CreateCluster

Creates an Amazon EKS control plane.

The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as etcd and the API server. The control plane runs in an account managed by AWS, and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single tenant and unique. It runs on its own set of Amazon EC2 instances.

The cluster control plane is provisioned across multiple Availability Zones and fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support kubectl exec, logs, and proxy data flows).

Amazon EKS nodes run in your AWS account and connect to your cluster's control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster.

You can use the endpointPublicAccess and endpointPrivateAccess parameters to enable or disable public and private access to your cluster's Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. For more information, see Amazon EKS Cluster Endpoint Access Control in the Amazon EKS User Guide .

You can use the logging parameter to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS Cluster Control Plane Logs in the Amazon EKS User Guide .

In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see Allowing users to access your cluster and Launching Amazon EKS nodes in the Amazon EKS User Guide.

Request Syntax

POST /clusters HTTP/1.1
Content-type: application/json

{
   "accessConfig": { 
      "authenticationMode": "string",
      "bootstrapClusterCreatorAdminPermissions": boolean
   },
   "bootstrapSelfManagedAddons": boolean,
   "clientRequestToken": "string",
   "encryptionConfig": [ 
      { 
         "provider": { 
            "keyArn": "string"
         },
         "resources": [ "string" ]
      }
   ],
   "kubernetesNetworkConfig": { 
      "ipFamily": "string",
      "serviceIpv4Cidr": "string"
   },
   "logging": { 
      "clusterLogging": [ 
         { 
            "enabled": boolean,
            "types": [ "string" ]
         }
      ]
   },
   "name": "string",
   "outpostConfig": { 
      "controlPlaneInstanceType": "string",
      "controlPlanePlacement": { 
         "groupName": "string"
      },
      "outpostArns": [ "string" ]
   },
   "resourcesVpcConfig": { 
      "endpointPrivateAccess": boolean,
      "endpointPublicAccess": boolean,
      "publicAccessCidrs": [ "string" ],
      "securityGroupIds": [ "string" ],
      "subnetIds": [ "string" ]
   },
   "roleArn": "string",
   "tags": { 
      "string" : "string" 
   },
   "upgradePolicy": { 
      "supportType": "string"
   },
   "version": "string",
   "zonalShiftConfig": { 
      "enabled": boolean
   }
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

Response Syntax

HTTP/1.1 200
Content-type: application/json

{
   "cluster": { 
      "accessConfig": { 
         "authenticationMode": "string",
         "bootstrapClusterCreatorAdminPermissions": boolean
      },
      "arn": "string",
      "certificateAuthority": { 
         "data": "string"
      },
      "clientRequestToken": "string",
      "connectorConfig": { 
         "activationCode": "string",
         "activationExpiry": number,
         "activationId": "string",
         "provider": "string",
         "roleArn": "string"
      },
      "createdAt": number,
      "encryptionConfig": [ 
         { 
            "provider": { 
               "keyArn": "string"
            },
            "resources": [ "string" ]
         }
      ],
      "endpoint": "string",
      "health": { 
         "issues": [ 
            { 
               "code": "string",
               "message": "string",
               "resourceIds": [ "string" ]
            }
         ]
      },
      "id": "string",
      "identity": { 
         "oidc": { 
            "issuer": "string"
         }
      },
      "kubernetesNetworkConfig": { 
         "ipFamily": "string",
         "serviceIpv4Cidr": "string",
         "serviceIpv6Cidr": "string"
      },
      "logging": { 
         "clusterLogging": [ 
            { 
               "enabled": boolean,
               "types": [ "string" ]
            }
         ]
      },
      "name": "string",
      "outpostConfig": { 
         "controlPlaneInstanceType": "string",
         "controlPlanePlacement": { 
            "groupName": "string"
         },
         "outpostArns": [ "string" ]
      },
      "platformVersion": "string",
      "resourcesVpcConfig": { 
         "clusterSecurityGroupId": "string",
         "endpointPrivateAccess": boolean,
         "endpointPublicAccess": boolean,
         "publicAccessCidrs": [ "string" ],
         "securityGroupIds": [ "string" ],
         "subnetIds": [ "string" ],
         "vpcId": "string"
      },
      "roleArn": "string",
      "status": "string",
      "tags": { 
         "string" : "string" 
      },
      "upgradePolicy": { 
         "supportType": "string"
      },
      "version": "string",
      "zonalShiftConfig": { 
         "enabled": boolean
      }
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

Errors

For information about the errors that are common to all actions, see Common Errors.

Examples

In the following example or examples, the Authorization header contents (AUTHPARAMS) must be replaced with an AWS Signature Version 4 signature. For more information about creating these signatures, see Signature Version 4 Signing Process in the Amazon EKS General Reference.

You need to learn how to sign HTTP requests only if you intend to manually create them. When you use the AWS Command Line Interface (AWS CLI) or one of the AWS SDKs to make requests to AWS, these tools automatically sign the requests for you with the access key that you specify when you configure the tools. When you use these tools, you don't need to learn how to sign requests yourself.

Example

The following example creates an Amazon EKS cluster named my-cluster with endpoint public and private access enabled.

Sample Request

POST /clusters HTTP/1.1
Host: eks.us-west-2.amazonaws.com
Accept-Encoding: identity
User-Agent: aws-cli/1.16.120 Python/3.7.0 Darwin/18.2.0 botocore/1.12.110
X-Amz-Date: 20190322T160158Z
Authorization: AUTHPARAMS
Content-Length: 368

{
    "name": "my-cluster",
    "roleArn": "arn:aws:iam::012345678910:role/eksClusterRole",
    "resourcesVpcConfig": {
        "subnetIds": [
            "subnet-xxxxxxxxxxxxxxxxx",
            "subnet-yyyyyyyyyyyyyyyyy",
            "subnet-zzzzzzzzzzzzzzzzz"
        ],
        "securityGroupIds": [
            "sg-xxxxxxxxxxxxxxxxx"
        ],
        "endpointPublicAccess": true,
        "endpointPrivateAccess": true
    },
    "clientRequestToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

Sample Response

HTTP/1.1 200 OK
Date: Fri, 22 Mar 2019 16:01:58 GMT
Content-Type: application/json
Content-Length: 682
x-amzn-RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
x-amz-apigw-id: W84GUEIbPHcFW2Q=
X-Amzn-Trace-Id: Root=1-xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive

{
  "cluster": {
    "name": "my-cluster",
    "arn": "arn:aws:eks:us-west-2:012345678910:cluster/my-cluster",
    "createdAt": 1573484658.211,
    "version": "1.14",
    "roleArn": "arn:aws:iam::012345678910:role/eksClusterRole",
    "resourcesVpcConfig": {
      "subnetIds": [
        "subnet-xxxxxxxxxxxxxxxxx",
        "subnet-yyyyyyyyyyyyyyyyy",
        "subnet-zzzzzzzzzzzzzzzzz"
      ],
      "securityGroupIds": [],
      "vpcId": "vpc-xxxxxxxxxxxxxxxxx",
      "endpointPublicAccess": true,
      "endpointPrivateAccess": false
    },
    "logging": {
      "clusterLogging": [
        {
          "types": [
            "api",
            "audit",
            "authenticator",
            "controllerManager",
            "scheduler"
          ],
          "enabled": false
        }
      ]
    },
    "status": "CREATING",
    "certificateAuthority": {},
    "platformVersion": "eks.3",
    "tags": {}
  }
}

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: