Ready-to-use eksctl cluster configs, Kubernetes manifests, and Helm-based stacks for
learning and experimenting with Amazon EKS. Each sample is
self-contained, with its own README covering prerequisites, steps, and cleanup.
Browse the samples on the project site: https://aws-samples.github.io/aws-eks-samples/
Warning
These samples are for testing and learning only. Do not use them in production as is. Always follow the Amazon EKS security best practices.
Cluster configuration files for creating and managing EKS clusters with eksctl.
| Sample | Description |
|---|---|
| Get started | Basic cluster with one managed and one self-managed node group |
| EKS Auto Mode | Cluster with EKS Auto Mode managing node provisioning, patching, and scaling |
| Reuse an existing IAM role | Managed and unmanaged node groups that attach to a pre-existing IAM role |
| Ubuntu node groups | Self-managed and managed node groups running Ubuntu |
| EKS with Fargate | Cluster with a Fargate profile for serverless pods |
Manifests for EKS workloads across storage, networking, security, observability, and disaster recovery.
| Sample | Description |
|---|---|
| Backup and restore an EBS PVC | Snapshot a PVC, restore it to a new PVC, and resize the restored volume |
| Cross-account disaster recovery | Restore an EBS snapshot into a cluster in another AWS account, including KMS-encrypted volumes |
| Proxy Protocol on a Classic Load Balancer | Preserve client IP addresses through a CLB in front of NGINX Ingress |
| Fargate logging to OpenSearch | Ship Fargate pod logs to Amazon OpenSearch Service with Fluent Bit |
| AWS SDK for Python with IRSA | Call AWS APIs from a pod using IAM roles for service accounts |
| NFS CSI driver with Amazon EFS | Dynamic EFS provisioning by subdirectory, without the EFS access point limit |
| Snapshot, restore, and resize StatefulSet PVCs | Back a Cassandra StatefulSet up to EBS snapshots, restore it, and resize its volumes |
| Topology Aware Routing | Keep Service traffic in the same Availability Zone to cut cross-AZ cost and latency |
| Troubleshoot intermittent network issues | tcpdump DaemonSet that streams node packet captures to Amazon S3 |
| Network policies | Default-deny and allow-all NetworkPolicy building blocks for the Amazon VPC CNI |
| vLLM on Graviton5 | Serve an LLM on Arm64 CPUs with EKS Auto Mode and a Karpenter NodePool |
Stacks installed from community Helm charts with tuned values.yaml files.
| Sample | Description |
|---|---|
| Karpenter observability on EKS Auto Mode | Prometheus and Grafana with a 35-panel Karpenter Impact dashboard |
You need an AWS account and the tools your chosen sample lists, usually some of: AWS CLI, kubectl, eksctl, and Helm.
git clone https://github.com/aws-samples/aws-eks-samples.git
cd aws-eks-samples
# Create an EKS Auto Mode cluster (us-west-2 by default; edit the file to change it)
eksctl create cluster -f examples/eksctl/how-to-eks-auto-mode/eks-auto.yaml
# Then pick a sample and follow its README
ls examples/kubernetes/Samples create billable AWS resources. Run each sample's cleanup steps when you're done.
examples/
├── eksctl/ # eksctl ClusterConfig files
├── kubernetes/ # Kubernetes manifests
└── helm/ # Helm-based stacks
docs/ # Static GitHub Pages site (served as is, no Jekyll build)
knowledge-center/ # Copy of the StatefulSet snapshot sample, kept for an AWS Knowledge Center article
knowledge-center/how-to-snapshot-restore-resize-sts is an exact copy of
examples/kubernetes/how-to-snapshot-restore-resize-sts.
It stays at this path because the AWS Knowledge Center article
EKS persistent storage snapshot
links to it. Change both copies together.
| Workflow | What it does |
|---|---|
| Checkov | Scans the manifests in examples/kubernetes with Checkov and uploads the results to GitHub code scanning |
| Knowledge Center | Runs the same Checkov scan on knowledge-center/ |
| CodeQL | GitHub default code scanning setup |
| pages-build-deployment | Publishes docs/ to GitHub Pages |
Checkov checks skipped in this project, and why
The samples favor easy experimentation over production hardening, so these checks are skipped. Apply them in your own clusters.
| Check | Description | Reason |
|---|---|---|
| CKV2_K8S_6 | Minimize the admission of pods that lack an associated NetworkPolicy | Pod-to-pod traffic is allowed by default to keep samples simple. The Amazon VPC CNI supports Kubernetes network policies, and the network policies sample shows how to use them. |
| CKV_K8S_8 | Liveness probe should be configured | Samples omit health checks. Configure liveness probes in production. |
| CKV_K8S_9 | Readiness probe should be configured | Samples omit health checks. Configure readiness probes in production. |
| CKV_K8S_14 | Image tag should be fixed, not latest or blank |
Some samples pull the latest public images so they run current versions. See the Kubernetes security checklist for images. |
| CKV_K8S_21 | The default namespace should not be used | Short-lived samples use the default namespace and should be deleted after testing. Use dedicated namespaces in production. |
| CKV_K8S_22 | Use a read-only root filesystem where possible | The Cassandra sample needs a writable filesystem. See configure images with a read-only root filesystem. |
| CKV_K8S_23 | Minimize the admission of root containers | Samples use public images with their default user ID. Set a non-root USER in your own images. |
| CKV_K8S_25 | Minimize the admission of containers with added capabilities | The Cassandra sample adds IPC_LOCK. See container capabilities. |
| CKV_K8S_28 | Minimize the admission of containers with the NET_RAW capability |
Some workloads, such as NGINX and Cassandra, don't drop all capabilities. Enforce this in production with Pod Security Admission. |
| CKV_K8S_35 | Prefer secrets as files over secrets as environment variables | The vLLM sample passes its API key as an environment variable for simplicity. In production, mount secrets from AWS Secrets Manager and Parameter Store as files. |
| CKV_K8S_37 | Minimize the admission of containers with assigned capabilities | Some workloads keep default or added capabilities. Grant only the Linux capabilities a process needs. |
| CKV_K8S_40 | Containers should run as a high UID to avoid host conflict | Samples use public images with their default user ID. Set runAsUser in production. |
| CKV_K8S_43 | Image should use a digest | Some samples pull the latest public images. In production, consider pinning images by digest. |
Issues and pull requests are welcome. See CONTRIBUTING.
When you add, rename, or remove a sample, update the project site in docs/ and the
samples tables in this README in the same pull request.
.kiro/steering/creating-samples.md has the checklist
and a script that checks the counts.
See CONTRIBUTING for how to report a security issue.
This library is licensed under the MIT-0 License. See the LICENSE file.