AWS Tools for Windows PowerShell
Command Reference

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

Synopsis

Calls the Amazon Elastic Container Service for Kubernetes CreateCluster API operation.

Syntax

New-EKSCluster
-Name <String>
-AccessConfig_AuthenticationMode <AuthenticationMode>
-AccessConfig_BootstrapClusterCreatorAdminPermission <Boolean>
-BootstrapSelfManagedAddon <Boolean>
-ClientRequestToken <String>
-Logging_ClusterLogging <LogSetup[]>
-OutpostConfig_ControlPlaneInstanceType <String>
-ComputeConfig_Enabled <Boolean>
-ElasticLoadBalancing_Enabled <Boolean>
-BlockStorage_Enabled <Boolean>
-ZonalShiftConfig_Enabled <Boolean>
-EncryptionConfig <EncryptionConfig[]>
-ControlPlanePlacement_GroupName <String>
-KubernetesNetworkConfig_IpFamily <IpFamily>
-ComputeConfig_NodePool <String[]>
-ComputeConfig_NodeRoleArn <String>
-OutpostConfig_OutpostArn <String[]>
-RemoteNetworkConfig_RemoteNodeNetwork <RemoteNodeNetwork[]>
-RemoteNetworkConfig_RemotePodNetwork <RemotePodNetwork[]>
-ResourcesVpcConfig <VpcConfigRequest>
-RoleArn <String>
-KubernetesNetworkConfig_ServiceIpv4Cidr <String>
-UpgradePolicy_SupportType <SupportType>
-Tag <Hashtable>
-Version <String>
-Select <String>
-PassThru <SwitchParameter>
-Force <SwitchParameter>
-ClientConfig <AmazonEKSConfig>

Description

Creates an Amazon EKS control plane. The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as etcd and the API server. The control plane runs in an account managed by Amazon Web Services, and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single tenant and unique. It runs on its own set of Amazon EC2 instances. The cluster control plane is provisioned across multiple Availability Zones and fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support kubectl exec, logs, and proxy data flows). Amazon EKS nodes run in your Amazon Web Services account and connect to your cluster's control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster. You can use the endpointPublicAccess and endpointPrivateAccess parameters to enable or disable public and private access to your cluster's Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. For more information, see Amazon EKS Cluster Endpoint Access Control in the Amazon EKS User Guide. You can use the logging parameter to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS Cluster Control Plane Logs in the Amazon EKS User Guide. CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see CloudWatch Pricing. In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see Allowing users to access your cluster and Launching Amazon EKS nodes in the Amazon EKS User Guide.

Parameters

-AccessConfig_AuthenticationMode <AuthenticationMode>
The desired authentication mode for the cluster. If you create a cluster by using the EKS API, Amazon Web Services SDKs, or CloudFormation, the default is CONFIG_MAP. If you create the cluster by using the Amazon Web Services Management Console, the default value is API_AND_CONFIG_MAP.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-AccessConfig_BootstrapClusterCreatorAdminPermission <Boolean>
Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time. The default value is true.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesAccessConfig_BootstrapClusterCreatorAdminPermissions
-BlockStorage_Enabled <Boolean>
Indicates if the block storage capability is enabled on your EKS Auto Mode cluster. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesStorageConfig_BlockStorage_Enabled
-BootstrapSelfManagedAddon <Boolean>
If you set this value to False when creating a cluster, the default networking add-ons will not be installed.The default networking addons include vpc-cni, coredns, and kube-proxy.Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesBootstrapSelfManagedAddons
-ClientConfig <AmazonEKSConfig>
Amazon.PowerShell.Cmdlets.EKS.AmazonEKSClientCmdlet.ClientConfig
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-ClientRequestToken <String>
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-ComputeConfig_Enabled <Boolean>
Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-ComputeConfig_NodePool <String[]>
Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. For more information, see EKS Auto Mode Node Pools in the EKS User Guide.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesComputeConfig_NodePools
-ComputeConfig_NodeRoleArn <String>
The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled. For more information, see the IAM Reference in the EKS User Guide.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-ControlPlanePlacement_GroupName <String>
The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesOutpostConfig_ControlPlanePlacement_GroupName
-ElasticLoadBalancing_Enabled <Boolean>
Indicates if the load balancing capability is enabled on your EKS Auto Mode cluster. If the load balancing capability is enabled, EKS Auto Mode will create and delete load balancers in your Amazon Web Services account.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesKubernetesNetworkConfig_ElasticLoadBalancing_Enabled
-EncryptionConfig <EncryptionConfig[]>
The encryption configuration for the cluster.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-Force <SwitchParameter>
This parameter overrides confirmation prompts to force the cmdlet to continue its operation. This parameter should always be used with caution.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-KubernetesNetworkConfig_IpFamily <IpFamily>
Specify which IP family is used to assign Kubernetes pod and service IP addresses. If you don't specify a value, ipv4 is used by default. You can only specify an IP family when you create a cluster and can't change this value once the cluster is created. If you specify ipv6, the VPC and subnets that you specify for cluster creation must have both IPv4 and IPv6 CIDR blocks assigned to them. You can't specify ipv6 for clusters in China Regions.You can only specify ipv6 for 1.21 and later clusters that use version 1.10.1 or later of the Amazon VPC CNI add-on. If you specify ipv6, then ensure that your VPC meets the requirements listed in the considerations listed in Assigning IPv6 addresses to pods and services in the Amazon EKS User Guide. Kubernetes assigns services IPv6 addresses from the unique local address range (fc00::/7). You can't specify a custom IPv6 CIDR block. Pod addresses are assigned from the subnet's IPv6 CIDR.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-KubernetesNetworkConfig_ServiceIpv4Cidr <String>
Don't specify a value if you select ipv6 for ipFamily. The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. The block must meet the following requirements:
  • Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
  • Doesn't overlap with any CIDR block assigned to the VPC that you selected for VPC.
  • Between /24 and /12.
You can only specify a custom CIDR block when you create a cluster. You can't change this value after the cluster is created.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-Logging_ClusterLogging <LogSetup[]>
The cluster control plane logging configuration for your cluster.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-Name <String>
The unique name to give to your cluster. The name can contain only alphanumeric characters (case-sensitive), hyphens, and underscores. It must start with an alphanumeric character and can't be longer than 100 characters. The name must be unique within the Amazon Web Services Region and Amazon Web Services account that you're creating the cluster in.
Required?True
Position?1
Accept pipeline input?True (ByValue, ByPropertyName)
-OutpostConfig_ControlPlaneInstanceType <String>
The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. Choose an instance type based on the number of nodes that your cluster will have. For more information, see Capacity considerations in the Amazon EKS User Guide.The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. The control plane is not automatically scaled by Amazon EKS.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-OutpostConfig_OutpostArn <String[]>
The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. Only a single Outpost ARN is supported.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesOutpostConfig_OutpostArns
-PassThru <SwitchParameter>
Changes the cmdlet behavior to return the value passed to the Name parameter. The -PassThru parameter is deprecated, use -Select '^Name' instead. This parameter will be removed in a future version.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-RemoteNetworkConfig_RemoteNodeNetwork <RemoteNodeNetwork[]>
The list of network CIDRs that can contain hybrid nodes.These CIDR blocks define the expected IP address range of the hybrid nodes that join the cluster. These blocks are typically determined by your network administrator.Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16).It must satisfy the following requirements:
  • Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /24, maximum allowed size is /8. Publicly-routable addresses aren't supported.
  • Each block cannot overlap with the range of the VPC CIDR blocks for your EKS resources, or the block of the Kubernetes service IP range.
  • Each block must have a route to the VPC that uses the VPC CIDR blocks, not public IPs or Elastic IPs. There are many options including Transit Gateway, Site-to-Site VPN, or Direct Connect.
  • Each host must allow outbound connection to the EKS cluster control plane on TCP ports 443 and 10250.
  • Each host must allow inbound connection from the EKS cluster control plane on TCP port 10250 for logs, exec and port-forward operations.
  • Each host must allow TCP and UDP network connectivity to and from other hosts that are running CoreDNS on UDP port 53 for service and pod DNS names.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesRemoteNetworkConfig_RemoteNodeNetworks
-RemoteNetworkConfig_RemotePodNetwork <RemotePodNetwork[]>
The list of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.These CIDR blocks are determined by configuring your Container Network Interface (CNI) plugin. We recommend the Calico CNI or Cilium CNI. Note that the Amazon VPC CNI plugin for Kubernetes isn't available for on-premises and edge locations.Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16).It must satisfy the following requirements:
  • Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /24, maximum allowed size is /8. Publicly-routable addresses aren't supported.
  • Each block cannot overlap with the range of the VPC CIDR blocks for your EKS resources, or the block of the Kubernetes service IP range.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesRemoteNetworkConfig_RemotePodNetworks
-ResourcesVpcConfig <VpcConfigRequest>
The VPC configuration that's used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. You must specify at least two subnets. You can specify up to five security groups. However, we recommend that you use a dedicated security group for your cluster control plane.
Required?True
Position?Named
Accept pipeline input?True (ByPropertyName)
-RoleArn <String>
The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf. For more information, see Amazon EKS Service IAM Role in the Amazon EKS User Guide.
Required?True
Position?Named
Accept pipeline input?True (ByPropertyName)
-Select <String>
Use the -Select parameter to control the cmdlet output. The default value is 'Cluster'. Specifying -Select '*' will result in the cmdlet returning the whole service response (Amazon.EKS.Model.CreateClusterResponse). Specifying the name of a property of type Amazon.EKS.Model.CreateClusterResponse will result in that property being returned. Specifying -Select '^ParameterName' will result in the cmdlet returning the selected cmdlet parameter value.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-Tag <Hashtable>
Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesTags
-UpgradePolicy_SupportType <SupportType>
If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support.Learn more about EKS Extended Support in the EKS User Guide.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-Version <String>
The desired Kubernetes version for your cluster. If you don't specify a value here, the default version available in Amazon EKS is used.The default version might not be the latest version available.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-ZonalShiftConfig_Enabled <Boolean>
If zonal shift is enabled, Amazon Web Services configures zonal autoshift for the cluster.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)

