Installing or updating the Amazon VPC CNI plugin for Kubernetes metrics helper add-on

Create an IAM policy that grants the CNI metrics helper cloudwatch:PutMetricData permissions to send metric data to CloudWatch.

1. Run the following command to create a file named cni-metrics-helper-policy.json.

   cat >cni-metrics-helper-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cloudwatch:PutMetricData",
                   "ec2:DescribeTags"
               ],
               "Resource": "*"
           }
       ]
   }
   EOF
   

2. Create an IAM policy named AmazonEKSVPCCNIMetricsHelperPolicy.

   aws iam create-policy --policy-name AmazonEKSVPCCNIMetricsHelperPolicy \
       --description "Grants permission to write metrics to CloudWatch" \
       --policy-document file://cni-metrics-helper-policy.json
   

Retrieve your Amazon account ID and store it in a variable.

account_id=$(aws sts get-caller-identity --query Account --output text)

Confirm that the variable is set.

echo $account_id

The example output is as follows.

111122223333

Create an IAM role and attach the IAM policy to it. Create a Kubernetes service account. Annotate the Kubernetes service account with the IAM role ARN and the IAM role with the Kubernetes service account name. You can create the role using eksctl or the Amazon CLI.

Verify that the role you created is configured correctly.

1. Verify the trust policy for the role.

   aws iam get-role --role-name AmazonEKSVPCCNIMetricsHelperRole-my-cluster --query Role.AssumeRolePolicyDocument.Statement[]

   The example output is as follows.

   [
       {
           "Effect": "Allow",
           "Principal": {
               "Federated": "arn:aws-cn:iam::oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
           },
           "Action": "sts:AssumeRoleWithWebIdentity",
           "Condition": {
               "StringEquals": {
                   "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:cni-metrics-helper",
                   "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
               }
           }
       }
   ]

2. Verify that your cluster's OIDC provider matches the provider returned in the previous step.

   aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text | cut -c9-

   The example output is as follows.

   oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE

Determine the version of the Amazon VPC CNI plugin for Kubernetes that's installed on your cluster.

kubectl describe daemonset aws-node -n kube-system | grep amazon-k8s-cni: | cut -d ":" -f3 | cut -d "v" -f2 | cut -d "-" -f1

The example output is as follows.

1.11.4

In the previous output, 1 is the major version, 11 is the minor version, and 4 is the patch version.

To add the same version of the CNI metrics helper to your cluster (or to update to the same version) as your Amazon VPC CNI plugin for Kubernetes, run the following command for the Amazon Web Services Region that your cluster is in.

China (Beijing) (cn-north-1) or China (Ningxia) (cn-northwest-1)

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.12.1/config/master/cni-metrics-helper-cn.yaml

If you previously configured an IAM role for the add-on's service account to use you can skip to the Restart the cni-metrics-helper deployment step.

Annotate the cni-metrics-helper Kubernetes service account created in a previous step with the ARN of the IAM role that you created previously. Replace my-cluster with your cluster name and AmazonEKSVPCCNIMetricsHelperRole-my-cluster with the name of the IAM role that you created in a previous step.

kubectl annotate serviceaccount cni-metrics-helper -n kube-system \
    eks.amazonaws.com/role-arn=arn:aws-cn:iam::$account_id:role/AmazonEKSVPCCNIMetricsHelperRole-my-cluster

(Optional) Configure the Amazon Security Token Service endpoint type used by your Kubernetes service account. For more information, see Configuring the Amazon Security Token Service endpoint for a service account.

Restart the cni-metrics-helper deployment.

kubectl rollout restart deployment cni-metrics-helper -n kube-system

Confirm the version of the metrics helper that you deployed.

kubectl describe deployment cni-metrics-helper -n kube-system | grep cni-metrics-helper: | cut -d ":" -f 3

The example output is as follows.

v1.12.1

Open the CloudWatch console at https://console.amazonaws.cn/cloudwatch/.

In the left navigation pane, choose Metrics and then select All metrics.

Choose the Graphed metrics tab.

Choose Add metrics using browse or query.

Make sure that under Metrics, you've selected the Amazon Web Services Region for your cluster.

In the Search box, enter Kubernetes and then press Enter.

Select the metrics that you want to add to the dashboard.

At the upper right of the console, select Actions, and then Add to dashboard.

In the Select a dashboard section, choose Create new, enter a name for your dashboard, such as EKS-CNI-metrics, and then choose Create.

In the Widget type section, select Number.

In the Customize widget title section, enter a logical name for your dashboard title, such as EKS CNI metrics.

Choose Add to dashboard to finish. Now your CNI metrics are added to a dashboard that you can monitor. For more information about Amazon CloudWatch Logs metrics, see Using Amazon CloudWatch metrics in the Amazon CloudWatch User Guide.