluster**
2+
3+
The following ``create-access-entry`` example creates an access entry that allows an IAM principal to access the EKS cluster. ::
4+
5+
aws eks create-access-entry \
6+
--cluster-name eks-customer \
7+
--principal-arn arn:aws:iam::111122223333:user/eks-user
8+
9+
Output::
10+
11+
{
12+
"accessEntry": {
13+
"clusterName": "eks-customer",
14+
"principalArn": "arn:aws:iam::111122223333:user/eks-user",
15+
"kubernetesGroups": [],
16+
"accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-user/a1b2c3d4-5678-90ab-cdef-a6506e3d36p0",
17+
"createdAt": "2025-04-14T22:45:48.097000-05:00",
18+
"modifiedAt": "2025-04-14T22:45:48.097000-05:00",
19+
"tags": {},
20+
"username": "arn:aws:iam::111122223333:user/eks-user",
21+
"type": "STANDARD"
22+
}
23+
}
24+
25+
For more information, see `Create access entries <https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html>`__ in the *Amazon EKS User Guide*.
26+
27+
**Example 2: To create the access entry for EKS cluster by specifying the type of access entry**
28+
29+
The following ``create-access-entry`` example creates an access entry of type ``EC2_LINUX`` in the EKS cluster. By default, a type ``STANDARD`` access entry is created. Apart from the default, if we specify any other access entry types, an IAM role ARN needs to be passed in the CLI. ::
30+
31+
aws eks create-access-entry \
32+
--cluster-name eks-customer \
33+
--principal-arn arn:aws:iam::111122223333:role/admin-test-ip \
34+
--type EC2_LINUX
35+
36+
Output::
37+
38+
{
39+
"accessEntry": {
40+
"clusterName": "eks-customer",
41+
"principalArn": "arn:aws:iam::111122223333:role/admin-test-ip",
42+
"kubernetesGroups": [
43+
"system:nodes"
44+
],
45+
"accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/role/111122223333/admin-test-ip/accb5418-f493-f390-3e6e-c3f19f725fcp",
46+
"createdAt": "2025-05-06T19:42:45.453000-05:00",
47+
"modifiedAt": "2025-05-06T19:42:45.453000-05:00",
48+
"tags": {},
49+
"username": "system:node:{{EC2PrivateDNSName}}",
50+
"type": "EC2_LINUX"
51+
}
52+
}
53+
54+
For more information, see `Create access entries <https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/create-pod-identity-association.rst‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
**Example 1: To create an EKS Pod Identity association in EKS cluster**
2+
3+
The following ``create-pod-identity-association`` example creates an EKS Pod Identity association between a service account in the EKS cluster and an IAM role. ::
4+
5+
aws eks create-pod-identity-association \
6+
--cluster-name eks-customer \
7+
--namespace default \
8+
--service-account default \
9+
--role-arn arn:aws:iam::111122223333:role/my-role
10+
11+
Output::
12+
13+
{
14+
"association": {
15+
"clusterName": "eks-customer",
16+
"namespace": "default",
17+
"serviceAccount": "default",
18+
"roleArn": "arn:aws:iam::111122223333:role/my-role",
19+
"associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-8mvwvh57cu74mgcst",
20+
"associationId": "a-8mvwvh57cu74mgcst",
21+
"tags": {},
22+
"createdAt": "2025-05-24T19:40:13.961000-05:00",
23+
"modifiedAt": "2025-05-24T19:40:13.961000-05:00"
24+
}
25+
}
26+
27+
For more information, see `Learn how EKS Pod Identity grants pods access to AWS services <https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html>`__ in the *Amazon EKS User Guide*.
