Amazon VPC CNI plugin for Kubernetes: aws-node

Amazon VPC CNI plugin for Kubernetes

• https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html

• ipamd (aws-node) Daemonset

• Obtain version:kubectl describe daemonset aws-node --namespace kube-system | grep amazon-k8s-cni: | cut -d : -f 3
• aws eks describe-addon --cluster-name my-cluster --addon-name vpc-cni --query addon.addonVersion --output text

Containers:

• aws-node
• aws-eks-nodeagent
• aws-vpc-cni-init

kubectl get pods -n kube-system | grep aws-node
aws-node-7wqrv                         2/2     Running                0                72d
aws-node-rfld6                         2/2     Running                0                26h
aws-node-w75dq                         0/2     Init:0/1               0                26h

kubectl logs -n kube-system aws-node
  kubectl logs -n kube-system aws-node-123 -c aws-node
  kubectl logs -n kube-system aws-node-123 -c aws-eks-nodeagent
  kubectl logs -n kube-system aws-node-123 -c aws-vpc-cni-init

Errors

FailedSync (507)3.8 mins ago	error determining status: rpc error: code = Unknown desc = Error: No such container: 91234567XXXXXXX

aws-node-w75dq                         0/2     Init:0/1               0                26h

Error from server (BadRequest): container "aws-node" in pod "aws-node-12345" is waiting to start: CreateContainerError

kube-system           aws-node-kjz6s                                             0/2     ImageInspectError   1               105m    10.111.111.111     ip-10-111-111-111.eu-west-3.compute.internal   <none>           <none>

Events

• Liveness probe errored
• Error: context deadline exceeded

Related

• kube-system
• kubectl get daemonset
• kubectl get serviceaccounts
• kubectl get pods -n kube-system
• kubectl set env daemonset -n kube-system
• sts:AssumeRoleWithWebIdentity
• eksctl create iamserviceaccount
• kubectl -n kube-system edit daemonset/aws-node
• Amazon VPC-CNI: cluster addons
• kubectl events: Failed, FailedSync, Unhealthy, Killing

See also

• aws-node, ipamd, kubectl logs -n kube-system aws-node, aws-vpc-cni-init, aws-node, aws-eks-nodeagent
• AWS VPC CNI, aws-node (ipamd): (aws-node, aws-eks-nodeagent, aws-vpc-cni-init), cluster_addons: vpc-cni, aws-network-policy-agent: aws-eks-na-cli, AmazonEKS_CNI_Policy, AmazonEKS_CNI_Policy
• kube-system: kubectl get pods -n kube-system, kube-dns, aws-node
• Kubernetes networking: Container Network Interface (CNI), VPC CNI, Multus CNI, Calico, Flannel

https://aws.github.io/aws-eks-best-practices/networking/vpc-cni/#understand-security-context