Amazon EKS add-ons

Name – vpc-cni

Description – A Kubernetes container network interface (CNI) plugin that provides native VPC networking for your cluster. The self-managed or managed type of this add-on is installed on each Amazon EC2 node, by default.

Required IAM permissions – This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. If your cluster uses the IPv4 family, the permissions in the AmazonEKS_CNI_Policy are required. If your cluster uses the IPv6 family, you must create an IAM policy with the permissions in IPv6 mode. You can create an IAM role, attach one of the policies to it, and annotate the Kubernetes service account used by the add-on with the following command.

Replace my-cluster with the name of your cluster and AmazonEKSVPCCNIRole with the name for your role. If your cluster uses the IPv6 family, then replace AmazonEKS_CNI_Policy with the name of the policy that you created. This command requires that you have eksctl installed on your device. If you need to use a different tool to create the role, attach the policy to it, and annotate the Kubernetes service account, see Configure a Kubernetes service account to assume an IAM role.

eksctl create iamserviceaccount --name aws-node --namespace kube-system --cluster my-cluster --role-name AmazonEKSVPCCNIRole \
    --role-only --attach-policy-arn arn:aws-cn:iam::aws:policy/AmazonEKS_CNI_Policy --approve

Additional information – To learn more about the add-on's configurable settings, see aws-vpc-cni-k8s on GitHub. To learn more about the plugin, see Proposal: CNI plugin for Kubernetes networking over Amazon VPC. For more information about creating the add-on, see Creating the Amazon EKS add-on.

Update information – You can only update one minor version at a time. For example, if your current version is 1.27.x-eksbuild.y and you want to update to 1.29.x-eksbuild.y, then you must update your current version to 1.28.x-eksbuild.y and then update it again to 1.29.x-eksbuild.y. For more information about updating the add-on, see Updating the Amazon EKS add-on.

Name – coredns

Description – A flexible, extensible DNS server that can serve as the Kubernetes cluster DNS. The self-managed or managed type of this add-on was installed, by default, when you created your cluster. When you launch an Amazon EKS cluster with at least one node, two replicas of the CoreDNS image are deployed by default, regardless of the number of nodes deployed in your cluster. The CoreDNS Pods provide name resolution for all Pods in the cluster. You can deploy the CoreDNS Pods to Fargate nodes if your cluster includes an Amazon Fargate profile with a namespace that matches the namespace for the CoreDNS deployment.

Required IAM permissions – This add-on doesn't require any permissions.

Additional information – To learn more about CoreDNS, see Using CoreDNS for Service Discovery and Customizing DNS Service in the Kubernetes documentation.

Name – kube-proxy

Description – Maintains network rules on each Amazon EC2 node. It enables network communication to your Pods. The self-managed or managed type of this add-on is installed on each Amazon EC2 node in your cluster, by default.

Required IAM permissions – This add-on doesn't require any permissions.

Additional information – To learn more about kube-proxy, see kube-proxy in the Kubernetes documentation.

Update information – Before updating your current version, consider the following requirements:

Name – aws-ebs-csi-driver

Description – A Kubernetes Container Storage Interface (CSI) plugin that provides Amazon EBS storage for your cluster.

Required IAM permissions – This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. The permissions in the AmazonEBSCSIDriverPolicy Amazon managed policy are required. You can create an IAM role and attach the managed policy to it with the following command. Replace my-cluster with the name of your cluster and AmazonEKS_EBS_CSI_DriverRole with the name for your role. This command requires that you have eksctl installed on your device. If you need to use a different tool or you need to use a custom KMS key for encryption, see Creating the Amazon EBS CSI driver IAM role.

eksctl create iamserviceaccount \
    --name ebs-csi-controller-sa \
    --namespace kube-system \
    --cluster my-cluster \
    --role-name AmazonEKS_EBS_CSI_DriverRole \
    --role-only \
    --attach-policy-arn arn:aws-cn:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
    --approve

Additional information – To learn more about the add-on, see Amazon EBS CSI driver.

Name – aws-efs-csi-driver

Description – A Kubernetes Container Storage Interface (CSI) plugin that provides Amazon EFS storage for your cluster.

