CreateCluster
Creates an Amazon EKS control plane.
The Amazon EKS control plane consists of control plane instances that run the Kubernetes
software, such as etcd
and the API server. The control plane runs in an
account managed by AWS, and the Kubernetes API is exposed via the Amazon EKS API server
endpoint. Each Amazon EKS cluster control plane is single-tenant and unique and runs
on its
own set of Amazon EC2 instances.
The cluster control plane is provisioned across multiple Availability Zones and
fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions
elastic network interfaces in your VPC
subnets to provide connectivity from the control plane instances to the worker nodes
(for example, to support kubectl exec
, logs
, and
proxy
data flows).
Amazon EKS worker nodes run in your AWS account and connect to your cluster's control plane via the Kubernetes API server endpoint and a certificate file that is created for your cluster.
You can use the endpointPublicAccess
and
endpointPrivateAccess
parameters to enable or disable public and
private access to your cluster's Kubernetes API server endpoint. By default, public
access is enabled, and private access is disabled. For more information, see Amazon EKS Cluster
Endpoint Access Control in the
Amazon EKS User Guide
.
You can use the logging
parameter to enable or disable exporting the
Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster
control
plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS
Cluster Control Plane Logs in the
Amazon EKS User Guide
.
Note
CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see Amazon CloudWatch Pricing.
Cluster creation typically takes between 10 and 15 minutes. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch worker nodes into your cluster. For more information, see Managing Cluster Authentication and Launching Amazon EKS Worker Nodes in the Amazon EKS User Guide.
Request Syntax
POST /clusters HTTP/1.1 Content-type: application/json { "clientRequestToken": "
string
", "logging": { "clusterLogging": [ { "enabled":boolean
, "types": [ "string
" ] } ] }, "name": "string
", "resourcesVpcConfig": { "endpointPrivateAccess":boolean
, "endpointPublicAccess":boolean
, "securityGroupIds": [ "string
" ], "subnetIds": [ "string
" ] }, "roleArn": "string
", "tags": { "string
" : "string
" }, "version": "string
" }
URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
- clientRequestToken
-
Unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
Type: String
Required: No
- logging
-
Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS Cluster Control Plane Logs in the Amazon EKS User Guide .
Note
CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see Amazon CloudWatch Pricing.
Type: Logging object
Required: No
- name
-
The unique name to give to your cluster.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 100.
Pattern:
^[0-9A-Za-z][A-Za-z0-9\-_]*
Required: Yes
- resourcesVpcConfig
-
The VPC configuration used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. You must specify at least two subnets. You can specify up to five security groups, but we recommend that you use a dedicated security group for your cluster control plane.
Type: VpcConfigRequest object
Required: Yes
- roleArn
-
The Amazon Resource Name (ARN) of the IAM role that provides permissions for Amazon EKS to make calls to other AWS API operations on your behalf. For more information, see Amazon EKS Service IAM Role in the Amazon EKS User Guide .
Type: String
Required: Yes
- tags
-
The metadata to apply to the cluster to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define.
Type: String to string map
Key Length Constraints: Minimum length of 1. Maximum length of 128.
Value Length Constraints: Maximum length of 256.
Required: No
- version
-
The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.
Type: String
Required: No
Response Syntax
HTTP/1.1 200 Content-type: application/json { "cluster": { "arn": "string", "certificateAuthority": { "data": "string" }, "clientRequestToken": "string", "createdAt": number, "endpoint": "string", "identity": { "oidc": { "issuer": "string" } }, "logging": { "clusterLogging": [ { "enabled": boolean, "types": [ "string" ] } ] }, "name": "string", "platformVersion": "string", "resourcesVpcConfig": { "clusterSecurityGroupId": "string", "endpointPrivateAccess": boolean, "endpointPublicAccess": boolean, "securityGroupIds": [ "string" ], "subnetIds": [ "string" ], "vpcId": "string" }, "roleArn": "string", "status": "string", "tags": { "string" : "string" }, "version": "string" } }
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
Errors
For information about the errors that are common to all actions, see Common Errors.
