Installing kubectl, AWS CLI and eksctl for EKS

Before we can create anything on Kubernetes, we need a cluster, and before we can create the cluster, we need a machine with the right tools on it. This lesson sets up that machine. It takes about 15 minutes and you only do it once.

Ways to get a Kubernetes cluster

There are many ways to run Kubernetes. They fall into three groups.

Managed options exist on every major cloud: Amazon EKS (Elastic Kubernetes Service), Azure AKS, Google GKE and Oracle OKE. With a managed service, all the control plane components from the architecture lesson (API server, etcd, scheduler, controller manager) are installed, patched and kept highly available by the provider.

We use EKS for the whole course.

The plan

We will not click through the EKS console to create the cluster. That path involves creating a VPC, subnets, IAM roles, a cluster, a node group and add-ons by hand, and missing one step gives you a cluster that does not work. Instead we use a command line tool that does all of it in one go.

Your laptop --SSH--> EC2 "EKS home server" (Ubuntu)
                       |- aws     : talks to AWS, provides credentials
                       |- eksctl  : creates / deletes the EKS cluster
                       '- kubectl : talks to Kubernetes once the cluster exists

Step 1: Launch the EKS home server

Step 2: Connect with SSH

Select the instance, click Connect, open the SSH client tab and copy the example command. Open Git Bash (Windows) or Terminal (macOS, Linux) in the folder where the .pem file is, then run:

chmod 400 kubernetes-keypair.pem
ssh -i "kubernetes-keypair.pem" ubuntu@<public-dns-of-your-instance>

The default user on Ubuntu AMIs is ubuntu. Type yes the first time when SSH asks about the host fingerprint. If you get stuck, Connecting to an EC2 Instance Using Git Bash in the Linux course walks through SSH in detail, and vi Editor Basics covers the editor we use next.

Step 3: Install the three tools

In the lecture, the script came from an AI assistant using a prompt like "create a production-ready, idempotent bash script to install kubectl, AWS CLI v2 and eksctl on Ubuntu, with verification steps". The first version failed with unzip: command not found, and after a fix it installed everything. That is a fine way to work, but always check generated commands against the official install pages, because AI tools often reproduce old flags.

Create the script:

vi install-kubernetes-tools.sh

Press i for insert mode, paste the following, then press Esc and type :wq to save and quit.

#!/usr/bin/env bash
# Installs AWS CLI v2, kubectl and eksctl on Ubuntu (x86_64 / amd64)
set -euo pipefail

echo "=== Installing prerequisites ==="
sudo apt-get update -y
sudo apt-get install -y curl unzip tar

cd /tmp

echo "=== AWS CLI v2 ==="
curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip -q -o awscliv2.zip
sudo ./aws/install --update
rm -rf aws awscliv2.zip

echo "=== kubectl (latest stable) ==="
KVER=$(curl -L -s https://dl.k8s.io/release/stable.txt)
curl -sSLO "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl"
curl -sSLO "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl.sha256"
echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
rm -f kubectl kubectl.sha256

echo "=== eksctl (latest) ==="
PLATFORM=$(uname -s)_amd64
curl -sSLO "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_${PLATFORM}.tar.gz"
curl -sSL "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_checksums.txt" | grep "${PLATFORM}" | sha256sum --check
tar -xzf "eksctl_${PLATFORM}.tar.gz" -C /tmp && rm "eksctl_${PLATFORM}.tar.gz"
sudo install -m 0755 /tmp/eksctl /usr/local/bin && rm /tmp/eksctl

echo "=== Versions ==="
aws --version
kubectl version --client
eksctl version

Make it executable and run it:

chmod +x install-kubernetes-tools.sh
./install-kubernetes-tools.sh

When it finishes you should see something like this (your versions will be newer or older):

aws-cli/2.x.x Python/3.x.x Linux/... exe/x86_64.ubuntu.24
Client Version: v1.37.1
Kustomize Version: v5.x.x
0.231.0

Step 4: Give the tools AWS credentials

eksctl needs permission to create a VPC, IAM roles, CloudFormation stacks, EC2 instances and the EKS cluster. There are two ways to give it that permission.

The way shown in the lecture: aws configure with access keys

The lecture creates an access key from the Security credentials page and runs:

aws configure

AWS Access Key ID [None]: <your access key id>
AWS Secret Access Key [None]: <your secret access key>
Default region name [None]: ap-south-1
Default output format [None]: json

This works, but be careful:

• Never create access keys for the root user. If you are signed in as root, create an IAM user first (see IAM: root vs IAM user) and create the key for that user.
• The keys are saved in plain text in ~/.aws/credentials on the EC2 instance. Anyone who gets into that machine gets your AWS account.
• Never paste keys into screenshots, chat messages or Git repositories.

The better way: an IAM role on the EC2 instance

The next lesson attaches an IAM role to this EC2 instance. A role gives the instance temporary credentials that rotate automatically, and nothing secret is stored on disk. If you use the role, you do not need access keys at all. Just set the region:

aws configure set region ap-south-1

Whichever method you choose, confirm who you are before creating anything:

aws sts get-caller-identity

It prints the user or role ARN that eksctl will use. AWS recommends that you create and manage the cluster as this same identity throughout.

Common errors

Cost note

The t3.micro EKS home server is small, and free tier eligible on most new accounts. When you take a break of several days, stop it from the EC2 console rather than terminating it. The tools stay installed and you only pay for the 8 GB disk while it is stopped. The expensive part is the EKS cluster, which we create and delete in the next lesson.

Try It Yourself

1. Launch the EKS home server and install all three tools with the script above.
2. Run aws --version, kubectl version --client and eksctl version and note the versions.
3. Run kubectl get nodes now, before any cluster exists. Read the error and explain why it happens (hint: there is no kubeconfig yet).
4. Run aws sts get-caller-identity and identify whether you are using an IAM user or a role.
5. Run the script a second time and confirm it completes without errors.

Official references

• Amazon EKS: Set up kubectl and eksctl
• Kubernetes: Install kubectl on Linux
• eksctl: Installation
• AWS CLI: Install or update to the latest version

Written By: Shramik Masti