EKS

9 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

EKSAccessEntry # GA

EKSAccessEntry is the Schema for managing EKS Access Entries.

kubectl get eksaccessentries · example on GitHub

Example

# EKSAccessEntry — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#eksaccessentry
apiVersion: aws.konfig.io/v1alpha1
kind: EKSAccessEntry
metadata:
  name: example-eksaccessentry
  namespace: default
spec:
  accessPolicies:
  - accessScope:
      namespaces:
      - example
      type: cluster
    policyArn: arn:aws:iam::123456789012:role/example-role
  clusterName: example-eksaccessentry
  clusterRef:
    clusterName: example-eksaccessentry
    name: example-eksaccessentry
  kubernetesGroups:
  - example
  principalArn: arn:aws:iam::123456789012:role/example-role
  principalRef:
    name: example-principal
  providerRef:
    name: example-eksaccessentry
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: STANDARD
  username: example-eksaccessentry

Spec

Field	Type	Required	Description
`accessPolicies`	array<object>	—	AccessPolicies are the EKS access policies to associate with this entry.
`accessPolicies[].accessScope`	object	yes	AccessScope defines the scope of the policy.
`accessPolicies[].accessScope.namespaces`	array<string>	—	Namespaces is the list of Kubernetes namespaces the policy applies to.
`accessPolicies[].accessScope.type`	enum	yes	Type is the scope type: cluster or namespace. Allowed: `cluster, namespace`
`accessPolicies[].policyArn`	string	yes	PolicyArn is the ARN of the EKS access policy.
`clusterName`	string	—	ClusterName is the EKS cluster name.
`clusterRef`	object	—	ClusterRef references an EKSCluster CR in the same namespace.
`clusterRef.clusterName`	string	—	ClusterName is a direct AWS EKS cluster name, bypassing CR lookup.
`clusterRef.name`	string	—	Name of an EKSCluster CR in the same namespace.
`kubernetesGroups`	array<string>	—	KubernetesGroups are the Kubernetes RBAC groups to assign to this principal.
`principalArn`	string	—	PrincipalArn is the IAM role or user ARN to grant cluster access.
`principalRef`	object	—	PrincipalRef references an IAMRole CR in the same namespace.
`principalRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`principalRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`principalRef.namespace`	string	—	Namespace of the IAMRole CR.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags.
`type`	enum	—	Type is the access entry type. Allowed: `STANDARD, FARGATE_LINUX, EC2_LINUX, EC2_WINDOWS`
`username`	string	—	Username is the Kubernetes username for this principal.

Status

Field	Type	Required	Description
`accessEntryArn`	string	—	AccessEntryArn is the ARN of the access entry.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

EKSAddon # GA

EKSAddon is the Schema for managing EKS Add-ons.

kubectl get eksaddons · example on GitHub

Example

# EKSAddon — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#eksaddon
apiVersion: aws.konfig.io/v1alpha1
kind: EKSAddon
metadata:
  name: example-eksaddon
  namespace: default
spec:
  addonName: example-eksaddon
  addonVersion: '1.0'
  clusterName: example-eksaddon
  clusterRef:
    clusterName: example-eksaddon
    name: example-eksaddon
  configurationValues: example
  providerRef:
    name: example-eksaddon
    region: us-east-1
  resolveConflicts: OVERWRITE
  serviceAccountRoleArn: arn:aws:iam::123456789012:role/example-role
  serviceAccountRoleRef:
    name: example-serviceaccountrole
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`addonName`	string	yes	AddonName is the name of the EKS add-on (e.g.
`addonVersion`	string	—	AddonVersion is the version of the add-on.
`clusterName`	string	—	ClusterName is the EKS cluster name.
`clusterRef`	object	—	ClusterRef references an EKSCluster CR in the same namespace.
`clusterRef.clusterName`	string	—	ClusterName is a direct AWS EKS cluster name, bypassing CR lookup.
`clusterRef.name`	string	—	Name of an EKSCluster CR in the same namespace.
`configurationValues`	string	—	ConfigurationValues is a JSON or YAML string of configuration values for the add-on.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resolveConflicts`	enum	—	ResolveConflicts controls how conflicts are resolved when updating the add-on. Allowed: `OVERWRITE, NONE, PRESERVE`
`serviceAccountRoleArn`	string	—	ServiceAccountRoleArn is an IAM role ARN for the add-on's service account (IRSA).
`serviceAccountRoleRef`	object	—	ServiceAccountRoleRef references an IAMRole CR in the same namespace.
`serviceAccountRoleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`serviceAccountRoleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`serviceAccountRoleRef.namespace`	string	—	Namespace of the IAMRole CR.
`tags`	map<string>	—	Tags are AWS resource tags.

