Deploying an Amazon EKS IPv6 cluster and managed Amazon Linux nodes

Run the following command to set a variable for your Amazon CloudFormation stack name. You can replace my-eks-ipv6-vpc with any name you choose.

export vpc_stack_name=my-eks-ipv6-vpc

Create an IPv6 VPC using an Amazon CloudFormation template.

aws cloudformation create-stack --region $region_code --stack-name $vpc_stack_name \
  --template-url https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-ipv6-vpc-public-private-subnets.yaml

The stack takes a few minutes to create. Run the following command. Don’t continue to the next step until the output of the command is CREATE_COMPLETE.

aws cloudformation describe-stacks --region $region_code --stack-name $vpc_stack_name --query Stacks[].StackStatus --output text

Retrieve the IDs of the public subnets that were created.

aws cloudformation describe-stacks --region $region_code --stack-name $vpc_stack_name \
    --query='Stacks[].Outputs[?OutputKey==`SubnetsPublic`].OutputValue' --output text

An example output is as follows.

subnet-0a1a56c486EXAMPLE,subnet-099e6ca77aEXAMPLE

Enable the auto-assign IPv6 address option for the public subnets that were created.

aws ec2 modify-subnet-attribute --region $region_code --subnet-id subnet-0a1a56c486EXAMPLE --assign-ipv6-address-on-creation
aws ec2 modify-subnet-attribute --region $region_code --subnet-id subnet-099e6ca77aEXAMPLE --assign-ipv6-address-on-creation

Retrieve the names of the subnets and security groups created by the template from the deployed Amazon CloudFormation stack and store them in variables for use in a later step.

security_groups=$(aws cloudformation describe-stacks --region $region_code --stack-name $vpc_stack_name \
    --query='Stacks[].Outputs[?OutputKey==`SecurityGroups`].OutputValue' --output text)

public_subnets=$(aws cloudformation describe-stacks --region $region_code --stack-name $vpc_stack_name \
    --query='Stacks[].Outputs[?OutputKey==`SubnetsPublic`].OutputValue' --output text)

private_subnets=$(aws cloudformation describe-stacks --region $region_code --stack-name $vpc_stack_name \
    --query='Stacks[].Outputs[?OutputKey==`SubnetsPrivate`].OutputValue' --output text)

subnets=${public_subnets},${private_subnets}

Run the following command to create the eks-cluster-role-trust-policy.json file.

cat >eks-cluster-role-trust-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

Run the following command to set a variable for your role name. You can replace myAmazonEKSClusterRole with any name you choose.

export cluster_role_name=myAmazonEKSClusterRole

Create the role.

aws iam create-role --role-name $cluster_role_name --assume-role-policy-document file://"eks-cluster-role-trust-policy.json"

Retrieve the ARN of the IAM role and store it in a variable for a later step.

CLUSTER_IAM_ROLE=$(aws iam get-role --role-name $cluster_role_name --query="Role.Arn" --output text)

Attach the required Amazon EKS managed IAM policy to the role.

aws iam attach-role-policy --policy-arn arn:aws-cn:iam::aws:policy/AmazonEKSClusterPolicy --role-name $cluster_role_name

NOTE: You might receive an error that one of the Availability Zones in your request doesn’t have sufficient capacity to create an Amazon EKS cluster. If this happens, the error output contains the Availability Zones that can support a new cluster. Retry creating your cluster with at least two subnets that are located in the supported Availability Zones for your account. For more information, see Insufficient capacity.

The cluster takes several minutes to create. Run the following command. Don’t continue to the next step until the output from the command is ACTIVE.

aws eks describe-cluster --region $region_code --name $cluster_name --query cluster.status

Run the following command to create the vpc-cni-ipv6-policy.json file.

cat >vpc-cni-ipv6-policy <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AssignIpv6Addresses",
                "ec2:DescribeInstances",
                "ec2:DescribeTags",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeInstanceTypes"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws-cn:ec2:*:*:network-interface/*"
            ]
        }
    ]
}
EOF

Create the IAM policy.

aws iam create-policy --policy-name AmazonEKS_CNI_IPv6_Policy --policy-document file://vpc-cni-ipv6-policy.json

Run the following command to create the node-role-trust-relationship.json file.

