EKSコントロールプレーンとワーカーノード

Amazon EKS とは

EKS コントロールプレーン

EKS クラスターの作成

# Create a cluster with eksctl (recommended for getting started)
eksctl create cluster \
  --name my-cluster \
  --region us-east-1 \
  --version 1.29 \
  --nodegroup-name standard-nodes \
  --node-type m5.large \
  --nodes 3 \
  --nodes-min 1 \
  --nodes-max 5

kubectl を EKS に接続する

# Update kubeconfig for your EKS cluster
aws eks update-kubeconfig \
  --region us-east-1 \
  --name my-cluster

# Verify connectivity
kubectl get nodes
kubectl get pods --all-namespaces

マネージドノードグループ

# Add a managed node group to an existing cluster
eksctl create nodegroup \
  --cluster my-cluster \
  --region us-east-1 \
  --name high-mem-nodes \
  --node-type r6i.large \
  --nodes 2 \
  --nodes-min 1 \
  --nodes-max 10 \
  --managed

セルフマネージドノードグループ

# Bootstrap script baked into the launch template
/etc/eks/bootstrap.sh my-cluster \
  --apiserver-endpoint 'https://EXAMPLE.gr7.us-east-1.eks.amazonaws.com' \
  --b64-cluster-ca 'BASE64_ENCODED_CA' \
  --kubelet-extra-args '--node-labels=role=custom'

ノード IAM ロールとインスタンスプロファイル

# Attach required policies to the node role
aws iam attach-role-policy \
  --role-name EKSNodeRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy

aws iam attach-role-policy \
  --role-name EKSNodeRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy

aws iam attach-role-policy \
  --role-name EKSNodeRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly

aws-auth ConfigMap：IAM と RBAC のマッピング

# View and edit the aws-auth ConfigMap
kubectl describe configmap aws-auth -n kube-system

# Add a role mapping (example YAML fragment)
# mapRoles:
# - rolearn: arn:aws:iam::111122223333:role/EKSNodeRole
#   username: system:node:{{EC2PrivateDNSName}}
#   groups:
#     - system:bootstrappers
#     - system:nodes

EKS アドオンとクラスターのアップグレード

# List available add-ons and their versions
aws eks describe-addon-versions \
  --kubernetes-version 1.29 \
  --query 'addons[].{Name:addonName,Versions:addonVersions[0].addonVersion}' \
  --output table

# Update the VPC CNI add-on
aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name vpc-cni \
  --addon-version v1.16.0-eksbuild.1

EKS のセキュリティ：エンドポイントアクセスと暗号化

# Enable private endpoint and envelope encryption at cluster creation
aws eks create-cluster \
  --name secure-cluster \
  --kubernetes-version 1.29 \
  --role-arn arn:aws:iam::111122223333:role/EKSClusterRole \
  --resources-vpc-config subnetIds=subnet-xxx,securityGroupIds=sg-xxx,endpointPublicAccess=false,endpointPrivateAccess=true \
  --encryption-config '[{"provider":{"keyArn":"arn:aws:kms:us-east-1:111122223333:key/KEY_ID"},"resources":["secrets"]}]'

EKS の Cluster Autoscaler

# Deploy Cluster Autoscaler (abbreviated)
kubectl apply -f https://raw.githubusercontent.com/kubernetes/autoscaler/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-autodiscover.yaml

# Add required annotation so it discovers your cluster ASGs
kubectl annotate serviceaccount cluster-autoscaler \
  -n kube-system \
  eks.amazonaws.com/role-arn=arn:aws:iam::111122223333:role/ClusterAutoscalerRole

理解度チェック

レッスンのまとめ