Status

Field	Type	Required	Description
`addonArn`	string	—	AddonArn is the ARN of the EKS add-on.
`addonVersion`	string	—	AddonVersion is the currently installed add-on version.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the add-on status: CREATING, ACTIVE, UPDATING, DEGRADED, DELETING.

EKSCapability # CLOUD CONTROL · AWS::EKS::Capability

EKSCapability manages AWS::EKS::Capability through the AWS Cloud Control API.

kubectl get ekscapabilities · example on GitHub

Example

# EKSCapability — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#ekscapability
apiVersion: aws.konfig.io/v1alpha1
kind: EKSCapability
metadata:
  name: example-ekscapability
  namespace: default
spec:
  capabilityName: example-ekscapability
  clusterName: example-ekscapability
  configuration:
    ack:
      disabledServices:
      - example
      enableCrossNamespace: true
    argoCd:
      awsIdc:
        idcInstanceArn: arn:aws:iam::123456789012:role/example-role
        idcManagedApplicationArn: arn:aws:iam::123456789012:role/example-role
        idcRegion: example
      namespace: example
      networkAccess:
        vpceIds:
        - example
      rbacRoleMappings:
      - identities:
        - id: example-id
          type: SSO_USER
        role: ADMIN
      serverUrl: example
  deletePropagationPolicy: RETAIN
  providerRef:
    name: example-ekscapability
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example
  type: ARGOCD

Spec

Field	Type	Required	Description
`capabilityName`	string	yes	A unique name for the capability.
`clusterName`	string	yes	The name of the EKS cluster where you want to create the capability.
`configuration`	object	—	The configuration settings for the capability.
`configuration.ack`	object	—	EKSCapabilityAck is a nested property type of AWS::EKS::Capability.
`configuration.ack.disabledServices`	array<string>	—	A list of ACK service names to disable.
`configuration.ack.enableCrossNamespace`	boolean	—	Whether cross-namespace references are enabled for ACK controllers.
`configuration.argoCd`	object	—	EKSCapabilityArgoCd is a nested property type of AWS::EKS::Capability.
`configuration.argoCd.awsIdc`	object	yes	EKSCapabilityAwsIdc is a nested property type of AWS::EKS::Capability.
`configuration.argoCd.awsIdc.idcInstanceArn`	string	yes	The ARN of the IAM Identity Center instance to use for authentication.
`configuration.argoCd.awsIdc.idcManagedApplicationArn`	string	—	The ARN of the managed application created in IAM Identity Center for this Argo CD capability.
`configuration.argoCd.awsIdc.idcRegion`	string	—	The Region where your IAM Identity Center instance is located.
`configuration.argoCd.namespace`	string	—	The Kubernetes namespace where Argo CD resources will be created.
`configuration.argoCd.networkAccess`	object	—	EKSCapabilityNetworkAccess is a nested property type of AWS::EKS::Capability.
`configuration.argoCd.networkAccess.vpceIds`	array<string>	—	A list of VPC endpoint IDs to associate with the managed Argo CD API server endpoint.
`configuration.argoCd.rbacRoleMappings`	array<object>	—	A list of role mappings that define which IAM Identity Center users or groups have which Argo CD roles.
`configuration.argoCd.rbacRoleMappings[].identities`	array<object>	yes	A list of IAM Identity Center identities (users or groups) that should be assigned this Argo CD role.
`configuration.argoCd.rbacRoleMappings[].identities[].id`	string	yes	The unique identifier of the IAM Identity Center user or group.
`configuration.argoCd.rbacRoleMappings[].identities[].type`	enum	yes	The type of identity. Allowed: `SSO_USER, SSO_GROUP`
`configuration.argoCd.rbacRoleMappings[].role`	enum	yes	The Argo CD role to assign. Allowed: `ADMIN, EDITOR, VIEWER`
`configuration.argoCd.serverUrl`	string	—	The URL of the Argo CD server.
`deletePropagationPolicy`	enum	yes	Specifies how Kubernetes resources managed by the capability should be handled when the capability is deleted. Allowed: `RETAIN`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes	The Amazon Resource Name (ARN) of the IAM role that the capability uses to interact with AWS services.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`type`	enum	yes	The type of capability to create. Allowed: `ARGOCD, ACK, KRO`

