<!doctype html>
<html lang="en">
  <head>
  <meta charset="utf-8">
<title>EKS Building &amp; Troubleshooting - David&#39;s Blog</title>
<meta name="viewport" content="width=device-width, initial-scale=1">


<meta name="generator" content="Hugo 0.71.1" /><meta itemprop="name" content="EKS Building &amp; Troubleshooting">
<meta itemprop="description" content="This is the full map of EKS and we&rsquo;ll go through how to install EKS and plugins in this post, as well as the troubles I got. Let&rsquo;s go! Quick Start an EKS with ADD-ONs  git clone https://github.com/davidh83110/eks-quickstart cd terraform &amp;&amp; make plan &amp;&amp; make apply cd ansible-playbooks ansible-playbook ./ You will get an EKS cluster and Node Group, also has metrics-server / k8s-dashboard / ALB-Ingress controller / Cluster-Autoscaler (CA) / Prometheus / Grafana / Weave.">
<meta itemprop="datePublished" content="2020-03-30T00:00:00&#43;00:00" />
<meta itemprop="dateModified" content="2020-03-31T00:00:00&#43;00:00" />
<meta itemprop="wordCount" content="1014">
<meta itemprop="image" content="https://live.staticflickr.com/65535/49715657891_23558e7f5d_k.jpg">



<meta itemprop="keywords" content="" /><meta property="og:title" content="EKS Building &amp; Troubleshooting" />
<meta property="og:description" content="This is the full map of EKS and we&rsquo;ll go through how to install EKS and plugins in this post, as well as the troubles I got. Let&rsquo;s go! Quick Start an EKS with ADD-ONs  git clone https://github.com/davidh83110/eks-quickstart cd terraform &amp;&amp; make plan &amp;&amp; make apply cd ansible-playbooks ansible-playbook ./ You will get an EKS cluster and Node Group, also has metrics-server / k8s-dashboard / ALB-Ingress controller / Cluster-Autoscaler (CA) / Prometheus / Grafana / Weave." />
<meta property="og:type" content="article" />
<meta property="og:url" content="/blog/2020-03-30-eks-install/" />
<meta property="og:image" content="https://live.staticflickr.com/65535/49715657891_23558e7f5d_k.jpg" />
<meta property="article:published_time" content="2020-03-30T00:00:00+00:00" />
<meta property="article:modified_time" content="2020-03-31T00:00:00+00:00" />
<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:image" content="https://live.staticflickr.com/65535/49715657891_23558e7f5d_k.jpg"/>

<meta name="twitter:title" content="EKS Building &amp; Troubleshooting"/>
<meta name="twitter:description" content="This is the full map of EKS and we&rsquo;ll go through how to install EKS and plugins in this post, as well as the troubles I got. Let&rsquo;s go! Quick Start an EKS with ADD-ONs  git clone https://github.com/davidh83110/eks-quickstart cd terraform &amp;&amp; make plan &amp;&amp; make apply cd ansible-playbooks ansible-playbook ./ You will get an EKS cluster and Node Group, also has metrics-server / k8s-dashboard / ALB-Ingress controller / Cluster-Autoscaler (CA) / Prometheus / Grafana / Weave."/>
<link rel="stylesheet" href="/css/bundle.min.e48525f842f0775483c6c966d1db9b666b27d4da583ad8f8addd1dabb2f9d6de.css" integrity="sha256-5IUl&#43;ELwd1SDxslm0dubZmsn1NpYOtj4rd0dq7L51t4="><link rel="stylesheet" href="/css/add-on.css">
</head>

  <body>
    <header id="site-header">
  <nav id="site-nav">
    <h1 class="nav-title">
      <a href="/">
        
          
            Blog
          
        
      </a>
    </h1>
    <menu id="site-nav-menu" class="flyout-menu">
      
        
          
          
            <a href="/" class="link"><i class='fa fa-home'></i> Home</a>
          
        
      
        
          
          
            <a href="/about/" class="link"><i class='fa fa-code'></i> About</a>
          
        
      
        
          
          
            <a href="/blog/" class="link"><i class='fa fa-hashtag'></i> Blog</a>
          
        
      
        
          
          
            <a href="/categories/" class="link"><i class='fa fa-bars'></i> Categories</a>
          
        
      
        
          
          
            <a href="/archive/" class="link"><i class='fa fa-archive'></i> Archive</a>
          
        
      
      <a href="#share-menu" class="share-toggle"><i class="fas fa-share-alt">&nbsp;</i>Share</a>
      

    </menu>
    

    <a href="#share-menu" class="share-toggle"><i class="fas fa-share-alt fa-2x">&nbsp;</i></a>
    <a href="#site-nav" class="nav-toggle"><i class="fas fa-bars fa-2x"></i></a>
  </nav>
  <menu id="lang-menu" class="flyout-menu">
  <a href="#" lang="en" class="link active">English (en)</a>
  