Required IAM permissions – This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. The permissions in the AmazonEFSCSIDriverPolicy Amazon managed policy are required. You can create an IAM role and attach the managed policy to it with the following commands. Replace my-cluster with the name of your cluster and AmazonEKS_EFS_CSI_DriverRole with the name for your role. These commands require that you have eksctl installed on your device. If you need to use a different tool, see Creating an IAM role.

export cluster_name=my-cluster
export role_name=AmazonEKS_EFS_CSI_DriverRole
eksctl create iamserviceaccount \
    --name efs-csi-controller-sa \
    --namespace kube-system \
    --cluster $cluster_name \
    --role-name $role_name \
    --role-only \
    --attach-policy-arn arn:aws-cn:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy \
    --approve
TRUST_POLICY=$(aws iam get-role --role-name $role_name --query 'Role.AssumeRolePolicyDocument' | \
    sed -e 's/efs-csi-controller-sa/efs-csi-*/' -e 's/StringEquals/StringLike/')
aws iam update-assume-role-policy --role-name $role_name --policy-document "$TRUST_POLICY"

Additional information – To learn more about the add-on, see Amazon EFS CSI driver.

Name – aws-mountpoint-s3-csi-driver

Description – A Kubernetes Container Storage Interface (CSI) plugin that provides Amazon S3 storage for your cluster.

Required IAM permissions – This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. The IAM role that is created will require a policy that gives access to S3. Follow the Mountpoint IAM permissions recommendations when creating the policy. Alternatively, you may use the Amazon managed policy AmazonS3FullAccess, but this managed policy grants more permissions than are needed for Mountpoint.

You can create an IAM role and attach your policy to it with the following commands. Replace my-cluster with the name of your cluster, region-code with the correct Amazon Web Services Region code, AmazonEKS_S3_CSI_DriverRole with the name for your role, and AmazonEKS_S3_CSI_DriverRole_ARN with the role ARN. These commands require that you have eksctl installed on your device. For instructions on using the IAM console or Amazon CLI, see Creating an IAM role.

CLUSTER_NAME=my-cluster
REGION=region-code
ROLE_NAME=AmazonEKS_S3_CSI_DriverRole
POLICY_ARN=AmazonEKS_S3_CSI_DriverRole_ARN
eksctl create iamserviceaccount \
    --name s3-csi-driver-sa \
    --namespace kube-system \
    --cluster $CLUSTER_NAME \
    --attach-policy-arn $POLICY_ARN \
    --approve \
    --role-name $ROLE_NAME \
    --region $REGION \
    --role-only

Additional information – To learn more about the add-on, see Mountpoint for Amazon S3 CSI driver.

Name – snapshot-controller

Description – The Container Storage Interface (CSI) snapshot controller enables the use of snapshot functionality in compatible CSI drivers, such as the Amazon EBS CSI driver.

Required IAM permissions – This add-on doesn't require any permissions.

Additional information – To learn more about the add-on, see CSI snapshot controller.

Name – adot

Description – The Amazon Distro for OpenTelemetry (ADOT) is a secure, production-ready, Amazon supported distribution of the OpenTelemetry project.

Required IAM permissions – This add-on only requires IAM permissions if you’re using one of the preconfigured custom resources that can be opted into through advanced configuration.

Additional information – For more information, see Getting Started with Amazon Distro for OpenTelemetry using EKS Add-Ons in the Amazon Distro for OpenTelemetry documentation.

ADOT requires that cert-manager is deployed on the cluster as a prerequisite, otherwise this add-on won't work if deployed directly using the Amazon EKS Terraform cluster_addons property. For more requirements, see Requirements for Getting Started with Amazon Distro for OpenTelemetry using EKS Add-Ons in the Amazon Distro for OpenTelemetry documentation.

Name – eks-pod-identity-agent

Description – Amazon EKS Pod Identity provide the ability to manage credentials for your applications, similar to the way that Amazon EC2 instance profiles provide credentials to EC2 instances.

Required IAM permissions – This add-on users permissions from the Amazon EKS node IAM role.

Update information – You can only update one minor version at a time. For example, if your current version is 1.27.x-eksbuild.y and you want to update to 1.29.x-eksbuild.y, then you must update your current version to 1.28.x-eksbuild.y and then update it again to 1.29.x-eksbuild.y. For more information about updating the add-on, see Updating the Amazon EKS add-on.