CreateCluster
Creates an Amazon EKS control plane.
The Amazon EKS control plane consists of control plane instances that run the
Kubernetes software, such as etcd
and the API server. The control plane runs in
an account managed by Amazon, and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is
single tenant and unique. It runs on its own set of Amazon EC2 instances.
The cluster control plane is provisioned across multiple Availability Zones and
fronted by an Elastic Load Balancing
Network Load Balancer. Amazon EKS also provisions elastic network interfaces in
your VPC subnets to provide connectivity from the control plane instances to the nodes
(for example, to support kubectl exec
, logs
, and
proxy
data flows).
Amazon EKS nodes run in your Amazon account and connect to your cluster's control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster.
You can use the endpointPublicAccess
and
endpointPrivateAccess
parameters to enable or disable public and
private access to your cluster's Kubernetes API server endpoint. By default, public access is
enabled, and private access is disabled. For more information, see Amazon EKS Cluster Endpoint Access Control in the
Amazon EKS User Guide
.
You can use the logging
parameter to enable or disable exporting the
Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster
control plane logs aren't exported to CloudWatch Logs. For more information, see
Amazon EKS Cluster Control Plane Logs in the
Amazon EKS User Guide
.
Note
CloudWatch Logs ingestion, archive storage, and data scanning rates apply to
exported control plane logs. For more information, see CloudWatch
Pricing
In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see Allowing users to access your cluster and Launching Amazon EKS nodes in the Amazon EKS User Guide.
Request Syntax
POST /clusters HTTP/1.1
Content-type: application/json
{
"accessConfig": {
"authenticationMode": "string
",
"bootstrapClusterCreatorAdminPermissions": boolean
},
"bootstrapSelfManagedAddons": boolean
,
"clientRequestToken": "string
",
"encryptionConfig": [
{
"provider": {
"keyArn": "string
"
},
"resources": [ "string
" ]
}
],
"kubernetesNetworkConfig": {
"ipFamily": "string
",
"serviceIpv4Cidr": "string
"
},
"logging": {
"clusterLogging": [
{
"enabled": boolean
,
"types": [ "string
" ]
}
]
},
"name": "string
",
"outpostConfig": {
"controlPlaneInstanceType": "string
",
"controlPlanePlacement": {
"groupName": "string
"
},
"outpostArns": [ "string
" ]
},
"resourcesVpcConfig": {
"endpointPrivateAccess": boolean
,
"endpointPublicAccess": boolean
,
"publicAccessCidrs": [ "string
" ],
"securityGroupIds": [ "string
" ],
"subnetIds": [ "string
" ]
},
"roleArn": "string
",
"tags": {
"string
" : "string
"
},
"upgradePolicy": {
"supportType": "string
"
},
"version": "string
",
"zonalShiftConfig": {
"enabled": boolean
}
}
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
- accessConfig
-
The access configuration for the cluster.
Type: CreateAccessConfigRequest object
Required: No
- bootstrapSelfManagedAddons
-
If you set this value to
False
when creating a cluster, the default networking add-ons will not be installed.The default networking addons include vpc-cni, coredns, and kube-proxy.
Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons.
Type: Boolean
Required: No
- clientRequestToken
-
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
Type: String
Required: No
- encryptionConfig
-
The encryption configuration for the cluster.
Type: Array of EncryptionConfig objects
Array Members: Maximum number of 1 item.
Required: No
- kubernetesNetworkConfig
-
The Kubernetes network configuration for the cluster.
Type: KubernetesNetworkConfigRequest object
Required: No
- logging
-
Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS Cluster control plane logs in the Amazon EKS User Guide .
Note
CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see CloudWatch Pricing
. Type: Logging object
Required: No
- name
-
The unique name to give to your cluster. The name can contain only alphanumeric characters (case-sensitive), hyphens, and underscores. It must start with an alphanumeric character and can't be longer than 100 characters. The name must be unique within the Amazon Web Services Region and Amazon Web Services account that you're creating the cluster in.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 100.