    
      
    
      
        <a href="/zh-tw" lang="zh-tw" class="no-lang link">中文 (zh-tw)</a>
      
    
  
</menu>

  
    <menu id="share-menu" class="flyout-menu">
      <h1>Share Post</h1>
      




  
      <a href="//www.facebook.com/sharer/sharer.php?u=%2fblog%2f2020-03-30-eks-install%2f" target="_blank" rel="noopener" class="share-btn facebook">
        <i class="fab fa-facebook"></i><p>&nbsp;Facebook</p>
        </a>
  

  
        <a href="//www.linkedin.com/shareArticle?url=%2fblog%2f2020-03-30-eks-install%2f&amp;title=EKS%20Building%20%26%20Troubleshooting" target="_blank" rel="noopener" class="share-btn linkedin">
            <i class="fab fa-linkedin"></i><p>&nbsp;LinkedIn</p>
          </a>
  

  
        <a href="mailto:?subject=Check%20out%20this%20post%20by David&amp;body=%2fblog%2f2020-03-30-eks-install%2f" target="_blank" class="share-btn email" data-proofer-ignore>
          <i class="fas fa-envelope"></i><p>&nbsp;Email</p>
        </a>
  


    </menu>
  
</header>

    <div id="wrapper">
      <section id="site-intro" >
  <a href="/"><img src="/img/main/avator.jpg" class="circle" width="165px" alt="" /></a>
  <header>
    <h1>David Hsu</h1>
  </header>
  <main>
    
  </main>
  
    <footer>
      <ul class="socnet-icons">
        

        <li><a href="//github.com/davidh83110" target="_blank" rel="noopener" title="GitHub" class="fab fa-github"></a></li>

<li><a href="//stackoverflow.com/users/12397001" target="_blank" rel="noopener" title="Stack Overflow" class="fab fa-stack-overflow"></a></li>









<li><a href="//linkedin.com/in/david-hsu-b1136112b" target="_blank" rel="noopener" title="LinkedIn" class="fab fa-linkedin"></a></li>




<li><a href="//facebook.com/ben12567" target="_blank" rel="noopener" title="Facebook" class="fab fa-facebook"></a></li>








<li><a href="//instagram.com/davidh.110" target="_blank" rel="noopener" title="Instagram" class="fab fa-instagram"></a></li>













<li><a href="mailto:davidh83110@gmail.com" target="_blank" title="Email" class="far fa-envelope"></a></li>

        <p style="text-align: center;">
          DevOps Engineering / AWS / Cloud Native
        </p>
        <p style="text-align: center; opacity: 1;">
          <a href="https://www.certmetrics.com/amazon/public/badge.aspx?i=1&t=c&d=2019-11-09&ci=AWS00993116" target="_blank"></a>
          <img src="https://www.certmetrics.com/api/ob/image/amazon/c/1" width=100px>
        </p>
      </ul>
    </footer>
  
</section>

      <main id="site-main">
        <article class="post">
  <header>
  <div class="title">
    
      <h2><a href="/blog/2020-03-30-eks-install/">EKS Building &amp; Troubleshooting</a></h2>
    
    
  </div>
  <div class="meta">
    <time class="published" datetime="2020-03-30 00:00:00 &#43;0000 UTC">
      March 30, 2020
    </time>
    <span class="author">David</span>
    
  </div>
</header>

  <section id="socnet-share">
    




  
      <a href="//www.facebook.com/sharer/sharer.php?u=%2fblog%2f2020-03-30-eks-install%2f" target="_blank" rel="noopener" class="share-btn facebook">
        <i class="fab fa-facebook"></i><p>&nbsp;Facebook</p>
        </a>
  

  
        <a href="//www.linkedin.com/shareArticle?url=%2fblog%2f2020-03-30-eks-install%2f&amp;title=EKS%20Building%20%26%20Troubleshooting" target="_blank" rel="noopener" class="share-btn linkedin">
            <i class="fab fa-linkedin"></i><p>&nbsp;LinkedIn</p>
          </a>
  

  
        <a href="mailto:?subject=Check%20out%20this%20post%20by David&amp;body=%2fblog%2f2020-03-30-eks-install%2f" target="_blank" class="share-btn email" data-proofer-ignore>
          <i class="fas fa-envelope"></i><p>&nbsp;Email</p>
        </a>
  


  </section>
  
  <a href="/blog/2020-03-30-eks-install/" class="image featured">
    
    <p style="text-align: center;">
      <img src="https://live.staticflickr.com/65535/49715657891_23558e7f5d_k.jpg" alt="">
    </p>
    