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the capability.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The Unix epoch timestamp in seconds for when the capability was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`modifiedAt`	string	—	The Unix epoch timestamp in seconds for when the capability was last modified.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	The current status of the capability.
`version`	string	—	The version of the capability software that is currently running.

EKSCertificateAuthority # CLOUD CONTROL · AWS::EKS::CertificateAuthority

EKSCertificateAuthority manages AWS::EKS::CertificateAuthority through the AWS Cloud Control API.

kubectl get ekscertificateauthorities · example on GitHub

Example

# EKSCertificateAuthority — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#ekscertificateauthority
apiVersion: aws.konfig.io/v1alpha1
kind: EKSCertificateAuthority
metadata:
  name: example-ekscertificateauthority
  namespace: default
spec:
  clusterName: example-ekscertificateauthority
  providerRef:
    name: example-ekscertificateauthority
    region: us-east-1

Spec

Field	Type	Required	Description
`clusterName`	string	yes	The name of the EKS cluster that the certificate authority belongs to.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`activatedAt`	string	—	The timestamp when the certificate authority was activated.
`activatedBy`	string	—	The entity that activated the certificate authority.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the certificate authority was created.
`createdBy`	string	—	The entity that created the certificate authority.
`data`	string	—	The Base64 encoded certificate authority data.
`distributionStatus`	string	—	The distribution status of the certificate authority.
`id`	string	—	The unique identifier of the certificate authority.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`rollbackAvailable`	boolean	—	Whether activation of this certificate authority can still be rolled back.
`scheduledEvents`	object	—	The scheduled auto-activation events for the certificate authority.
`scheduledEvents.finalAutoActivation`	string	—	The deadline by which EKS will auto-activate this certificate authority (notAfter minus 45 days).
`scheduledEvents.firstAutoActivation`	string	—	The earliest date EKS may auto-activate this certificate authority (notAfter minus 6 months).
`signingStatus`	string	—	The signing status of the certificate authority.
`validity`	object	—	The validity period of the certificate authority.
`validity.notAfter`	string	—	The end of the validity period for the certificate authority.
`validity.notBefore`	string	—	The start of the validity period for the certificate authority.

EKSCluster # GA

EKSCluster is the Schema for managing EKS Clusters.

