Amazon EKS — eksctl Cheat Sheet

eksctl is the official CLI for Amazon EKS. Here are the essential commands.

---

Cluster Management

# Create cluster with defaults
eksctl create cluster --name my-cluster --region us-east-1

# Create cluster with config file
eksctl create cluster -f cluster.yaml

# Get cluster info
eksctl get cluster --name my-cluster --region us-east-1

# Delete cluster
eksctl delete cluster --name my-cluster --region us-east-1

# Update kubeconfig
eksctl utils write-kubeconfig --cluster my-cluster --region us-east-1

# Upgrade cluster version
eksctl upgrade cluster --name my-cluster --version 1.31 --approve

---

Node Group Management

# List node groups
eksctl get nodegroup --cluster my-cluster

# Create managed node group
eksctl create nodegroup \
  --cluster my-cluster \
  --name main-nodes \
  --node-type m6i.large \
  --nodes 3 \
  --nodes-min 1 \
  --nodes-max 5 \
  --managed

# Scale node group
eksctl scale nodegroup \
  --cluster my-cluster \
  --name main-nodes \
  --nodes 5

# Delete node group
eksctl delete nodegroup \
  --cluster my-cluster \
  --name main-nodes \
  --drain

# Upgrade node group
eksctl upgrade nodegroup \
  --cluster my-cluster \
  --name main-nodes \
  --kubernetes-version 1.31

---

IAM & IRSA

# Create IRSA role
eksctl create iamserviceaccount \
  --cluster my-cluster \
  --namespace kube-system \
  --name aws-load-balancer-controller \
  --attach-policy-arn arn:aws:iam::123456789012:policy/AWSLoadBalancerControllerIAMPolicy \
  --approve

# List IRSA associations
eksctl get iamserviceaccount --cluster my-cluster

# Delete IRSA
eksctl delete iamserviceaccount \
  --cluster my-cluster \
  --namespace kube-system \
  --name aws-load-balancer-controller

---

IAM Identity Mapping (aws-auth)

# Map IAM role to Kubernetes group
eksctl create iamidentitymapping \
  --cluster my-cluster \
  --arn arn:aws:iam::123456789012:role/DevTeamRole \
  --group developers \
  --username dev-

# List identity mappings
eksctl get iamidentitymapping --cluster my-cluster

# Delete mapping
eksctl delete iamidentitymapping \
  --cluster my-cluster \
  --arn arn:aws:iam::123456789012:role/DevTeamRole

---

Add-ons

# Create add-on
eksctl create addon --cluster my-cluster --name vpc-cni

# List add-ons
eksctl get addons --cluster my-cluster

# Update add-on
eksctl update addon --cluster my-cluster --name vpc-cni

# Delete add-on
eksctl delete addon --cluster my-cluster --name vpc-cni

---

Fargate

# Create Fargate profile
eksctl create fargateprofile \
  --cluster my-cluster \
  --name fp-default \
  --namespace production

# List Fargate profiles
eksctl get fargateprofile --cluster my-cluster

# Delete Fargate profile
eksctl delete fargateprofile \
  --cluster my-cluster \
  --name fp-default

---

Enable Features

# Enable CloudWatch logging
eksctl utils update-cluster-logging \
  --cluster my-cluster \
  --enable-types api,audit,authenticator,controllerManager,scheduler \
  --approve

# Enable OIDC provider
eksctl utils associate-iam-oidc-provider \
  --cluster my-cluster \
  --approve

# Enable secrets encryption
eksctl utils enable-secrets-encryption \
  --cluster my-cluster \
  --key-arn arn:aws:kms:us-east-1:123456789012:key/abc123 \
  --approve

---

Config File Example

# cluster.yaml
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: my-cluster
  region: us-east-1
  version: "1.31"

vpc:
  cidr: 10.0.0.0/16
  nat:
    gateway: HighlyAvailable

managedNodeGroups:
  - name: main
    instanceType: m6i.large
    desiredCapacity: 3
    minSize: 1
    maxSize: 5
    volumeSize: 100
    iam:
      withAddonPolicies:
        albIngress: true
        ebs: true
        cloudWatch: true

addons:
  - name: vpc-cni
  - name: coredns
  - name: kube-proxy
  - name: aws-ebs-csi-driver

cloudWatch:
  clusterLogging:
    enableTypes: ["api", "audit", "authenticator", "controllerManager", "scheduler"]

---