  </a>


  <div class="content">
    <p>This is the full map of EKS and we&rsquo;ll go through how to install EKS and plugins in this post, as well as the troubles I got. Let&rsquo;s go!
<br />
<br /></p>
<h2 id="quick-start-an-eks-with-add-ons">Quick Start an EKS with ADD-ONs</h2>
<hr>
<pre><code>git clone https://github.com/davidh83110/eks-quickstart
cd terraform &amp;&amp; make plan &amp;&amp; make apply
cd ansible-playbooks
ansible-playbook ./
</code></pre><p>You will get an <code>EKS cluster</code> and <code>Node Group</code>, also has
<code>metrics-server</code> / <code>k8s-dashboard</code> / <code>ALB-Ingress controller</code> / <code>Cluster-Autoscaler (CA)</code> / <code>Prometheus</code> / <code>Grafana</code> / <code>Weave</code>.</p>
<p><br />
<br />
<br /></p>
<h2 id="pre-create-cluster">Pre-Create Cluster</h2>
<hr>
<p><strong>What EKS Cluster needs:</strong></p>
<ul>
<li><code>eksServiceRole</code></li>
<li>Subnets (Including Public and Private Subnets)</li>
<li>Additional Security Groups</li>
<li>Endpoint Access</li>
<li>Secrets Encryption
<br /></li>
</ul>
<p>最容易有疑問的大概是上述這幾個參數了，一一詳細記錄下來，其他沒有寫的應該都能很輕易的選擇。</p>
<ul>
<li>
<p><strong>eksServiceRole</strong><br>
這個有用過ECS應該都不陌生，EKS也需要一個類似的東西。<br>
需要兩個Policies. <code>AmazonEKSServicePolicy</code> &amp; <code>AmazonEKSClusterPolicy</code></p>
</li>
<li>
<p><strong>Subnets</strong><br>
Cluster的Subnets務必要選擇Public &amp; Private Subnets, <strong>不能只選Private</strong>.<br>
所謂Private就是要給你的Node用的; Public就是要給ALB-Ingress用的。</p>
</li>
<li>
<p><strong>Additional Security Group</strong><br>
這個是用來控制誰可以存取代管的MASTER.<br>
EKS會在創建的時候，自動幫你的Cluster掛上代管的Security Group，當你在啟動新的ALB-Ingress/NodeGroup的時候，這個代管的SG會自行變動Rules.<br>
Additional就是指除了這個代管的之外，你可以選擇其他你自由控制的SG附加上去。
<code>BUT, 一但建立之後就不能改變附加的SG了</code></p>
</li>
<li>
<p><strong>Endpoint Access</strong><br>
這個是控制誰可以使用Kubernetes API, 也就是誰可以用kubectl去控制這個cluster.<br>
For instance: 如果你希望要開VPN才可以使用，你就只需要勾選<code>Private Access</code>.<br>
但如果希望可以不要這麼麻煩的還要開VPN, 可以同時勾選<code>Public Access</code> &amp; <code>Private Access</code>, 並指定<code>Source to public access endpoint</code>.</p>
</li>
</ul>
<blockquote>
<p>如果勾選了Public Access, 一定要給Source IP.<br>
因為如果不給的會會套用預設值，也就是 0.0.0.0/0. 非常危險，你的cluster就裸奔了。</p>
</blockquote>
<ul>
<li>
<p><strong>Secrets Encryption</strong><br>
這是可以讓你綁定KMS Key去加密Kubernetes Secrets.<br>
<code>因為Kubernetes Secrets眾所皆知就是做base64 ENCODE 而已</code><br>
所謂Encode就是可以直接Decode (base64 -d), 是編碼的一種，<code>並不算是加密!</code></p>
<p>之前常見的做法會是使用Hashicorp的 <code>Vault</code>, 然後掛Sidecar在Runtime的時候去取.<br>