kubectl get eksclusters · example on GitHub

Example

# EKSCluster — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#ekscluster
apiVersion: aws.konfig.io/v1alpha1
kind: EKSCluster
metadata:
  name: example-ekscluster
  namespace: default
spec:
  accessConfig:
    authenticationMode: API
    bootstrapClusterCreatorAdminPermissions: false
  bootstrapSelfManagedAddons: false
  clusterName: example-ekscluster
  encryptionConfig:
    providerKeyArn: arn:aws:iam::123456789012:role/example-role
    resources:
    - example
  kubernetesNetworkConfig:
    ipFamily: ipv4
    serviceIpv4Cidr: 10.0.0.0/16
  logging:
    enabledTypes:
    - example
  providerRef:
    name: example-ekscluster
    region: us-east-1
  resourcesVpcConfig:
    endpointPrivateAccess: false
    endpointPublicAccess: false
    publicAccessCidrs:
    - 10.0.0.0/16
    securityGroupRefs:
    - name: example-securitygrouprefs
    subnetRefs:
    - name: example-subnetrefs
  roleArn: arn:aws:iam::123456789012:role/example-role
  roleRef:
    name: example-role
  tags:
    environment: dev
    team: platform
  upgradePolicy:
    supportType: STANDARD
  version: '1.0'

Spec

Field	Type	Required	Description
`accessConfig`	object	—	AccessConfig configures the cluster authentication mode.
`accessConfig.authenticationMode`	enum	—	AuthenticationMode controls how IAM principals are granted cluster access. Allowed: `API, API_AND_CONFIG_MAP, CONFIG_MAP`
`accessConfig.bootstrapClusterCreatorAdminPermissions`	boolean	—	BootstrapClusterCreatorAdminPermissions grants the cluster creator admin access.
`bootstrapSelfManagedAddons`	boolean	—	BootstrapSelfManagedAddons installs self-managed add-ons on cluster creation.
`clusterName`	string	yes	ClusterName is the name of the EKS cluster.
`encryptionConfig`	object	—	EncryptionConfig enables KMS encryption of Kubernetes secrets.
`encryptionConfig.providerKeyArn`	string	yes	ProviderKeyArn is the KMS key ARN to use for encryption.
`encryptionConfig.resources`	array<string>	yes	Resources is the list of Kubernetes resources to encrypt (e.g.
`kubernetesNetworkConfig`	object	—	KubernetesNetworkConfig configures the Kubernetes network.
`kubernetesNetworkConfig.ipFamily`	enum	—	IPFamily is the IP family for the cluster: ipv4 or ipv6. Allowed: `ipv4, ipv6`
`kubernetesNetworkConfig.serviceIpv4Cidr`	string	—	ServiceIPv4CIDR is the CIDR block for Kubernetes service IPs.
`logging`	object	—	Logging configures control plane logging.
`logging.enabledTypes`	array<string>	—	EnabledTypes is the list of log types to enable.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourcesVpcConfig`	object	yes	ResourcesVpcConfig is the VPC configuration for the cluster control plane.
`resourcesVpcConfig.endpointPrivateAccess`	boolean	—	EndpointPrivateAccess enables the private API server endpoint.
`resourcesVpcConfig.endpointPublicAccess`	boolean	—	EndpointPublicAccess enables the public API server endpoint.
`resourcesVpcConfig.publicAccessCidrs`	array<string>	—	PublicAccessCidrs restricts access to the public endpoint.
`resourcesVpcConfig.securityGroupRefs`	array<object>	—	SecurityGroupRefs are additional security groups for the control plane ENIs.
`resourcesVpcConfig.securityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`resourcesVpcConfig.securityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`resourcesVpcConfig.subnetRefs`	array<object>	yes	SubnetRefs are the subnets for the EKS control plane ENIs.
`resourcesVpcConfig.subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`resourcesVpcConfig.subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`roleArn`	string	—	RoleArn is the IAM role ARN for the EKS control plane.
`roleRef`	object	—	RoleRef is a reference to an IAMRole CR in the same namespace.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`upgradePolicy`	object	—	UpgradePolicy configures the cluster version support policy.
`upgradePolicy.supportType`	enum	yes	SupportType is STANDARD or EXTENDED. Allowed: `STANDARD, EXTENDED`
`version`	string	—	Version is the Kubernetes version for the cluster (e.g.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`certificateAuthority`	string	—	CertificateAuthority is the base64-encoded certificate authority data.
`clusterArn`	string	—	ClusterArn is the ARN of the EKS cluster.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpoint`	string	—	Endpoint is the Kubernetes API server endpoint.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`oidcIssuer`	string	—	OIDCIssuer is the OIDC issuer URL for the cluster (used for IRSA).
`status`	string	—	Status is the cluster status: CREATING, ACTIVE, DELETING, FAILED, UPDATING.
`version`	string	—	Version is the current Kubernetes version of the cluster.

