Amazon EKS — EKS Add-ons

EKS add-ons are core cluster components that AWS can manage for you. Instead of manually installing and upgrading VPC CNI, CoreDNS, and kube-proxy, you let EKS handle their lifecycle.

---

What Are EKS Add-ons?

EKS add-ons are operational software that provides networking, DNS, and proxy functionality for your cluster. AWS offers two management modes:

Mode	Description
EKS-managed add-ons	AWS installs, configures, and updates the add-on. You manage version selection.
Self-managed add-ons	You install and update the add-on yourself (via Helm, kubectl, etc.)

Recommendation: Use EKS-managed add-ons for core components. Self-manage only when you need deep customization.

---

Default Add-ons

Every EKS cluster gets these three add-ons:

Add-on	Purpose	Default Install
Amazon VPC CNI	Pod networking — assigns VPC IPs to pods	Yes (EKS-managed)
CoreDNS	Cluster DNS — resolves service names	Yes (EKS-managed)
kube-proxy	Network proxy — maintains iptables/IPVS rules for Services	Yes (EKS-managed)

---

Optional Add-ons

Add-on	Purpose	When to Enable
Amazon EBS CSI Driver	Persistent block storage (EBS volumes)	When using PersistentVolumeClaims with EBS
Amazon EFS CSI Driver	Shared file storage (EFS)	When multiple pods need ReadWriteMany storage
EKS Pod Identity Agent	Pod-level AWS credentials (newer alternative to IRSA)	When using Pod Identity associations
ADOT (AWS Distro for OpenTelemetry)	Metrics, logs, and traces collection	When sending telemetry to AWS observability services
Snapshot Controller	CSI volume snapshots	When using volume snapshot/restore
AWS Mountpoint for S3 CSI Driver	Mount S3 buckets as file systems	When pods need direct S3 access
CoreDNS (advanced)	Custom DNS configuration	When you need DNS policy customization

---

Managing Add-ons via CLI

List Available Add-ons

aws eks describe-addon-versions \
  --kubernetes-version 1.29 \
  --query 'addons[].{Name:addonName,Versions:addonVersions[0].addonVersion}' \
  --output table

List Installed Add-ons

aws eks list-addons --cluster-name my-cluster

Describe an Add-on

aws eks describe-addon \
  --cluster-name my-cluster \
  --addon-name vpc-cni

Install an Add-on

aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name aws-ebs-csi-driver \
  --addon-version v1.28.0-eksbuild.1 \
  --service-account-role-arn arn:aws:iam::123456789012:role/EBS_CSI_DriverRole \
  --resolve-conflicts OVERWRITE

Update an Add-on

aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name vpc-cni \
  --addon-version v1.16.0-eksbuild.1 \
  --resolve-conflicts OVERWRITE

Delete an Add-on

aws eks delete-addon \
  --cluster-name my-cluster \
  --addon-name aws-ebs-csi-driver

---

Managing Add-ons via eksctl

# In cluster.yaml
addons:
  - name: vpc-cni
    version: latest
    attachPolicyARNs:
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
  - name: coredns
    version: latest
  - name: kube-proxy
    version: latest
  - name: aws-ebs-csi-driver
    version: latest
    wellKnownPolicies:
      ebsCSIController: true

---

Managing Add-ons via Terraform

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  # ... cluster config ...

  cluster_addons = {
    coredns = {
      most_recent = true
    }
    kube-proxy = {
      most_recent = true
    }
    vpc-cni = {
      most_recent = true
      configuration_values = jsonencode({
        env = {
          ENABLE_PREFIX_DELEGATION = "true"
          WARM_IP_TARGET           = "1"
        }
      })
    }
    aws-ebs-csi-driver = {
      most_recent              = true
      service_account_role_arn = module.ebs_csi_irsa.iam_role_arn
    }
  }
}

---

Add-on Version Compatibility

Each add-on version is compatible with specific Kubernetes versions. Check compatibility:

aws eks describe-addon-versions \
  --addon-name vpc-cni \
  --kubernetes-version 1.29 \
  --query 'addons[].addonVersions[].{Version:addonVersion,Default:compatibilities[0].defaultVersion}' \
  --output table

Tip: When upgrading your EKS cluster version, upgrade add-ons after the control plane upgrade, not before.

---

Self-Managed vs EKS-Managed

Aspect	EKS-Managed	Self-Managed
Installation	aws eks create-addon	helm install or kubectl apply
Upgrades	aws eks update-addon	Manual Helm/kubectl upgrade
Configuration	configuration_values JSON	Full Helm values.yaml control
Conflict Resolution	OVERWRITE or PRESERVE	You manage conflicts
Drift Detection	EKS detects and reports drift	You monitor yourself
Customization	Limited to supported config	Full control

---

What’s Next?

Let’s put everything together in a hands-on lab where you create an EKS cluster from scratch.

Next: Hands-On Lab →