Pattern:
^[0-9A-Za-z][A-Za-z0-9\-_]*
Required: Yes
- outpostConfig
-
An object representing the configuration of your local Amazon EKS cluster on an Amazon Outpost. Before creating a local cluster on an Outpost, review Local clusters for Amazon EKS on Amazon Outposts in the Amazon EKS User Guide. This object isn't available for creating Amazon EKS clusters on the Amazon cloud.
Type: OutpostConfigRequest object
Required: No
- resourcesVpcConfig
-
The VPC configuration that's used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. You must specify at least two subnets. You can specify up to five security groups. However, we recommend that you use a dedicated security group for your cluster control plane.
Type: VpcConfigRequest object
Required: Yes
- roleArn
-
The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon API operations on your behalf. For more information, see Amazon EKS Service IAM Role in the Amazon EKS User Guide .
Type: String
Required: Yes
-
Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon resources.
Type: String to string map
Map Entries: Maximum number of 50 items.
Key Length Constraints: Minimum length of 1. Maximum length of 128.
Value Length Constraints: Maximum length of 256.
Required: No
- upgradePolicy
-
New clusters, by default, have extended support enabled. You can disable extended support when creating a cluster by setting this value to
STANDARD
.Type: UpgradePolicyRequest object
Required: No
- version
-
The desired Kubernetes version for your cluster. If you don't specify a value here, the default version available in Amazon EKS is used.
Note
The default version might not be the latest version available.
Type: String
Required: No
- zonalShiftConfig
-
Enable or disable ARC zonal shift for the cluster. If zonal shift is enabled, Amazon configures zonal autoshift for the cluster.
Zonal shift is a feature of Amazon Application Recovery Controller (ARC). ARC zonal shift is designed to be a temporary measure that allows you to move traffic for a resource away from an impaired AZ until the zonal shift expires or you cancel it. You can extend the zonal shift if necessary.
You can start a zonal shift for an EKS cluster, or you can allow Amazon to do it for you by enabling zonal autoshift. This shift updates the flow of east-to-west network traffic in your cluster to only consider network endpoints for Pods running on worker nodes in healthy AZs. Additionally, any ALB or NLB handling ingress traffic for applications in your EKS cluster will automatically route traffic to targets in the healthy AZs. For more information about zonal shift in EKS, see Learn about Amazon Application Recovery Controller (ARC) Zonal Shift in Amazon EKS in the Amazon EKS User Guide .
Type: ZonalShiftConfigRequest object
Required: No
Response Syntax
HTTP/1.1 200
Content-type: application/json
{
"cluster": {
"accessConfig": {
"authenticationMode": "string",
"bootstrapClusterCreatorAdminPermissions": boolean
},
"arn": "string",
"certificateAuthority": {
"data": "string"
},
"clientRequestToken": "string",
"connectorConfig": {
"activationCode": "string",
"activationExpiry": number,
"activationId": "string",
"provider": "string",
"roleArn": "string"
},
"createdAt": number,
"encryptionConfig": [
{
"provider": {
"keyArn": "string"
},
"resources": [ "string" ]
}
],
"endpoint": "string",
"health": {
"issues": [
{
"code": "string",
"message": "string",
"resourceIds": [ "string" ]
}
]
},
"id": "string",
"identity": {
"oidc": {
"issuer": "string"
}
},
"kubernetesNetworkConfig": {
"ipFamily": "string",
"serviceIpv4Cidr": "string",
"serviceIpv6Cidr": "string"
},
"logging": {
"clusterLogging": [
{
"enabled": boolean,
"types": [ "string" ]
}
]
},
"name": "string",
"outpostConfig": {
"controlPlaneInstanceType": "string",
"controlPlanePlacement": {
"groupName": "string"
},
"outpostArns": [ "string" ]
},
"platformVersion": "string",
"resourcesVpcConfig": {
"clusterSecurityGroupId": "string",
"endpointPrivateAccess": boolean,
"endpointPublicAccess": boolean,
"publicAccessCidrs": [ "string" ],
"securityGroupIds": [ "string" ],
"subnetIds": [ "string" ],
"vpcId": "string"
},
"roleArn": "string",
"status": "string",
"tags": {
"string" : "string"
},
"upgradePolicy": {
"supportType": "string"
},
"version": "string",
"zonalShiftConfig": {
"enabled": boolean
}
}
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
Errors
For information about the errors that are common to all actions, see Common Errors.