EKSFargateProfile # GA

EKSFargateProfile is the Schema for managing EKS Fargate Profiles.

kubectl get eksfargateprofiles · example on GitHub

Example

# EKSFargateProfile — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#eksfargateprofile
apiVersion: aws.konfig.io/v1alpha1
kind: EKSFargateProfile
metadata:
  name: example-eksfargateprofile
  namespace: default
spec:
  clusterName: example-eksfargateprofile
  clusterRef:
    clusterName: example-eksfargateprofile
    name: example-eksfargateprofile
  fargateProfileName: example-eksfargateprofile
  podExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
  podExecutionRoleRef:
    name: example-podexecutionrole
  providerRef:
    name: example-eksfargateprofile
    region: us-east-1
  selectors:
  - labels:
      key: value
    namespace: example
  subnetRefs:
  - name: example-subnetrefs
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`clusterName`	string	—	ClusterName is the EKS cluster name.
`clusterRef`	object	—	ClusterRef references an EKSCluster CR in the same namespace.
`clusterRef.clusterName`	string	—	ClusterName is a direct AWS EKS cluster name, bypassing CR lookup.
`clusterRef.name`	string	—	Name of an EKSCluster CR in the same namespace.
`fargateProfileName`	string	yes	FargateProfileName is the name of the Fargate profile.
`podExecutionRoleArn`	string	—	PodExecutionRoleArn is the IAM role ARN for Fargate pod execution.
`podExecutionRoleRef`	object	—	PodExecutionRoleRef references an IAMRole CR in the same namespace.
`podExecutionRoleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`podExecutionRoleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`podExecutionRoleRef.namespace`	string	—	Namespace of the IAMRole CR.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`selectors`	array<object>	yes	Selectors define which pods are scheduled on Fargate.
`selectors[].labels`	map<string>	—	Labels are the Kubernetes pod labels to match.
`selectors[].namespace`	string	yes	Namespace is the Kubernetes namespace to match.
`subnetRefs`	array<object>	—	SubnetRefs are the private subnets to run Fargate pods in.
`subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`fargateProfileArn`	string	—	FargateProfileArn is the ARN of the Fargate profile.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the profile status: CREATING, ACTIVE, DELETING, CREATE_FAILED, DELETE_FAILED.

EKSIdentityProviderConfig # GA

EKSIdentityProviderConfig is the Schema for managing EKS OIDC identity provider configurations.

kubectl get eksidentityproviderconfigs · example on GitHub

Example

# EKSIdentityProviderConfig — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#eksidentityproviderconfig
apiVersion: aws.konfig.io/v1alpha1
kind: EKSIdentityProviderConfig
metadata:
  name: example-eksidentityproviderconfig
  namespace: default
spec:
  clusterName: example-eksidentityproviderconfig
  identityProviderConfigName: example-eksidentityproviderconfig
  oidc:
    clientId: example-id
    groupsClaim: example
    groupsPrefix: example
    issuerUrl: example
    requiredClaims:
      key: value
    usernameClaim: example
    usernamePrefix: example
  providerRef:
    name: example-eksidentityproviderconfig
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`clusterName`	string	yes	ClusterName is the name of the EKS cluster.
`identityProviderConfigName`	string	yes	IdentityProviderConfigName is the name of the identity provider configuration.
`oidc`	object	yes	OIDC is the OIDC identity provider configuration.
`oidc.clientId`	string	yes	ClientID is the OIDC client application ID.
`oidc.groupsClaim`	string	—	GroupsClaim is the JWT claim to use for group membership.
`oidc.groupsPrefix`	string	—	GroupsPrefix is a prefix to prepend to group names.
`oidc.issuerUrl`	string	yes	IssuerURL is the OIDC provider URL.
`oidc.requiredClaims`	map<string>	—	RequiredClaims are key-value pairs that must be present in the token.
`oidc.usernameClaim`	string	—	UsernameClaim is the JWT claim to use as the username.
`oidc.usernamePrefix`	string	—	UsernamePrefix is a prefix to prepend to usernames.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the identity provider configuration.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the current state of the configuration.