現在EKS提供和KMS的整合，讓我們在存進去的時候他就用KMS再做一層加密了，<br>
<code>只是我還不知道怎麼去驗證AWS確實有幫我們做加密, 這也是滿tricky的地方</code>。</p>
</li>
<li>
<p><strong>AWS Auth</strong><br>
之前會需要apply <code>aws-auth.yaml</code> 這個ConfigMap, 但現在(1.15)似乎EKS已經自己幫我們Apply了。<br>
如果要修改或新增 IAM User/Roles, 可以再去編輯這個 ConfigMap 就好。</p>
</li>
</ul>
<p><br />
<br />
<br /></p>
<h2 id="what-else-do-i-need-to-do-after-create-an-eks-cluster-">What else do I need to do after create an EKS cluster ?</h2>
<hr>
<p>先進到EKS Console, 來看看有什麼相關資訊。 以下列舉幾個比較可能有疑問的。</p>
<ul>
<li>
<p><strong>Platform version</strong><br>
AWS自己給的eks版本號碼，基本上不太需要理他。</p>
</li>
<li>
<p><strong>API server endpoint &amp; Certificate authority</strong><br>
你的Master API Endpoint跟Cert. 不過透過aws cli去做授權的話，也不太需要管這個。</p>
</li>
<li>
<p><strong>OpenID Connect provider URL</strong><br>
OIDC. 這是讓EKS可以結合IAM使用做授權管理的關鍵，會需要拿這個ID去IAM OIDC那邊建立一個新的<code>Identity providers</code>.<br>
後面會詳細講到如何建立。 主要是在建立 ALB-Ingress Controller的時候會需要去做建立。</p>
</li>
<li>
<p><strong>Node Group</strong><br>
在之前要建立EKS的Nodes, 會需要自己去建立Auto Scaling Group(ASG)並連結到EKS, 還要打一些Tags.<br>
現在透過Node Group可以半代管ASG, 他會自動根據你給的資訊去建立ASG, 並自動連結到EKS. (雖然常常有些問題)。<br>
後面也會詳細講到建立過程。</p>
</li>
<li>
<p><strong>Fargate Profiles</strong><br>
Fargate with EKS是沒有Node(worker)的概念的。就像ECS沒有ECS Instance一樣。<br>
所以這邊會去指定Fargate所在的Subnets和Role，提供給Pod在上面跑的資訊而已。</p>
</li>
</ul>
<p><br /></p>
<blockquote>
<p>比較值得說的是Fargate的使用模式</p>
<p>Fargate with EKS是有限制的，請以Serverless的角度來思考。</p>
<p>Fargate features with EKS:</p>
<ul>
<li>No Daemonset</li>
<li>No statefulset that require PV or File Systems (EFS also no supported)</li>
<li>Maximum 4vCPU and 30G Memory per pod</li>
<li>No CLB/NLB (cuz no NodePort in Fargate)</li>
</ul>
</blockquote>
<p><a href="https://aws.amazon.com/blogs/aws/amazon-eks-on-aws-fargate-now-generally-available/">More Information: AWS Blog - Fargate with EKS</a></p>
<p><br />
<br />
<br /></p>
<h2 id="第一件要做的事---tagging">第一件要做的事 - TAGGING</h2>
<hr>
<p>由於EKS繼承了Kops的模式，大量使用Tags來控制EKS的相關資源，也很容易被忽略，一定要做好這部分的控制。</p>
<p><code>kubernetes.io/cluster/${CLUSTER_NAME} </code> 是最廣泛使用的Tag, 會需要Tag在Subnets, Instances上。 可以Assign的值有兩個 - <code>owned</code> OR <code>shared</code>.<br>
一般來說在Subnets都會給<code>owned</code>, 因為會需要與其他EKS Cluster共用, 除非你希望這個Subnet是給某個cluster專用。
<code>shared</code> 顧名思義就是共用subnet。</p>
<p><code>elb</code> OR <code>internal-elb</code> 這個分別要Tag在Public &amp; Private Subnet上面，讓EKS知道他們是什麼類型的子網，
這樣ALB-Ingress才能根據Tag放到正確的子網。</p>
<p><br /></p>
<p>需要被Tag的有以下資源：</p>
<ul>
<li><strong>Public Subnets</strong></li>
</ul>
<pre><code>kubernetes.io/cluster/${CLUSTER_NAME} = shared
 