- ClientException
-
These errors are usually caused by a client action. Actions can include using an action or resource on behalf of an IAM principal that doesn't have permissions to use the action or resource or specifying an identifier that is not valid.
HTTP Status Code: 400
- InvalidParameterException
-
The specified parameter is invalid. Review the available parameters for the API request.
HTTP Status Code: 400
- ResourceInUseException
-
The specified resource is in use.
HTTP Status Code: 409
- ResourceLimitExceededException
-
You have encountered a service limit on the specified resource.
HTTP Status Code: 400
- ServerException
-
These errors are usually caused by a server-side issue.
HTTP Status Code: 500
- ServiceUnavailableException
-
The service is unavailable. Back off and retry the operation.
HTTP Status Code: 503
- UnsupportedAvailabilityZoneException
-
At least one of your specified cluster subnets is in an Availability Zone that does not support Amazon EKS. The exception output specifies the supported Availability Zones for your account, from which you can choose subnets for your cluster.
HTTP Status Code: 400
Examples
In the following example or examples, the Authorization header contents
(AUTHPARAMS
) must be replaced with an Amazon Signature Version 4
signature. For more information about creating these signatures, see Signature
Version 4 Signing Process in the Amazon EKS General
Reference.
You need to learn how to sign HTTP requests only if you intend to manually
create them. When you use the Amazon Command Line
Interface (Amazon CLI)
Example
The following example creates an Amazon EKS cluster named
my-cluster
with endpoint public and private access
enabled.
Sample Request
POST /clusters HTTP/1.1
Host: eks.us-west-2.amazonaws.com
Accept-Encoding: identity
User-Agent: aws-cli/1.16.120 Python/3.7.0 Darwin/18.2.0 botocore/1.12.110
X-Amz-Date: 20190322T160158Z
Authorization: AUTHPARAMS
Content-Length: 368
{
"name": "my-cluster",
"roleArn": "arn:aws:iam::012345678910:role/eksClusterRole",
"resourcesVpcConfig": {
"subnetIds": [
"subnet-xxxxxxxxxxxxxxxxx",
"subnet-yyyyyyyyyyyyyyyyy",
"subnet-zzzzzzzzzzzzzzzzz"
],
"securityGroupIds": [
"sg-xxxxxxxxxxxxxxxxx"
],
"endpointPublicAccess": true,
"endpointPrivateAccess": true
},
"clientRequestToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
Sample Response
HTTP/1.1 200 OK
Date: Fri, 22 Mar 2019 16:01:58 GMT
Content-Type: application/json
Content-Length: 682
x-amzn-RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
x-amz-apigw-id: W84GUEIbPHcFW2Q=
X-Amzn-Trace-Id: Root=1-xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive
{
"cluster": {
"name": "my-cluster",
"arn": "arn:aws:eks:us-west-2:012345678910:cluster/my-cluster",
"createdAt": 1573484658.211,
"version": "1.14",
"roleArn": "arn:aws:iam::012345678910:role/eksClusterRole",
"resourcesVpcConfig": {
"subnetIds": [
"subnet-xxxxxxxxxxxxxxxxx",
"subnet-yyyyyyyyyyyyyyyyy",
"subnet-zzzzzzzzzzzzzzzzz"
],
"securityGroupIds": [],
"vpcId": "vpc-xxxxxxxxxxxxxxxxx",
"endpointPublicAccess": true,
"endpointPrivateAccess": false
},
"logging": {
"clusterLogging": [
{
"types": [
"api",
"audit",
"authenticator",
"controllerManager",
"scheduler"
],
"enabled": false
}
]
},
"status": "CREATING",
"certificateAuthority": {},
"platformVersion": "eks.3",
"tags": {}
}
}
See Also
For more information about using this API in one of the language-specific Amazon SDKs, see the following: