Telusko Docs

Attach an IAM role to the EKS home server, create the telusko-learning EKS cluster with one eksctl command, check it with kubectl, and delete it safely when you stop practising.

The deploy stage of our pipeline needs somewhere to deploy. In this lesson we create that place: a two-node Amazon EKS cluster, built from the EKS home server with a single eksctl command. eksctl creates the VPC, subnets, IAM roles, the EKS control plane, the worker nodes and the core add-ons for us.

This is the same recording as in the Kubernetes course. If your cluster from that course is still running (or you can recreate it with the same command), you can skip to the next lesson. The full walkthrough, with the complete eksctl output and every resource explained, is in Creating Your First EKS Cluster in the Kubernetes course.

Step 1: create an IAM role for the EKS home server

Create the role

Open IAM > Roles > Create role. Trusted entity: AWS service. Use case: EC2. Click Next.

Attach permissions

For a personal practice account, attach AdministratorAccess. It avoids permission errors halfway through cluster creation.

The video also attaches AmazonEC2FullAccess, IAMFullAccess, AWSCloudFormationFullAccess, AmazonVPCFullAccess, AmazonEKSClusterPolicy and AmazonEKS_CNI_Policy, as an example of a narrower set for real environments. The first four are what eksctl really uses. The two EKS policies are meant for the cluster role and the node role, which eksctl creates by itself, so this instance does not need them. For a proper least-privilege setup, use the list in eksctl: Minimum IAM policies.

Name it

Name the role eks-telusko-learning and click Create role.

Attach it to the instance

EC2 > Instances, select EKS-HOME-Server, then Actions > Security > Modify IAM role, choose eks-telusko-learning, Update IAM role.

Remember this role name. In the next lesson we attach the same role to the Jenkins server, and that is the reason Jenkins will be allowed into the cluster.

Check that the role is now in use:

aws sts get-caller-identity

The Arn should contain assumed-role/eks-telusko-learning/i-.... If it shows an IAM user instead, you still have access keys in ~/.aws/credentials from the previous lesson. Remove them, because they take priority over the role.

Step 2: create the cluster

eksctl create cluster \
  --name telusko-learning \
  --region ap-south-1 \
  --version 1.36 \
  --node-type t3.small \
  --nodes 2 \
  --zones ap-south-1a,ap-south-1b

Flag	Meaning
`--name`	Cluster name, used again in the Jenkins lessons
`--region`	Same region as your Jenkins server keeps things simple
`--version`	Kubernetes version. Not in the video, see the callout
`--node-type t3.small`	Worker node size. Must be allowed in your account; the default `m5.large` costs much more
`--nodes 2`	Two worker nodes
`--zones`	At least two Availability Zones

Pass --version

The recording did not pass --version, so eksctl picked its default (1.34 at the time). EKS standard support for 1.34 ends on 2 December 2026, after which the control plane is billed at the extended support price, six times higher. Choose a version that is in standard support on the EKS version calendar and keep kubectl within one minor version of it, on both the EKS home server and the Jenkins server.

Creation takes 10 to 20 minutes. Keep the terminal open. When it finishes, eksctl prints that it saved the kubeconfig to /home/ubuntu/.kube/config. Keep that path in mind: in the next lesson we copy this file to the Jenkins server.

Before you choose the node type, check it is available: in EC2 > Launch instance, search the instance type list. Free plan accounts cannot launch every family.

Step 3: check the cluster

kubectl get nodes
kubectl get pods
kubectl get svc

You should see two worker nodes in Ready state, no pods in the default namespace, and only the built-in kubernetes Service. In the AWS console, EKS > Clusters shows telusko-learning as Active, and EC2 > Instances now lists two node instances that the node group created for you.

Step 4: delete the cluster when you stop

EKS is not free

The control plane costs $0.10 per hour (about $2.40 a day) and the two t3.small nodes, the NAT gateway and any load balancers are billed on top. A forgotten practice cluster can reach $100 to $200 in a month. Create it when you sit down to practise, delete it when you get up.

First delete anything you deployed that created AWS resources. In this section that means the LoadBalancer Service created by the pipeline, which owns an AWS load balancer:

kubectl get svc -A | grep LoadBalancer
kubectl delete svc <service-name>

Then delete the cluster:

eksctl delete cluster --name telusko-learning --region ap-south-1 --wait

--wait makes eksctl wait for CloudFormation and report any failure, instead of returning immediately. Afterwards check CloudFormation (no eksctl-telusko-learning-* stacks), EC2 (no node instances, no load balancers) and VPC.

Stop (do not terminate) the EKS home server, and stop the Jenkins server too if you are done for the day. Next session: start both, run the same eksctl create cluster command, and repeat the kubeconfig step from the next lesson, because a new cluster has a new endpoint and certificate.

Common errors

Try It Yourself

Create the eks-telusko-learning role, attach it, and confirm it with aws sts get-caller-identity.
Create the cluster with an explicit --version and time how long it takes.
Run kubectl config current-context and cat ~/.kube/config. Find the cluster endpoint and the aws eks get-token command inside the file.
Open EKS > Clusters > telusko-learning > Access and find the access entry eksctl created for your role.
Delete the cluster with --wait and confirm in CloudFormation that nothing is left.

Official references

Written By: Shramik Masti

Creating Your First EKS Cluster

AccessDenied ... cloudformation:CreateStack

UnsupportedAvailabilityZoneException

The connection to the server localhost:8080 was refused

On this page