kubernetes.io/role/elb = 1
</code></pre><ul>
<li><strong>Private Subnets</strong></li>
</ul>
<pre><code>kubernetes.io/cluster/${CLUSTER_NAME} = shared
 
kubernetes.io/role/internal-elb = 1
</code></pre><ul>
<li><strong>Security Group / Instances / NodeGroup</strong><br>
這些理論上EKS會自動去檢查，然後幫我們tag上去，不要手賤去刪都行。
而我相信EKS也是往這個方向努力，之後會自己幫我們檢查TAG並自動做掉這部分，讓我們拭目以待。</li>
</ul>
<p><br />
<br />
<br /></p>
<h2 id="create-nodes">Create Nodes</h2>
<hr>
<p>建立Nodes有兩種方式</p>
<ul>
<li>自行建立Auto Scaling Group(ASG) &amp; ASG Configuration &amp; Register to EKS</li>
<li>使用EKS Node Group</li>
</ul>
<p>過去通常都要自行註冊與建立ASG, 是有點麻煩。 現在可以使用Node Group來幫我們<code>半代管</code>這個Nodes.</p>
<p>為什麼是<code>半代管</code>？</p>
<pre><code>當Node Group出現註冊問題或是有錯誤時，你還是得要進去這台機器手動排除錯誤。
</code></pre><p><br /></p>
<h4 id="建立node-group的注意事項"><strong>建立Node Group的注意事項</strong></h4>
<ul>
<li>
<p><strong>VPC</strong> (務必檢查，很容易忽略)</p>
<ul>
<li><code>MUST ENABLE enableDnsHostnames, enableDnsSupport</code></li>
<li><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/cluster-endpoint.html">Check Documentation Here</a></li>
</ul>
</li>
<li>
<p><strong>Subnets</strong><br>
選擇Private Subnets</p>
</li>
<li>
<p><strong>eksNodeRole</strong><br>
Attach 3 Policies:</p>
<ul>
<li>AmazonEC2ContainerRegistryReadOnly</li>
<li>AmazonEKS_CNI_Policy</li>
<li>AmazonEKSWorkerNodePolicy</li>
</ul>
</li>
<li>
<p><strong>Remote Access Security Group</strong><br>
要注意的是這裡指的是 <code>允許Remote Access</code> 的SG, 不是要掛在Instance上面的SG。</p>
</li>
<li>
<p><strong>Labels</strong><br>
這邊指的是 <code>Node Group的TAG, 不是Instance的TAG</code></p>
</li>
</ul>
<p><br />
<br />
<br /></p>
<h2 id="kubectl">Kubectl</h2>
<hr>
<p>做完以上那些大概要花10-20min去跑，跑完都是 <code>Active</code> 的狀態差不多就完成了。</p>
<p>接下來我們實際 Access 這個 cluster 看看。</p>
<p><br /></p>
<p>首先，需要安裝 <code>kubectl</code>. (自行安裝)</p>
<p>然後需要建立相對應的 <code>kubeconfig</code>, EKS 會使用 <code>aws-iam-authenticator</code> 來幫我們完成這部分。</p>
<p><br /></p>
<p>過程如下：</p>
<pre><code>➜  ~ aws eks --region ${REGION} update-kubeconfig --name ${CLUSTER_NAME}                                                                                                                                                           &lt;aws:dev&gt;
Updated context arn:aws:eks:ap-northeast-1:34323434:cluster/development in /Users/davidhsu/.kube/config
➜  ~                                                                                                                                                                                                                                &lt;aws:dev&gt;
➜  ~ kubectl get nodes                                                                                                                                                                                                              &lt;aws:dev&gt;
NAME                                              STATUS   ROLES    AGE    VERSION
ip-10-10-11-141.ap-northeast-1.compute.internal   Ready    &lt;none&gt;   125m   v1.15.10-eks-bac369
ip-10-10-12-203.ap-northeast-1.compute.internal   Ready    &lt;none&gt;   126m   v1.15.10-eks-bac369
➜  ~
</code></pre><p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/create-kubeconfig.html">Reference Official Documentation - EKS kubeconfig</a></p>
<hr>
<p>到這裡這個 EKS Cluster 就算是完成囉，但是還需要一些額外設定跟 Add-ons 的安裝。</p>
<p><br />
<br />
<br /></p>
<h2 id="add-ons-of-eks">ADD-ONs of EKS</h2>
<hr>
<p>這邊詳列要裝的 Add-ons 並附上官方的資料來源（官方怎不幫我裝一裝就好？）</p>
<p><br /></p>
<ul>
<li><strong>Metrics-Server</strong><br>
收集 kubernetes cluster 內各項指標，以便提供給 Prometheus/K8s Dashboard 收集使用，或做圖表的呈現。</li>
</ul>
<p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/metrics-server.html">安裝 Kubernetes 指標伺服器</a></p>
<p><br /></p>
<ul>
<li><strong>Kubernetes Dashboard</strong><br>
Kubernetes Web UI, 提供視覺化的操作以及資源的監控，必須要先建立 <code>eks-admin</code> 這個 ServiceAccount。</li>
</ul>
<p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/dashboard-tutorial.html">部署 Kubernetes Web UI (儀表板)</a></p>
<p><br /></p>
<ul>
<li><strong>Cluster Autoscaler (CA)</strong><br>
用來自動擴展 Node 數量的套件，當有資源需要 Node 而 Node 不夠的時候會自動加開新的 Nodes。</li>
</ul>
<p>和 <code>ASG</code> 是連動的，會自動調整 Desired &amp; Minimum Count，但是受到 Maximum 的限制，也就是說自動成長到定義的 Maximum 之後就不會再長了。</p>
<p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/cluster-autoscaler.html">EKS - Cluster Autoscaler</a></p>
<p><br /></p>
<ul>
<li><strong>ALB Ingress Controller</strong><br>
與ALB連接的Ingress Controller，可以直接在 ingress yaml 裡直接定義 ALB 的參數。</li>
</ul>
<p>比較可怕的是如果自定義 Security Group 的 ID ，會造成 Master SG 沒有自動加入這個 ALB 的 SG 到 Inbound，
就會一直是 unhealthy 的狀態，可以透過指定 inbound rule 的方式來避免這個 Bug。</p>
<pre><code>alb.ingress.kubernetes.io/security-group-inbound-cidrs: 61.67.11.22/32
</code></pre><p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/alb-ingress.html">Amazon EKS 上的 ALB 傳入控制器</a><br>