Common Credential and Region Parameters

-AccessKey <String>
The AWS access key for the user account. This can be a temporary access key if the corresponding session token is supplied to the -SessionToken parameter.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesAK
-Credential <AWSCredentials>
An AWSCredentials object instance containing access and secret key information, and optionally a token for session-based credentials.
Required?False
Position?Named
Accept pipeline input?True (ByValue, ByPropertyName)
-EndpointUrl <String>
The endpoint to make the call against.Note: This parameter is primarily for internal AWS use and is not required/should not be specified for normal usage. The cmdlets normally determine which endpoint to call based on the region specified to the -Region parameter or set as default in the shell (via Set-DefaultAWSRegion). Only specify this parameter if you must direct the call to a specific custom endpoint.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
-NetworkCredential <PSCredential>
Used with SAML-based authentication when ProfileName references a SAML role profile. Contains the network credentials to be supplied during authentication with the configured identity provider's endpoint. This parameter is not required if the user's default network identity can or should be used during authentication.
Required?False
Position?Named
Accept pipeline input?True (ByValue, ByPropertyName)
-ProfileLocation <String>
Used to specify the name and location of the ini-format credential file (shared with the AWS CLI and other AWS SDKs)If this optional parameter is omitted this cmdlet will search the encrypted credential file used by the AWS SDK for .NET and AWS Toolkit for Visual Studio first. If the profile is not found then the cmdlet will search in the ini-format credential file at the default location: (user's home directory)\.aws\credentials.If this parameter is specified then this cmdlet will only search the ini-format credential file at the location given.As the current folder can vary in a shell or during script execution it is advised that you use specify a fully qualified path instead of a relative path.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesAWSProfilesLocation, ProfilesLocation
-ProfileName <String>
The user-defined name of an AWS credentials or SAML-based role profile containing credential information. The profile is expected to be found in the secure credential file shared with the AWS SDK for .NET and AWS Toolkit for Visual Studio. You can also specify the name of a profile stored in the .ini-format credential file used with the AWS CLI and other AWS SDKs.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesStoredCredentials, AWSProfileName
-Region <Object>
The system name of an AWS region or an AWSRegion instance. This governs the endpoint that will be used when calling service operations. Note that the AWS resources referenced in a call are usually region-specific.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesRegionToCall
-SecretKey <String>
The AWS secret key for the user account. This can be a temporary secret key if the corresponding session token is supplied to the -SessionToken parameter.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesSK, SecretAccessKey
-SessionToken <String>
The session token if the access and secret keys are temporary session-based credentials.
Required?False
Position?Named
Accept pipeline input?True (ByPropertyName)
AliasesST

Outputs

Amazon.EKS.Model.Cluster or Amazon.EKS.Model.CreateClusterResponse
This cmdlet returns an Amazon.EKS.Model.Cluster object. The service call response (type Amazon.EKS.Model.CreateClusterResponse) can be returned by specifying '-Select *'.

Examples

Example 1

New-EKSCluster -Name prod -ResourcesVpcConfig @{SubnetIds=@("subnet-0a1b2c3d","subnet-3a2b1c0d");SecurityGroupIds="sg-6979fe18"} -RoleArn "arn:aws:iam::012345678901:role/eks-service-role"

Arn                  : arn:aws:eks:us-west-2:012345678901:cluster/prod
CertificateAuthority : Amazon.EKS.Model.Certificate
ClientRequestToken   :
CreatedAt            : 12/10/2018 9:25:31 PM
Endpoint             :
Name                 : prod
PlatformVersion      : eks.3
ResourcesVpcConfig   : Amazon.EKS.Model.VpcConfigResponse
RoleArn              : arn:aws:iam::012345678901:role/eks-service-role
Status               : CREATING
Version              : 1.10
This example creates a new cluster called 'prod'.
User Guide
Service API Reference
AWS Tools for PowerShell User Guide

Supported Version

AWS Tools for PowerShell: 2.x.y.z