• Please put TEAM name to be your name.

• Download ee-default-keypair to your PC (just in case, copy key material to notepad as well).

• Copy credentials (export AWS_DEFAULT_REGION=..)
• Click "Open AWS Console".

Usually in eksworkshop or normal immersionday offered by AWS, we guide customer to experience Cloud9 (AWS IDE environment). But in this workshop, plan is to provide a general environment with your own Bastion Host EC2, where you have to install kubectl tools and other tools as needed.

(General)

• We can use EC2 Instance Connect to login to EC2 instance.
• EC2->Instances->"connect" (right top corner of screen).
• click "connect"

(MAC user) Log in from your laptop

• Let's use key pair we downloaded to access to the instance.

chmod 600 ee-default-keypair.pem
ssh-add ee-default-keypair.pem
ssh -A [email protected]

• Copy AWS credentials (AWS_DEFAULT_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)

export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=ASIA..
export AWS_SECRET_ACCESS_KEY=4wyDA..
export AWS_SESSION_TOKEN=IQo...

• Try whether AWS confidential is already configured well

aws sts get-caller-identity
{
  "Account": "400166681888", 
  "UserId": "AROAV2K6K7UQPEU2EMBY3:MasterKey", 
  "Arn": "arn:aws:sts::400166681888:assumed-role/TeamRole/MasterKey"
}

(Window user) Log in from your laptop

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html

Download kubectl.

curl -o kubectl https://amazon-eks.s3.us-west-2.amazonaws.com/1.19.6/2021-01-05/bin/linux/amd64/kubectl
curl -o kubectl.sha256 https://amazon-eks.s3.us-west-2.amazonaws.com/1.19.6/2021-01-05/bin/linux/``amd64``/kubectl.sha256
openssl sha1 -sha256 kubectl
chmod +x ./kubectl
mkdir -p $HOME/bin && cp ./kubectl $HOME/bin/kubectl && export PATH=$PATH:$HOME/bin
echo 'export PATH=$PATH:$HOME/bin' >> ~/.bashrc
kubectl version —short —client

Check your name of EKS cluster (from CloudFormation output or EKS console (service search -> EKS))

Config kubeconfig with EKS CLI

aws eks update-kubeconfig --name=eks-my-first-stack

Verify kubectl command

kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   <none>        443/TCP   31m

Verify it from AWS CLI

aws eks describe-cluster --name eks-my-first-stack

Go to S3 and create bucket (folder/directory) with Create bucket.

Bucket name to be unique like young-jung-immersion, and then Create bucket.

Click the bucket you just created and drag & drop lambda_function.zip file (which you can find from /template directory of this GitHub). Then, click Upload.

Please memorize bucket name you create (this is required in CloudFormation)

Go to CloudFormation console by selecting CloudFormation from Services drop down or by search menu.

• Select Create stack, with new resources(standard).
• Click *Template is ready" (default), "Upload a template file", "Choose file". Select "amazon-eks-nodegroup-multus.yaml" file that you have downloaded from this GitHub.
• Stack name -> ng1
• ClusterName -> eks-immersion (your own name)
• ClusterControlPlaneSecurityGroup -> "immersion-EksControlSecurityGroup-xxxx"
• NodeGroupName -> ng1
• Min/Desired/MaxSize -> 1/1/1
• KeyName -> ee-default-keypair
• VpcId -> vpc-immersion (that you created)
• Subnets -> privateAz1-immersion (this is for main primary K8s networking network)
• MultusSubnets -> multus1Az1 and Multus2Az1
• MultusSecurityGroups -> immersion-MultusSecurityGroup
• LambdaS3Bucket -> the one you created (young-jung-immersion)
• LambdaS3Key -> lambda_function.zip
• Next, check "I acknowledge...", and then Next.

Once CloudFormation stack creation is completed, check Output part in the menu and copy the value of NodeInstanceRole (e.g. arn:aws:iam::153318889914:role/ng1-NodeInstanceRole-1C77OUUUP6686)

Go to the Bastion Host where we can run kubectl command.

Download aws-auth-cm file at Bastion Host.

curl -o aws-auth-cm.yaml https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/aws-auth-cm.yaml

Open aws-auth-cm.yaml file downloaded using vi or any text editor. And place above copied NodeInstanceRole value to the place of "<ARN of instance role (not instance profile)>", and then apply this through kubectl.

kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::153318889914:role/ng1-NodeInstanceRole-1C77OUUUP6686
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes

kubectl -f apply aws-auth-cm.yaml