<a href="https://github.com/kubernetes-sigs/aws-alb-ingress-controller/issues/691">ALB Ingress Security Group&rsquo;s Issue</a></p>
<p><br /></p>
<ul>
<li><strong>Prometheus</strong></li>
</ul>
<p><a href="https://docs.aws.amazon.com/zh_tw/eks/latest/userguide/prometheus.html">控制平面指標與 Prometheus</a></p>
<p><br /></p>
<ul>
<li><strong>Grafana</strong></li>
</ul>
<p><a href="https://eksworkshop.com/intermediate/240_monitoring/deploy-grafana/">EKS Workshop - DEPLOY GRAFANA</a></p>
<p><br />
<br />
<br /></p>
<h2 id="troubleshooting">Troubleshooting</h2>
<hr>
<blockquote>
<p><strong>Q: Node cannot join to cluster? ( <code>cni config uninitialized</code> )</strong></p>
</blockquote>
<p>A: Please make sure subnets are well-tagging and all selected in EKS cluster.</p>
<p>If you&rsquo;re using NodeGroup then it won&rsquo;t has any problem on your instances basically,
so what you need to check is the resources about VPC and Subnets.</p>
<ul>
<li>Subnets tags
<ul>
<li><code>kubernetes.io/role/elb</code> = <code>1</code> (For Public Subnets (Ingress Subnets))</li>
<li><code>kubernetes.io/role/internal-elb</code> = <code>1</code> (For Private Subnets (Nodes Subnets))</li>
<li><code>kubernetes.io/cluster/${CLUSTER_NAME} </code> = <code>shared</code> (ALL Subnets including for ingress and nodes)</li>
</ul>
</li>
<li>You must selected <code>PUBLIC &amp; PRIVATE</code> subnets in EKS control plane.</li>
<li>VPC DNS Hostname <code>enabled</code></li>
<li>VPC DNS Support <code>enabled</code></li>
</ul>
<p><br />
Also, you can use <code>journalctl -u kubelet</code> on nodes to check the logs.</p>
<p><br />
<br /></p>
<blockquote>
<p><strong>Q: error: You must be logged in to the server (Unauthorized)</strong></p>
</blockquote>
<p>A: Your identity might be wrong. Please check the current identity by the following command.</p>
<pre><code>- $ aws sts get-caller-identity
{
    &quot;Account&quot;: &quot;000012345&quot;,
    &quot;UserId&quot;: &quot;dawdwwfwefewfefwef&quot;,
    &quot;Arn&quot;: &quot;arn:aws:iam::000012345:user/david&quot;
}
</code></pre><p>Then rerun the kubeconfig setup.</p>
<pre><code>- $ aws eks --region ap-northeast-1 update-kubeconfig --name test-cluster                                                                                                                                                           &lt;aws:dev&gt;
Updated context arn:aws:eks:ap-northeast-1:000012345:cluster/test-cluster in /Users/davidhsu/.kube/config
</code></pre><p><br />
<br /></p>
<blockquote>
<p><strong>Q: Security Group on EKS Control Plane?</strong></p>
</blockquote>
<p>A: EKS Control plane has 2 kinds of subnets.</p>
<ul>
<li>EKS Master Managed SG</li>
<li>Additional SG</li>
</ul>
<p>When we are creating some AWS resources such as ALB-Ingress&rsquo;s SG,
it will be automatically added to Master managed SG, so we don&rsquo;t have to worry about it.</p>
<p>Additional SG is for other source you trust, you can add them to the SG so that they can access the EKS Master as well.</p>
<p><br />
<br /></p>
<blockquote>
<p><strong>Q: API server endpoint access?</strong></p>
</blockquote>
<p>A: If you are using <code>private access</code> for the connectivity between nodes and master,<br>
then you must <code>enable VPC DNS hostname and support</code>. Otherwise, it will still go with public route.</p>
<p><br />
<br /></p>
<blockquote>
<p><strong>Q: Fargate with EKS</strong></p>
</blockquote>
<p>A: <code>Fargate is a serverless service.</code></p>
<p>It doesn&rsquo;t support <code>daemonset</code> / <code>statefulset</code> / <code>EFS</code>.<br>
Only <code>10G</code> volume can be used per Fargate; and the maximum of vCPU and Memory are 4vCPU and 30G RAM.</p>
<p>To use Fargate on EKS, you need to create <code>Fargate Profile</code> first.</p>
<p><br />
<br /></p>
<blockquote>
<p><strong>Q: Can I specify Security Group for ALB-Ingress?</strong></p>
</blockquote>
<p>A: Yes. But the EKS Managed SG might not be changed and it means you have to change by yourself.<br>
The alternative way would be specify the SG rules for ALB Ingress.</p>
<p>Example:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: &quot;weave-scope-ingress&quot;
  namespace: &quot;weave&quot;
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/security-group-inbound-cidrs: 61.220.65.15/32
...(skip)
</code></pre><p><br />
<br /></p>
<blockquote>
<p><strong>Q: Cluster Autoscler didn&rsquo;t trigger scale down</strong></p>
</blockquote>
<p>A: Don&rsquo;t worry, normally it would cost around 10min to let the CA calculate which Pods should be moved to which Node. It really takes time bus I can&rsquo;t really realize why, seems the calculation not complicated at all.</p>