28+
29+
**Example 2: To create an EKS Pod Identity association in EKS cluster with tags**
30+
31+
The following ``create-pod-identity-association`` creates an EKS Pod Identity association between a service account and an IAM role in the EKS cluster with tags. ::
32+
33+
aws eks create-pod-identity-association \
34+
--cluster-name eks-customer \
35+
--namespace default \
36+
--service-account default \
37+
--role-arn arn:aws:iam::111122223333:role/my-role \
38+
--tags Key1=value1,Key2=value2
39+
40+
Output::
41+
42+
{
43+
"association": {
44+
"clusterName": "eks-customer",
45+
"namespace": "default",
46+
"serviceAccount": "default",
47+
"roleArn": "arn:aws:iam::111122223333:role/my-role",
48+
"associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-9njjin9gfghecgoda",
49+
"associationId": "a-9njjin9gfghecgoda",
50+
"tags": {
51+
"Key2": "value2",
52+
"Key1": "value1"
53+
},
54+
"createdAt": "2025-05-24T19:52:14.135000-05:00",
55+
"modifiedAt": "2025-05-24T19:52:14.135000-05:00"
56+
}
57+
}
58+
59+
For more information, see `Learn how EKS Pod Identity grants pods access to AWS services <https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/delete-access-entry.rst‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
**To delete an access entry associated with the cluster**
2+
3+
The following ``delete-access-entry`` deletes an access entry associated with the EKS cluster named ``eks-customer``. ::
4+
5+
aws eks delete-access-entry \
6+
--cluster-name eks-customer \
7+
--principal-arn arn:aws:iam::111122223333:role/Admin
8+
9+
This command produces no output.
10+
11+
For more information, see `Delete access entries <https://docs.aws.amazon.com/eks/latest/userguide/deleting-access-entries.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/delete-pod-identity-association.rst‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
**To delete the EKS Pod Identity association**
2+
3+
The following ``delete-pod-identity-association`` example deletes the EKS Pod Identity association with association ID ``a-9njjin9gfghecgocd`` from the EKS cluster named ``eks-customer``. ::
4+
5+
aws eks delete-pod-identity-association \
6+
--cluster-name eks-customer \
7+
--association-id a-9njjin9gfghecgocd
8+
9+
Output::
10+
11+
{
12+
"association": {
13+
"clusterName": "eks-customer",
14+
"namespace": "default",
15+
"serviceAccount": "default",
16+
"roleArn": "arn:aws:iam::111122223333:role/s3-role",
17+
"associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-9njjin9gfghecgocd",
18+
"associationId": "a-9njjin9gfghecgocd",
19+
"tags": {
20+
"Key2": "value2",
21+
"Key1": "value1"
22+
},
23+
"createdAt": "2025-05-24T19:52:14.135000-05:00",
24+
"modifiedAt": "2025-05-25T21:10:56.923000-05:00"
25+
}
26+
}
27+
28+
For more information, see `Learn how EKS Pod Identity grants pods access to AWS services <https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/describe-access-entry.rst‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
**To describe the access entry for EKS cluster**
2+
3+
The following ``describe-access-entry`` example describes an access entry for the EKS cluster. ::
4+
5+
aws eks describe-access-entry \
6+
--cluster-name eks-customer \
7+
--principal-arn arn:aws:iam::111122223333:user/eks-admin-user
8+
9+
Output::
10+
11+
{
12+
"accessEntry": {
13+
"clusterName": "eks-customer",
14+
"principalArn": "arn:aws:iam::111122223333:user/eks-admin-user",
15+
"kubernetesGroups": [],
16+
"accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-admin-user/0acb1bc6-cb0a-ede6-11ae-a6506e3d36p0",
17+
"createdAt": "2025-04-14T22:45:48.097000-05:00",
18+
"modifiedAt": "2025-04-14T22:45:48.097000-05:00",
19+
"tags": {},
20+
"username": "arn:aws:iam::111122223333:user/eks-admin-user",
21+
"type": "STANDARD"
22+
}
23+
}
24+
25+
For more information, see `Grant IAM users access to Kubernetes with EKS access entries <https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/describe-insight.rst‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
**To get the details of an insight for an EKS cluster using its ID**
2+
3+
The following ``describe-insight`` example returns the details about the insight specified using the cluster name and insight ID. ::
4+
5+
aws eks describe-insight \
6+
--cluster-name eks-customer \
7+
--id 38ea7a64-a14f-4e0e-95c7-8dbcab3c3623
8+
9+
Output::
10+
11+
{
12+
"insight": {
13+
"id": "38ea7a64-a14f-4e0e-95c7-8dbcab3c3623",
14+
"name": "Kubelet version skew",
15+
"category": "UPGRADE_READINESS",
16+
"kubernetesVersion": "1.33",
17+
"lastRefreshTime": "2025-05-24T11:22:50-05:00",
18+
"lastTransitionTime": "2025-05-24T11:22:50-05:00",
19+
"description": "Checks for kubelet versions of worker nodes in the cluster to see if upgrade would cause noncompliance with supported Kubernetes kubelet version skew policy.",
20+
"insightStatus": {
21+
"status": "PASSING",
22+
"reason": "Node kubelet versions match the cluster control plane version."