EKSNodeGroup # GA

EKSNodeGroup is the Schema for managing EKS Managed Node Groups.

kubectl get eksnodegroups · example on GitHub

Example

# EKSNodeGroup — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#eksnodegroup
apiVersion: aws.konfig.io/v1alpha1
kind: EKSNodeGroup
metadata:
  name: example-eksnodegroup
  namespace: default
spec:
  amiType: AL2_x86_64
  capacityType: ON_DEMAND
  clusterName: example-eksnodegroup
  clusterRef:
    clusterName: example-eksnodegroup
    name: example-eksnodegroup
  diskSize: 2
  instanceTypes:
  - example
  labels:
    key: value
  launchTemplate:
    name: example-eksnodegroup
    version: '1.0'
  nodeRepairConfig:
    enabled: true
  nodeRoleArn: arn:aws:iam::123456789012:role/example-role
  nodeRoleRef:
    name: example-noderole
  nodegroupName: example-eksnodegroup
  providerRef:
    name: example-eksnodegroup
    region: us-east-1
  releaseVersion: '1.0'
  remoteAccess:
    ec2SshKey: example
    sourceSecurityGroupRefs:
    - name: example-sourcesecuritygrouprefs
  scalingConfig:
    desiredSize: 1
    maxSize: 1
    minSize: 1
  subnetRefs:
  - name: example-subnetrefs
  tags:
    environment: dev
    team: platform
  taints:
  - effect: NO_SCHEDULE
    key: example
    value: example
  updateConfig:
    maxUnavailable: 1
    maxUnavailablePercentage: 1
  version: '1.0'

