Help improve this page
Want to contribute to this user guide? Scroll to the bottom of this page and select Edit this page on GitHub. Your contributions will help make our user guide better for everyone.
Creating the Amazon VPC CNI plugin for Kubernetes Amazon EKS add-on
Use the following steps to create the Amazon VPC CNI plugin for Kubernetes Amazon EKS add-on.
Before you begin, review the considerations. For more information, see Considerations.
Prerequisites
The following are prerequisites for the Amazon VPC CNI plugin for Kubernetes Amazon EKS add-on.
-
An existing Amazon EKS cluster. To deploy one, see Get started with Amazon EKS.
-
An existing Amazon Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster. To determine whether you already have one, or to create one, see Create an IAM OIDC provider for your cluster.
-
An IAM role with the AmazonEKS_CNI_Policy IAM policy attached to it. For more information, see Configure Amazon VPC CNI plugin to use IRSA.
-
If you're using version
1.7.0
or later of the Amazon VPC CNI plugin for Kubernetes and you use custom Pod security policies, see Delete the default Amazon EKS Pod security policyUnderstand Amazon EKS created pod security policies (PSP). -
Important
Amazon VPC CNI plugin for Kubernetes versions
v1.16.0
tov1.16.1
removed compatibility with Kubernetes versions1.23
and earlier. VPC CNI versionv1.16.2
restores compatibility with Kubernetes versions1.23
and earlier and CNI specv0.4.0
.Amazon VPC CNI plugin for Kubernetes versions
v1.16.0
tov1.16.1
implement CNI specification versionv1.0.0
. CNI specv1.0.0
is supported on EKS clusters that run the Kubernetes versionsv1.24
or later. VPC CNI versionv1.16.0
tov1.16.1
and CNI specv1.0.0
aren't supported on Kubernetes versionv1.23
or earlier. For more information aboutv1.0.0
of the CNI spec, see Container Network Interface (CNI) Specificationon .
Procedure
After you complete the prerequisites, use the following steps to create the add-on.
-
See which version of the add-on is installed on your cluster.
kubectl describe daemonset aws-node --namespace kube-system | grep amazon-k8s-cni: | cut -d : -f 3
An example output is as follows.
v1.16.4-eksbuild.2
-
See which type of the add-on is installed on your cluster. Depending on the tool that you created your cluster with, you might not currently have the Amazon EKS add-on type installed on your cluster. Replace
my-cluster
with the name of your cluster.$
aws eks describe-addon --cluster-name
my-cluster
--addon-name vpc-cni --query addon.addonVersion --output textIf a version number is returned, you have the Amazon EKS type of the add-on installed on your cluster and don't need to complete the remaining steps in this procedure. If an error is returned, you don't have the Amazon EKS type of the add-on installed on your cluster. Complete the remaining steps of this procedure to install it.
-
Save the configuration of your currently installed add-on.
kubectl get daemonset aws-node -n kube-system -o yaml >
aws-k8s-cni-old.yaml
-
Create the add-on using the Amazon CLI. If you want to use the Amazon Web Services Management Console or
eksctl
to create the add-on, see Creating an Amazon EKS add-on and specifyvpc-cni
for the add-on name. Copy the command that follows to your device. Make the following modifications to the command, as needed, and then run the modified command.-
Replace
with the name of your cluster.my-cluster
-
Replace
with the latest version listed in the latest version table for your cluster version.v1.18.3-eksbuild.2
-
Replace
111122223333
with your account ID andAmazonEKSVPCCNIRole
with the name of an existing IAM role that you've created. Specifying a role requires that you have an IAM OpenID Connect (OIDC) provider for your cluster. To determine whether you have one for your cluster, or to create one, see Create an IAM OIDC provider for your cluster.
aws eks create-addon --cluster-name
my-cluster
--addon-name vpc-cni --addon-version
\ --service-account-role-arn arn:aws-cn:iam::v1.18.3-eksbuild.2
111122223333
:role/AmazonEKSVPCCNIRole
If you've applied custom settings to your current add-on that conflict with the default settings of the Amazon EKS add-on, creation might fail. If creation fails, you receive an error that can help you resolve the issue. Alternatively, you can add
--resolve-conflicts OVERWRITE
to the previous command. This allows the add-on to overwrite any existing custom settings. Once you've created the add-on, you can update it with your custom settings. -
-
Confirm that the latest version of the add-on for your cluster's Kubernetes version was added to your cluster. Replace
with the name of your cluster.my-cluster
aws eks describe-addon --cluster-name
my-cluster
--addon-name vpc-cni --query addon.addonVersion --output textIt might take several seconds for add-on creation to complete.
An example output is as follows.
v1.18.3-eksbuild.2
-
If you made custom settings to your original add-on, before you created the Amazon EKS add-on, use the configuration that you saved in a previous step to update the Amazon EKS add-on with your custom settings.
(Optional) Install the
cni-metrics-helper
to your cluster. It scrapes elastic network interface and IP address information, aggregates it at a cluster level, and publishes the metrics to Amazon CloudWatch. For more information, see cni-metrics-helperon GitHub.