  </div>
  <footer>
    <ul class="stats">
  
    
    
      <li class="categories">
        <ul>
          
            
            <li><a class="article-category-link" href="/categories/aws">AWS</a></li>
          
            
            <li><a class="article-category-link" href="/categories/kubernetes">Kubernetes</a></li>
          
            
            <li><a class="article-category-link" href="/categories/%E7%B3%BB%E7%B5%B1%E5%BB%BA%E7%BD%AE">系統建置</a></li>
          
            
            <li><a class="article-category-link" href="/categories/terraform">Terraform</a></li>
          
        </ul>
      </li>
    
  
  
    <li class="tags">
      <ul>
        <li>-</li>
      </ul>
    </li>
  
</ul>

  </footer>
</article>

    <article class="post">
        <div id="disqus_thread"></div>
<script type="application/javascript">
    var disqus_config = function () {
    
    
    
    };
    (function() {
        if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
            document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
            return;
        }
        var d = document, s = d.createElement('script'); s.async = true;
        s.src = '//' + "davidh83110" + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
    })();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
    </article>




<div class="pagination">
  
    <a href="/blog/2020-03-05-saas-self-hosted/" class="button"><div class="previous"><div>SaaS/Managed Services &amp; Self-Hosted 衍伸思考</div></div></a>
  
  
    <a href="/aws/kubernetes/%E7%B3%BB%E7%B5%B1%E5%BB%BA%E7%BD%AE/terraform/2020/05/14/eks-external-dns.html" class="button"><div class="next"><div>EKS External-DNS Cross Account Route53 Setup</div></div></a>
  
</div>


      </main>
      <section id="site-sidebar">






  
    
      <section id="categories">
        <header>
          <h1><a href="/categories">Categories</a></h1>
        </header>
        <ul>
          
            
          
          
          <li>
            
              <a href="/categories/%E6%8A%80%E8%A1%93%E7%B0%A1%E4%BB%8B/">技術簡介<span class="count">13</span></a>
            
          
          <li>
            
              <a href="/categories/%E7%B3%BB%E7%B5%B1%E5%BB%BA%E7%BD%AE/">系統建置<span class="count">8</span></a>
            
          
          <li>
            
              <a href="/categories/aws/">aws<span class="count">7</span></a>
            
          
          <li>
            
              <a href="/categories/%E9%9B%9C%E4%B8%83%E9%9B%9C%E5%85%AB/">雜七雜八<span class="count">5</span></a>
            
          
          <li>
            
              <a href="/categories/python/">python<span class="count">4</span></a>
            
          
          <li>
            
              <a href="/categories/kubernetes/">kubernetes<span class="count">2</span></a>
            
          
          <li>
            
              <a href="/categories/terraform/">terraform<span class="count">2</span></a>
            
          
          <li>
            
              <a href="/categories/owasp-top10/">owasp-top10<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/serverless/">serverless<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/%E4%BA%BA%E5%B7%A5%E6%99%BA%E6%85%A7/">人工智慧<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/%E5%89%8D%E7%AB%AF%E5%B7%A5%E7%A8%8B/">前端工程<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/%E5%BE%8C%E7%AB%AF%E5%B7%A5%E7%A8%8B/">後端工程<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/%E8%B3%87%E8%A8%8A%E5%AE%89%E5%85%A8/">資訊安全<span class="count">1</span></a>
            
          
          <li>
            
              <a href="/categories/%E9%A7%AD%E5%AE%A2%E6%8A%80%E8%A1%93/">駭客技術<span class="count">1</span></a>
            
          
          </li>
        </ul>
      </section>
    
  


  
    <section id="recent-posts">
      <header>
        <h1>Recent posts</h1>
      </header>
      
      <article class="mini-post">
        <section>
          
  <a href="/aws/kubernetes/%E7%B3%BB%E7%B5%B1%E5%BB%BA%E7%BD%AE/terraform/2020/05/14/eks-external-dns.html" class="image featured">
    
    <p style="text-align: center;">
      <img src="https://live.staticflickr.com/65535/49908288961_c380509717_b.jpg%20width=10" alt="">
    </p>
    
