Create self-managed Ubuntu Linux nodes - Amazon EKS
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

Want to contribute to this user guide? Choose the Edit this page on GitHub link that is located in the right pane of every page. Your contributions will help make our user guide better for everyone.

Create self-managed Ubuntu Linux nodes

Note

Managed node groups might offer some advantages for your use case. For more information, see Simplify node lifecycle with managed node groups.

This topic describes how to launch Auto Scaling groups of Ubuntu on Amazon Elastic Kubernetes Service (EKS) or Ubuntu Pro on Amazon Elastic Kubernetes Service (EKS) nodes that register with your Amazon EKS cluster. Ubuntu and Ubuntu Pro for EKS are based on the official Ubuntu Minimal LTS, include the custom Amazon kernel that is jointly developed with Amazon, and have been built specifically for EKS. Ubuntu Pro adds additional security coverage by supporting EKS extended support periods, kernel livepatch, FIPS compliance and the ability to run unlimited Pro containers.

After the nodes join the cluster, you can deploy containerized applications to them. For more information, visit the documentation for Ubuntu on Amazon and Custom AMI support in the eksctl documentation.

Important
  • Amazon EKS nodes are standard Amazon EC2 instances, and you are billed for them based on normal Amazon EC2 instance prices. For more information, see Amazon EC2 pricing.

  • You can launch Ubuntu nodes in Amazon EKS extended clusters on Amazon Outposts, but you can’t launch them in local clusters on Amazon Outposts. For more information, see Deploy Amazon EKS on-premises with Amazon Outposts.

  • You can deploy to Amazon EC2 instances with x86 or Arm processors. However, instances that have Inferentia chips might need to install the Neuron SDK first.

This procedure requires eksctl version 0.199.0 or later. You can check your version with the following command:

eksctl version

For instructions on how to install or upgrade eksctl, see Installation in the eksctl documentation.NOTE: This procedure only works for clusters that were created with eksctl.

+ . Copy the following contents to your device. Replace my-cluster with the name of your cluster. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and can’t be longer than 100 characters. Replace ng-ubuntu with a name for your node group. The node group name can’t be longer than 63 characters. It must start with letter or digit, but can also include hyphens and underscores for the remaining characters. To deploy on Arm instances, replace m5.large with an Arm instance type. Replace my-ec2-keypair-name with the name of an Amazon EC2 SSH key pair that you can use to connect using SSH into your nodes with after they launch. If you don’t already have an Amazon EC2 key pair, you can create one in the Amazon Web Services Management Console. For more information, see Amazon EC2 key pairs in the Amazon EC2 User Guide. Replace all remaining example values with your own values. Once you’ve made the replacements, run the modified command to create the ubuntu.yaml file.

+ IMPORTANT: To deploy a node group to Amazon Outposts, Amazon Wavelength, or Amazon Local Zone subnets, don’t pass Amazon Outposts, Amazon Wavelength, or Amazon Local Zone subnets when you create the cluster. You must specify the subnets in the following example. For more information see Create a nodegroup from a config file and Config file schema in the eksctl documentation. Replace region-code with the Amazon Region that your cluster is in.

+

cat >ubuntu.yaml <<EOF --- apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: my-cluster region: region-code version: '1.30' iam: withOIDC: true nodeGroups: - name: ng-ubuntu instanceType: m5.large desiredCapacity: 3 amiFamily: Ubuntu2204 iam: attachPolicyARNs: - arn:aws-cn:iam::aws:policy/AmazonEKSWorkerNodePolicy - arn:aws-cn:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly - arn:aws-cn:iam::aws:policy/AmazonSSMManagedInstanceCore - arn:aws-cn:iam::aws:policy/AmazonEKS_CNI_Policy ssh: allow: true publicKeyName: my-ec2-keypair-name EOF

+ To create an Ubuntu Pro node group, just change the amiFamily value to UbuntuPro2204. . Deploy your nodes with the following command.

+

eksctl create nodegroup --config-file=ubuntu.yaml

+ An example output is as follows.

+ Several lines are output while the nodes are created. One of the last lines of output is the following example line.

+

[✔] created 1 nodegroup(s) in cluster "my-cluster"
  1. (Optional) Deploy a sample application to test your Ubuntu nodes.

  2. We recommend blocking Pod access to IMDS if the following conditions are true:

    • You plan to assign IAM roles to all of your Kubernetes service accounts so that Pods only have the minimum permissions that they need.

    • No Pods in the cluster require access to the Amazon EC2 instance metadata service (IMDS) for other reasons, such as retrieving the current Amazon Region.

    For more information, see Restrict access to the instance profile assigned to the worker node.