cat >node-role-trust-relationship.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

Run the following command to set a variable for your role name. You can replace AmazonEKSNodeRole with any name you choose.

export node_role_name=AmazonEKSNodeRole

Create the IAM role.

aws iam create-role --role-name $node_role_name --assume-role-policy-document file://"node-role-trust-relationship.json"

Attach the IAM policy to the IAM role.

aws iam attach-role-policy --policy-arn arn:aws-cn:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy \
    --role-name $node_role_name

Attach two required IAM managed policies to the IAM role.

aws iam attach-role-policy --policy-arn arn:aws-cn:iam::aws:policy/AmazonEKSWorkerNodePolicy \
  --role-name $node_role_name
aws iam attach-role-policy --policy-arn arn:aws-cn:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
  --role-name $node_role_name

Retrieve the ARN of the IAM role and store it in a variable for a later step.

node_iam_role=$(aws iam get-role --role-name $node_role_name --query="Role.Arn" --output text)

View the IDs of the subnets that you created in a previous step.

echo $subnets

An example output is as follows.

subnet-0a1a56c486EXAMPLE,subnet-099e6ca77aEXAMPLE,subnet-0377963d69EXAMPLE,subnet-0c05f819d5EXAMPLE

Create the node group. Replace 0a1a56c486EXAMPLE, 099e6ca77aEXAMPLE, 0377963d69EXAMPLE, and 0c05f819d5EXAMPLE with the values returned in the output of the previous step. Be sure to remove the commas between subnet IDs from the previous output in the following command. You can replace t3.medium with any Amazon Nitro System instance type.

aws eks create-nodegroup --region $region_code --cluster-name $cluster_name --nodegroup-name $nodegroup_name \
    --subnets subnet-0a1a56c486EXAMPLE subnet-099e6ca77aEXAMPLE subnet-0377963d69EXAMPLE subnet-0c05f819d5EXAMPLE \
    --instance-types t3.medium --node-role $node_iam_role

The node group takes a few minutes to create. Run the following command. Don’t proceed to the next step until the output returned is ACTIVE.

aws eks describe-nodegroup --region $region_code --cluster-name $cluster_name --nodegroup-name $nodegroup_name \
    --query nodegroup.status --output text

If you’re completing this step in a different shell than you completed the previous steps in, set the values of all the variables used in previous steps, replacing the example values with the values you specified when you completed the previous steps. If you’re completing this step in the same shell that you completed the previous steps in, skip to the next step.

export region_code=region-code
export vpc_stack_name=my-eks-ipv6-vpc
export cluster_name=my-cluster
export nodegroup_name=my-nodegroup
export account_id=111122223333
export node_role_name=AmazonEKSNodeRole
export cluster_role_name=myAmazonEKSClusterRole

Delete your node group.

aws eks delete-nodegroup --region $region_code --cluster-name $cluster_name --nodegroup-name $nodegroup_name

Deletion takes a few minutes. Run the following command. Don’t proceed to the next step if any output is returned.

aws eks list-nodegroups --region $region_code --cluster-name $cluster_name --query nodegroups --output text

Delete the cluster.

aws eks delete-cluster --region $region_code --name $cluster_name

The cluster takes a few minutes to delete. Before continuing make sure that the cluster is deleted with the following command.

aws eks describe-cluster --region $region_code --name $cluster_name

Don’t proceed to the next step until your output is similar to the following output.

An error occurred (ResourceNotFoundException) when calling the DescribeCluster operation: No cluster found for name: my-cluster.

Delete the IAM resources that you created. Replace AmazonEKS_CNI_IPv6_Policy with the name you chose, if you chose a different name than the one used in previous steps.

aws iam detach-role-policy --role-name $cluster_role_name --policy-arn arn:aws-cn:iam::aws:policy/AmazonEKSClusterPolicy
aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws-cn:iam::aws:policy/AmazonEKSWorkerNodePolicy
aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws-cn:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws-cn:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy
aws iam delete-policy --policy-arn arn:aws-cn:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy
aws iam delete-role --role-name $cluster_role_name
aws iam delete-role --role-name $node_role_name

Delete the Amazon CloudFormation stack that created the VPC.

aws cloudformation delete-stack --region $region_code --stack-name $vpc_stack_name