  </a>


        </section>
        <header>
          <h4><a href="/aws/kubernetes/%E7%B3%BB%E7%B5%B1%E5%BB%BA%E7%BD%AE/terraform/2020/05/14/eks-external-dns.html">EKS External-DNS Cross Account Route53 Setup</a></h4>
          <time class="published" datetime="">May 14, 2020</time>
        </header>
      </article>
      
      <article class="mini-post">
        <section>
          
  <a href="/blog/2020-03-30-eks-install/" class="image featured">
    
    <p style="text-align: center;">
      <img src="https://live.staticflickr.com/65535/49715657891_23558e7f5d_k.jpg" alt="">
    </p>
    
  </a>


        </section>
        <header>
          <h4><a href="/blog/2020-03-30-eks-install/">EKS Building &amp; Troubleshooting</a></h4>
          <time class="published" datetime="">March 30, 2020</time>
        </header>
      </article>
      
      <article class="mini-post">
        <section>
          
  <a href="/blog/2020-03-05-saas-self-hosted/" class="image featured">
    
    <p style="text-align: center;">
      <img src="https://live.staticflickr.com/65535/49618259028_e4784532cf_h.jpg" alt="">
    </p>
    
  </a>


        </section>
        <header>
          <h4><a href="/blog/2020-03-05-saas-self-hosted/">SaaS/Managed Services &amp; Self-Hosted 衍伸思考</a></h4>
          <time class="published" datetime="">March 5, 2020</time>
        </header>
      </article>
      
      <article class="mini-post">
        <section>
          

        </section>
        <header>
          <h4><a href="/blog/2020-02-15-cloud-native-log-solution/">Cloud-Native LOG 儲存以及分析方案</a></h4>
          <time class="published" datetime="">February 15, 2020</time>
        </header>
      </article>
      
      <article class="mini-post">
        <section>
          
  <a href="/blog/2019-12-05-aws-saa-pass/" class="image featured">
    
    <p style="text-align: center;">
      <img src="https://live.staticflickr.com/65535/49038426206_83d9c537d2_h.jpg" alt="">
    </p>
    
  </a>


        </section>
        <header>
          <h4><a href="/blog/2019-12-05-aws-saa-pass/">AWS Solutions Architect Associate (SAA) - [PASSED] 心得以及攻略</a></h4>
          <time class="published" datetime="">December 5, 2019</time>
        </header>
      </article>
      
      <article class="mini-post">
        <section>
          

        </section>
        <header>
          <h4><a href="/blog/2019-02-03-terraform-module-bitbucket/">Terraform Module Private Registries - Bitbucket</a></h4>
          <time class="published" datetime="">February 3, 2019</time>
        </header>
      </article>
      
      
        <footer>
          <a href="/blog/" class="button">See more</a>
        </footer>
      
    </section>
  


</section>
      <footer id="site-footer">
  
      <ul class="socnet-icons">
        

        <li><a href="//github.com/davidh83110" target="_blank" rel="noopener" title="GitHub" class="fab fa-github"></a></li>

<li><a href="//stackoverflow.com/users/12397001" target="_blank" rel="noopener" title="Stack Overflow" class="fab fa-stack-overflow"></a></li>









<li><a href="//linkedin.com/in/david-hsu-b1136112b" target="_blank" rel="noopener" title="LinkedIn" class="fab fa-linkedin"></a></li>




<li><a href="//facebook.com/ben12567" target="_blank" rel="noopener" title="Facebook" class="fab fa-facebook"></a></li>








<li><a href="//instagram.com/davidh.110" target="_blank" rel="noopener" title="Instagram" class="fab fa-instagram"></a></li>













<li><a href="mailto:davidh83110@gmail.com" target="_blank" title="Email" class="far fa-envelope"></a></li>

      </ul>
  
  <p class="copyright">
    
      &copy; 2020
      
        David&#39;s Blog
      
    . <br>
    Theme: <a href='https://github.com/pacollins/hugo-future-imperfect-slim' target='_blank' rel='noopener'>Hugo Future Imperfect Slim</a><br>A <a href='https://html5up.net/future-imperfect' target='_blank' rel='noopener'>HTML5 UP port</a> | Powered by <a href='https://gohugo.io/' title='0.71.1' target='_blank' rel='noopener'>Hugo</a>
  </p>
</footer>
<a id="back-to-top" href="#" class="fas fa-arrow-up fa-2x"></a>

      <script src="/js/highlight.js"></script>
    <script>hljs.initHighlightingOnLoad();</script>
    <script>hljs.initLineNumbersOnLoad();</script><script src="/js/bundle.min.ba01f4c6fd09c8681f5bb9960755a2d29a543735c990ef92c5c97365cbb37a4e.js" integrity="sha256-ugH0xv0JyGgfW7mWB1Wi0ppUNzXJkO&#43;SxclzZcuzek4="></script>
    <script src="/js/add-on.js"></script>
    </div>
  </body>
</html>