23+
},
24+
"recommendation": "Upgrade your worker nodes to match the Kubernetes version of your cluster control plane.",
25+
"additionalInfo": {
26+
"Kubelet version skew policy": "https://kubernetes.io/releases/version-skew-policy/#kubelet",
27+
"Updating a managed node group": "https://docs.aws.amazon.com/eks/latest/userguide/update-managed-node-group.html"
28+
},
29+
"resources": [],
30+
"categorySpecificSummary": {
31+
"deprecationDetails": []
32+
}
33+
}
34+
}
35+
36+
For more information, see `View cluster insights <https://docs.aws.amazon.com/eks/latest/userguide/view-cluster-insights.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/describe-pod-identity-association.rst‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
**To provide the details about Pod Identity association**
2+
3+
The following ``describe-pod-identity-association`` example describes a Pod Identity association in the EKS cluster. ::
4+
5+
aws eks describe-pod-identity-association \
6+
--cluster-name eks-customer \
7+
--association-id a-9njjin9gfghecgocd
8+
9+
Output::
10+
11+
{
12+
"association": {
13+
"clusterName": "eks-customer",
14+
"namespace": "default",
15+
"serviceAccount": "default",
16+
"roleArn": "arn:aws:iam::111122223333:role/my-role",
17+
"associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-9njjin9gfghecgocd",
18+
"associationId": "a-9njjin9gfghecgocd",
19+
"tags": {
20+
"Key2": "value2",
21+
"Key1": "value1"
22+
},
23+
"createdAt": "2025-05-24T19:52:14.135000-05:00",
24+
"modifiedAt": "2025-05-24T19:52:14.135000-05:00"
25+
}
26+
}
27+
28+
For more information, see `Learn how EKS Pod Identity grants pods access to AWS services <https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/disassociate-access-policy.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
**To disassociate the access policy from an access entry**
2+
3+
The following ``disassociate-access-policy`` removes the access policy associated with the access entry. ::
4+
5+
aws eks disassociate-access-policy \
6+
--cluster-name eks-customer \
7+
--principal-arn arn:aws:iam::111122223333:role/Admin \
8+
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy
9+
10+
This command produces no output.
11+
12+
For more information, see `Associate access policies with access entries <https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html>`__ in the *Amazon EKS User Guide*.

‎awscli/examples/eks/list-access-entries.rst‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
**To list the access entries for an EKS cluster**
2+
3+
The following ``list-access-entries`` returns the list of access entries associated with the EKS cluster ``eks-customer``. ::
4+
5+
aws eks list-access-entries \
6+
--cluster-name eks-customer
7+
8+
Output::
9+
10+
{
11+
"accessEntries": [
12+
"arn:aws:iam::111122223333:role/Admin",
13+
"arn:aws:iam::111122223333:role/admin-test-ip",
14+
"arn:aws:iam::111122223333:role/assume-worker-node-role",
15+
"arn:aws:iam::111122223333:user/eks-admin-user"
16+
]
17+
}
18+
19+
For more information, see `Grant IAM users access to Kubernetes with EKS access entries <https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html>`__ in the *Amazon EKS User Guide*.

0 commit comments

Comments
 (0)