Set up an Elastic Kubernetes Service (EKS) cluster

Learn how to set up an EKS Cluster

This guide walks you through installing an Elastic Kubernetes Service (EKS) cluster. If you need more information, refer to Create an Amazon EKS cluster

Prerequisites

Install:

Deploy an EKS cluster

In the terminal, log into AWS.
```
aws configure
```

Create a new file called cluster-config.yaml and add the content below to it, replacing [your_cluster_name], [your_cluster_region], and [your_k8s_version] with the appropriate values:

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: [your_cluster_name]
  region: [your_cluster_region]
  version: [your_k8s_version]
  tags:
    karpenter.sh/discovery: [your_cluster_name]

iam:
  withOIDC: true

managedNodeGroups:
  - name: mng-od-4vcpu-8gb
    desiredCapacity: 2
    minSize: 1
    maxSize: 5
    instanceType: c5.xlarge
    privateNetworking: true

addons:
  - name: vpc-cni 
    attachPolicyARNs:
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
  - name: coredns
    version: latest 
  - name: kube-proxy
    version: latest
  - name: aws-ebs-csi-driver
    wellKnownPolicies: 
      ebsCSIController: true

Create the cluster by running the following command:
```
eksctl create cluster -f cluster-config.yaml
```
Verify the kubectl context:
```
kubectl config current-context
```

Add Dapr requirements for sidecar access and default storage class:

Update the security group rule to allow the EKS cluster to communicate with the Dapr Sidecar by creating an inbound rule for port 4000.

aws ec2 authorize-security-group-ingress --region [your_aws_region] \
--group-id [your_security_group] \
--protocol tcp \
--port 4000 \
--source-group [your_security_group]

Add a default storage class if you don’t have one:

kubectl patch storageclass gp2 -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

Install Dapr

Install Dapr on your cluster by running:

dapr init -k

You should see the following response:

⌛  Making the jump to hyperspace...
ℹ️  Note: To install Dapr using Helm, see here: https://docs.dapr.io/getting-started/install-dapr-kubernetes/#install-with-helm-advanced

ℹ️  Container images will be pulled from Docker Hub
✅  Deploying the Dapr control plane with latest version to your cluster...
✅  Deploying the Dapr dashboard with latest version to your cluster...
✅  Success! Dapr has been installed to namespace dapr-system. To verify, run `dapr status -k' in your terminal. To get started, go here: https://docs.dapr.io/getting-started

IAM Roles for Service Accounts (IRSA)

You can attach custom annotations to the ServiceAccounts created by the dapr_rbac Helm subchart—useful for enabling IAM Roles for Service Accounts (IRSA) on AWS EKS. This enables fine-grained, secure access control for Dapr components using EKS’s IRSA mechanism. Update your Dapr Helm values files to include the following necessary annotations for the ServiceAccounts.

See here for more information on AWS authentication.

serviceAccount:
  operator:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT_ID>:role/operator-role
  injector:
    annotations: {}
  placement:
    annotations: {}
  scheduler:
    annotations: {}
  sentry:
    annotations: {}

Troubleshooting

Access permissions

If you face any access permissions, make sure you are using the same AWS profile that was used to create the cluster. If needed, update the kubectl configuration with the correct profile. More information here:

aws eks --region [your_aws_region] update-kubeconfig --name [your_eks_cluster_name] --profile [your_profile_name]

Last modified September 5, 2025: [1.16] Adds docs for EKS IRSA (#4845) (a5355b51)