Spec

Field	Type	Required	Description
`amiType`	enum	—	AmiType is the AMI type for nodes. Allowed: `AL2_x86_64, AL2_x86_64_GPU, AL2_ARM_64, AL2023_x86_64_STANDARD, AL2023_ARM_64_STANDARD, BOTTLEROCKET_x86_64, BOTTLEROCKET_ARM_64, CUSTOM`
`capacityType`	enum	—	CapacityType is the capacity type: ON_DEMAND or SPOT. Allowed: `ON_DEMAND, SPOT`
`clusterName`	string	—	ClusterName is the EKS cluster name.
`clusterRef`	object	—	ClusterRef references an EKSCluster CR in the same namespace.
`clusterRef.clusterName`	string	—	ClusterName is a direct AWS EKS cluster name, bypassing CR lookup.
`clusterRef.name`	string	—	Name of an EKSCluster CR in the same namespace.
`diskSize`	integer	—	DiskSize is the root EBS volume size in GiB.
`instanceTypes`	array<string>	—	InstanceTypes is the list of EC2 instance types.
`labels`	map<string>	—	Labels are Kubernetes labels applied to nodes.
`launchTemplate`	object	—	LaunchTemplate is an optional custom launch template.
`launchTemplate.id`	string	—	ID is a direct AWS Launch Template ID.
`launchTemplate.name`	string	—	Name is a LaunchTemplate CR name in the same namespace.
`launchTemplate.version`	string	—	Version is the launch template version.
`nodeRepairConfig`	object	—	NodeRepairConfig configures automatic node repair.
`nodeRepairConfig.enabled`	boolean	yes	Enabled enables automatic node repair.
`nodeRoleArn`	string	—	NodeRoleArn is the IAM role ARN for the node instances.
`nodeRoleRef`	object	—	NodeRoleRef references an IAMRole CR in the same namespace.
`nodeRoleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`nodeRoleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`nodeRoleRef.namespace`	string	—	Namespace of the IAMRole CR.
`nodegroupName`	string	yes	NodegroupName is the name of the node group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`releaseVersion`	string	—	ReleaseVersion is the AMI release version.
`remoteAccess`	object	—	RemoteAccess configures SSH access to nodes.
`remoteAccess.ec2SshKey`	string	—	EC2SshKey is the name of the EC2 key pair for SSH access.
`remoteAccess.sourceSecurityGroupRefs`	array<object>	—	SourceSecurityGroupRefs restricts SSH access to these security groups.
`remoteAccess.sourceSecurityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`remoteAccess.sourceSecurityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`scalingConfig`	object	yes	ScalingConfig defines the min/max/desired node counts.
`scalingConfig.desiredSize`	integer	yes	DesiredSize is the desired number of nodes.
`scalingConfig.maxSize`	integer	yes	MaxSize is the maximum number of nodes.
`scalingConfig.minSize`	integer	yes	MinSize is the minimum number of nodes.
`subnetRefs`	array<object>	yes	SubnetRefs are the subnets to launch nodes in.
`subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags.
`taints`	array<object>	—	Taints are Kubernetes taints applied to nodes.
`taints[].effect`	enum	yes	Effect specifies the taint effect. Allowed: `NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE`
`taints[].key`	string	yes	Key is the taint key.
`taints[].value`	string	—	Value is the taint value.
`updateConfig`	object	—	UpdateConfig defines rolling update behavior.
`updateConfig.maxUnavailable`	integer	—	MaxUnavailable is the maximum number of nodes unavailable during an update.
`updateConfig.maxUnavailablePercentage`	integer	—	MaxUnavailablePercentage is the maximum percentage of nodes unavailable during an update.
`version`	string	—	Version is the Kubernetes version for the node group.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`nodegroupArn`	string	—	NodegroupArn is the ARN of the node group.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the node group status: CREATING, ACTIVE, UPDATING, DELETING, DEGRADED.

PodIdentityAssociation # GA

PodIdentityAssociation links a Kubernetes ServiceAccount to an AWS IAM Role via EKS Pod Identity.

kubectl get podidentityassociations · example on GitHub

Example

# PodIdentityAssociation — EKS
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/eks.html#podidentityassociation
apiVersion: aws.konfig.io/v1alpha1
kind: PodIdentityAssociation
metadata:
  name: example-podidentityassociation
  namespace: default
spec:
  annotateServiceAccount: false
  clusterName: example-podidentityassociation
  providerRef:
    name: example-podidentityassociation
    region: us-east-1
  roleRef:
    name: example-role
  serviceAccountName: example-podidentityassociation
  tags:
    environment: dev
    team: platform
  targetNamespace: example

Spec

Field	Type	Required	Description
`annotateServiceAccount`	boolean	—	AnnotateServiceAccount controls whether the operator also writes the eks.amazonaws.com/role-arn annotation on the target ServiceAccount (for IRSA compatibility).
`clusterName`	string	yes	ClusterName is the name of the EKS cluster.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleRef`	object	yes	RoleRef references the IAMRole CR or a direct ARN to bind to the ServiceAccount.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.
`serviceAccountName`	string	yes	ServiceAccountName is the name of the Kubernetes ServiceAccount to bind.
`tags`	map<string>	—	Tags are AWS resource tags applied to the association.
`targetNamespace`	string	yes	Namespace is the Kubernetes namespace of the target ServiceAccount.

Status

Field	Type	Required	Description
`associationArn`	string	—	AssociationARN is the ARN of the EKS Pod Identity association.
`associationId`	string	—	AssociationID is the EKS Pod Identity association identifier.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`roleArn`	string	—	RoleARN is the resolved IAM role ARN.