- ClientException
-
These errors are usually caused by a client action. Actions can include using an action or resource on behalf of a user that doesn't have permissions to use the action or resource or specifying an identifier that is not valid.
HTTP Status Code: 400
- InvalidParameterException
-
The specified parameter is invalid. Review the available parameters for the API request.
HTTP Status Code: 400
- ResourceInUseException
-
The specified resource is in use.
HTTP Status Code: 409
- ResourceLimitExceededException
-
You have encountered a service limit on the specified resource.
HTTP Status Code: 400
- ServerException
-
These errors are usually caused by a server-side issue.
HTTP Status Code: 500
- ServiceUnavailableException
-
The service is unavailable. Back off and retry the operation.
HTTP Status Code: 503
- UnsupportedAvailabilityZoneException
-
At least one of your specified cluster subnets is in an Availability Zone that does not support Amazon EKS. The exception output specifies the supported Availability Zones for your account, from which you can choose subnets for your cluster.
HTTP Status Code: 400
Example
In the following example or examples, the Authorization header contents
(AUTHPARAMS
) must be replaced with an AWS Signature Version 4
signature. For more information about creating these signatures, see Signature
Version 4 Signing Process in the AWS General
Reference.
You need to learn how to sign HTTP requests only if you intend to manually create them. When you use the AWS Command Line Interface (AWS CLI) or one of the AWS SDKs to make requests to AWS, these tools automatically sign the requests for you with the access key that you specify when you configure the tools. When you use these tools, you don't need to learn how to sign requests yourself.
Example
The following example creates an Amazon EKS cluster called prod
with endpoint public and private access enabled.
Sample Request
POST /clusters HTTP/1.1 Host: eks.us-west-2.amazonaws.com Accept-Encoding: identity User-Agent: aws-cli/1.16.120 Python/3.7.0 Darwin/18.2.0 botocore/1.12.110 X-Amz-Date: 20190322T160158Z Authorization: AUTHPARAMS Content-Length: 368 { "name": "prod", "roleArn": "arn:aws:iam::012345678910:role/EksServiceRole", "resourcesVpcConfig": { "subnetIds": [ "subnet-077bc97efd5dae4f9", "subnet-0d6dc303cd69de702", "subnet-0b48c05c4cd1500cb" ], "securityGroupIds": [ "sg-089666e5ca892599f" ], "endpointPublicAccess": true, "endpointPrivateAccess": true }, "clientRequestToken": "644136db-8cb9-4183-b59f-11d615f979e9" }
Sample Response
HTTP/1.1 200 OK Date: Fri, 22 Mar 2019 16:01:58 GMT Content-Type: application/json Content-Length: 682 x-amzn-RequestId: d1b8b8d8-4cbb-11e9-b348-0398c7ea9718 x-amz-apigw-id: W84GUEIbPHcFW2Q= X-Amzn-Trace-Id: Root=1-5c9506f5-d1e3152f7fbec44a4c3b6dde Connection: keep-alive { "cluster": { "name": "prod", "arn": "arn:aws:eks:us-west-2:012345678910:cluster/prod", "createdAt": 1573484658.211, "version": "1.14", "roleArn": "arn:aws:iam::012345678910:role/EksServiceRole", "resourcesVpcConfig": { "subnetIds": [ "subnet-04751110b066869aa", "subnet-00d64f80bf7da767c", "subnet-0c1843cbc9803368c" ], "securityGroupIds": [], "vpcId": "vpc-0918e75e123a169b6", "endpointPublicAccess": true, "endpointPrivateAccess": false }, "logging": { "clusterLogging": [ { "types": [ "api", "audit", "authenticator", "controllerManager", "scheduler" ], "enabled": false } ] }, "status": "CREATING", "certificateAuthority": {}, "platformVersion": "eks.3", "tags": {} } }
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following: