### Install Pulumi EKS for Go

Source: https://github.com/pulumi/pulumi-eks/blob/master/README.md

Install the Pulumi EKS SDK for Go using go get.

```bash
$ go get github.com/pulumi/pulumi-eks/sdk/go
```

--------------------------------

### Install Standard EKS Add-ons

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/configuration.md

Installs recommended add-ons like vpc-cni, kube-proxy, and CoreDNS with default configurations. It also shows how to install additional add-ons like the EBS CSI driver.

```typescript
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    bootstrapSelfManagedAddons: true, // Installs vpc-cni, kube-proxy, CoreDNS
});

// Get latest addon versions
const corednsVersion = aws.eks.getAddonVersionOutput({
    addonName: "coredns",
    kubernetesVersion: cluster.eksCluster.version,
    mostRecent: true,
});

// Install additional add-on
const ebsCsi = new eks.Addon("ebs-csi", {
    cluster: cluster,
    addonName: "ebs-csi-driver",
    addonVersion: corednsVersion.version,
});
```

--------------------------------

### Build and Install Node.js SDK

Source: https://github.com/pulumi/pulumi-eks/blob/master/CONTRIBUTING.md

Builds the Node.js SDK and installs it into the local node_modules directory. Ensure you have the necessary build tools and yarn installed.

```bash
$ make build_nodejs && make install_nodejs_sdk
```

--------------------------------

### Basic VPC CNI Addon Setup

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/vpc-cni-addon.md

Installs the VPC CNI addon on a cluster created without the default VPC CNI. Use this for a standard installation.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

// Create a cluster without the default VPC CNI
const cluster = new eks.Cluster("my-cluster", {
    useDefaultVpcCni: false,
    skipDefaultNodeGroup: false,
});

// Explicitly add the VPC CNI add-on
const vpcCni = new eks.VpcCniAddon("vpc-cni", {
    clusterName: cluster.eksCluster.name,
    clusterVersion: cluster.eksCluster.version,
});

export const clusterName = cluster.eksCluster.name;
```

--------------------------------

### Clone the Pulumi EKS Example Repository

Source: https://github.com/pulumi/pulumi-eks/blob/master/examples/modify-default-eks-sg/README.md

Clone the repository to get started with the EKS security group modification example.

```bash
git clone https://github.com/metral/modify-default-eks-sg
cd modify-default-eks-sg
```

--------------------------------

### Multi-Environment Setup

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster-creation-role-provider.md

Configure EKS cluster creation for different environments using dynamic role and policy assignments based on configuration.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

const config = new pulumi.Config();
const environment = config.require("environment");

// Create environment-specific deployment roles
const deploymentRole = new aws.iam.Role(`${environment}-eks-deployment-role`, {
    assumeRolePolicy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "eks.amazonaws.com",
                AWS: config.require(`${environment}-deployer-arn`),
            },
        }],
    }),
});

// Attach policies based on environment
const policyArn = environment === "production"
    ? "arn:aws:iam::aws:policy/AmazonEKSServiceRolePolicy"
    : "arn:aws:iam::aws:policy/PowerUserAccess";

new aws.iam.RolePolicyAttachment(`${environment}-policy`, {
    role: deploymentRole.name,
    policyArn: policyArn,
});

const roleProvider = new eks.ClusterCreationRoleProvider(`${environment}-provider`, {
    role: deploymentRole,
});

const cluster = new eks.Cluster(`${environment}-cluster`, {
    creationRoleProvider: roleProvider,
    version: environment === "production" ? "1.28" : "1.27",
});

export const kubeconfig = cluster.kubeconfig;
```

--------------------------------

### Install Node.js Dependencies

Source: https://github.com/pulumi/pulumi-eks/blob/master/examples/modify-default-eks-sg/README.md

Install the necessary Node.js dependencies for the Pulumi project.

```bash
npm install
```

--------------------------------

### Basic NodeGroupV2 Setup

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/node-group-v2.md

Creates a basic EKS NodeGroupV2. Use this for standard node provisioning within an EKS cluster.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

// Create a cluster
const cluster = new eks.Cluster("my-cluster", {
    skipDefaultNodeGroup: true,
});

// Create a node group
const nodeGroup = new eks.NodeGroupV2("my-node-group", {
    cluster: cluster,
    desiredCapacity: 2,
    minSize: 1,
    maxSize: 5,
    instanceType: "t3.medium",
});

export const asgName = nodeGroup.autoScalingGroupName;
```

--------------------------------

### Install Pulumi EKS for .NET

Source: https://github.com/pulumi/pulumi-eks/blob/master/README.md

Install the Pulumi EKS package for .NET using the dotnet add package command.

```bash
$ dotnet add package Pulumi.Eks
```

--------------------------------

### Create Managed Node Group with Spot Instances

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/managed-node-group.md

This example shows how to configure a managed node group to use Spot Instances for cost savings. It specifies the `capacityType` as 'SPOT' and sets a `spotPrice`.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    skipDefaultNodeGroup: true,
});

// Create a Spot instance node group
const spotNodeGroup = new eks.ManagedNodeGroup("spot-node-group", {
    cluster: cluster,
    desiredSize: 2,
    minSize: 0,
    maxSize: 5,
    instanceType: "t3.medium",
    capacityType: "SPOT",
    spotPrice: "0.05",
    labels: {
        workload: "batch",
        capacity: "spot",
    },
});

export const spotNodeGroupId = spotNodeGroup.nodeGroup.id;
```

--------------------------------

### Install Pulumi EKS for Python

Source: https://github.com/pulumi/pulumi-eks/blob/master/README.md

Install the Pulumi EKS package for Python using pip.

```bash
$ pip install pulumi_eks
```

--------------------------------

### Basic Managed Node Group

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

This example demonstrates creating a managed node group with typical defaults. It sets up a VPC, an EKS cluster, an IAM role for worker nodes, attaches required IAM policies, and finally creates the managed node group. Instance security groups are automatically configured.

```python
import pulumi
import json
import pulumi_aws as aws
import pulumi_awsx as awsx
import pulumi_eks as eks

eks_vpc = awsx.ec2.Vpc("eks-vpc",
    enable_dns_hostnames=True,
    cidr_block="10.0.0.0/16")
eks_cluster = eks.Cluster("eks-cluster",
    vpc_id=eks_vpc.vpc_id,
    authentication_mode=eks.AuthenticationMode.API,
    public_subnet_ids=eks_vpc.public_subnet_ids,
    private_subnet_ids=eks_vpc.private_subnet_ids,
    skip_default_node_group=True)
node_role = aws.iam.Role("node-role", assume_role_policy=json.dumps({
    "Version": "2012-10-17",
    "Statement": [{
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Sid": "",
        "Principal": {
            "Service": "ec2.amazonaws.com",
        },
    }],
}))
worker_node_policy = aws.iam.RolePolicyAttachment("worker-node-policy",
    role=node_role.name,
    policy_arn="arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy")
cni_policy = aws.iam.RolePolicyAttachment("cni-policy",
    role=node_role.name,
    policy_arn="arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy")
registry_policy = aws.iam.RolePolicyAttachment("registry-policy",
    role=node_role.name,
    policy_arn="arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly")
node_group = eks.ManagedNodeGroup("node-group",
    cluster=eks_cluster,
    node_role=node_role)

```

--------------------------------

### .NET EKS Cluster Creation

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/INDEX.md

Provides an example of creating an EKS cluster in .NET using the Pulumi EKS package. Requires the `Pulumi.Eks` namespace to be imported.

```csharp
using Pulumi.Eks;

// Usage
var cluster = new Cluster("my-cluster", new ClusterArgs { });
```

--------------------------------

### Install Pulumi EKS for Node.js/TypeScript

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/README.md

Use npm or yarn to install the Pulumi EKS package for Node.js and TypeScript projects.

```bash
npm install @pulumi/eks
# or
yarn add @pulumi/eks
```

--------------------------------

### Install Pulumi EKS for Node.js (yarn)

Source: https://github.com/pulumi/pulumi-eks/blob/master/README.md

Install the Pulumi EKS package using yarn for use in Node.js JavaScript or TypeScript projects.

```bash
$ yarn add @pulumi/eks
```

--------------------------------

### Basic Managed Node Group

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

This example demonstrates creating a managed node group with typical defaults. It sets up a VPC, an EKS cluster, an IAM role for worker nodes, attaches required IAM policies, and finally creates the managed node group. Instance security groups are automatically configured.

```yaml
resources:
  eks-vpc:
    type: awsx:ec2:Vpc
    properties:
      enableDnsHostnames: true
      cidrBlock: 10.0.0.0/16
  eks-cluster:
    type: eks:Cluster
    properties:
      vpcId: ${eks-vpc.vpcId}
      authenticationMode: API
      publicSubnetIds: ${eks-vpc.publicSubnetIds}
      privateSubnetIds: ${eks-vpc.privateSubnetIds}
      skipDefaultNodeGroup: true
  node-role:
    type: aws:iam:Role
    properties:
      assumeRolePolicy:
        fn::toJSON:
          Version: 2012-10-17
          Statement:
            - Action: sts:AssumeRole
              Effect: Allow
              Sid: ""
              Principal:
                Service: ec2.amazonaws.com
  worker-node-policy:
    type: aws:iam:RolePolicyAttachment
    properties:
      role: ${node-role.name}
      policyArn: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  cni-policy:
    type: aws:iam:RolePolicyAttachment
    properties:
      role: ${node-role.name}
      policyArn: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
  registry-policy:
    type: aws:iam:RolePolicyAttachment
    properties:
      role: ${node-role.name}
      policyArn: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
  node-group:
    type: eks:ManagedNodeGroup
    properties:
      cluster: ${eks-cluster}
      nodeRole: ${node-role}
```

--------------------------------

### NodeGroupV2 with Spot Instances

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/node-group-v2.md

Configure a NodeGroupV2 to use Spot instances for cost optimization. This example specifies multiple instance types and sets a spot price. Labels and Auto Scaling Group tags can be applied for identification and management.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    skipDefaultNodeGroup: true,
});

// Create a cost-optimized node group using Spot instances
const spotNodeGroup = new eks.NodeGroupV2("spot-node-group", {
    cluster: cluster,
    desiredCapacity: 2,
    minSize: 0,
    maxSize: 10,
    instanceType: ["m5.large", "m5a.large", "m6i.large"],
    spotPrice: "0.10",
    labels: {
        capacity: "spot",
        workload: "batch",
    },
    autoScalingGroupTags: {
        "spotInstance": "true",
    },
});

export const spotAsgName = spotNodeGroup.autoScalingGroupName;
```

--------------------------------

### Create EKS Cluster with Fargate Support

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster.md

This example configures an EKS cluster to use AWS Fargate for running pods in specified namespaces. It also ensures the default node group is not skipped.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    fargate: {
        namespaces: ["default", "kube-system"],
    },
    skipDefaultNodeGroup: false,
});

export const kubeconfig = cluster.kubeconfig;
```

--------------------------------

### Basic Managed Node Group

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

This example demonstrates creating a managed node group with typical defaults. It sets up a VPC, an EKS cluster, an IAM role for worker nodes, attaches required IAM policies, and finally creates the managed node group. Instance security groups are automatically configured.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";
import * as eks from "@pulumi/eks";

const eksVpc = new awsx.ec2.Vpc("eks-vpc", {
    enableDnsHostnames: true,
    cidrBlock: "10.0.0.0/16",
});
const eksCluster = new eks.Cluster("eks-cluster", {
    vpcId: eksVpc.vpcId,
    authenticationMode: eks.AuthenticationMode.Api,
    publicSubnetIds: eksVpc.publicSubnetIds,
    privateSubnetIds: eksVpc.privateSubnetIds,
    skipDefaultNodeGroup: true,
});
const nodeRole = new aws.iam.Role("node-role", {assumeRolePolicy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [{
        Action: "sts:AssumeRole",
        Effect: "Allow",
        Sid: "",
        Principal: {
            Service: "ec2.amazonaws.com",
        },
    }],
})});
const workerNodePolicy = new aws.iam.RolePolicyAttachment("worker-node-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
});
const cniPolicy = new aws.iam.RolePolicyAttachment("cni-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
});
const registryPolicy = new aws.iam.RolePolicyAttachment("registry-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
});
const nodeGroup = new eks.ManagedNodeGroup("node-group", {
    cluster: eksCluster,
    nodeRole: nodeRole,
});

```

--------------------------------

### Install Pulumi EKS for Node.js (npm)

Source: https://github.com/pulumi/pulumi-eks/blob/master/README.md

Install the Pulumi EKS package using npm for use in Node.js JavaScript or TypeScript projects.

```bash
$ npm install @pulumi/eks
```

--------------------------------

### Prepare for Security Group Modification

Source: https://github.com/pulumi/pulumi-eks/blob/master/examples/modify-default-eks-sg/README.md

Back up the current index.ts file and copy the step1.ts example to index.ts to modify the security group rules.

```bash
mv index.ts index.ts.bak
cp step1.ts index.ts
```

--------------------------------

### Create EKS Cluster and Managed Node Group in C#

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

This C# code snippet demonstrates the equivalent of the Go example, creating an EKS cluster, IAM roles, policies, and a managed node group. It utilizes Pulumi's AWS, AWSX, and EKS components.

```csharp
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;
using Awsx = Pulumi.Awsx;
using Eks = Pulumi.Eks;

return await Deployment.RunAsync(() => 
{
    var eksVpc = new Awsx.Ec2.Vpc("eks-vpc", new() 
    {
        EnableDnsHostnames = true,
        CidrBlock = "10.0.0.0/16",
    });

    var eksCluster = new Eks.Cluster("eks-cluster", new() 
    {
        VpcId = eksVpc.VpcId,
        AuthenticationMode = Eks.AuthenticationMode.Api,
        PublicSubnetIds = eksVpc.PublicSubnetIds,
        PrivateSubnetIds = eksVpc.PrivateSubnetIds,
        SkipDefaultNodeGroup = true,
    });

    var nodeRole = new Aws.Iam.Role("node-role", new() 
    {
        AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary<string, object?> 
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?> 
                {
                    ["Action"] = "sts:AssumeRole",
                    ["Effect"] = "Allow",
                    ["Sid"] = "",
                    ["Principal"] = new Dictionary<string, object?> 
                    {
                        ["Service"] = "ec2.amazonaws.com",
                    },
                },
            },
        }),
    });

    var workerNodePolicy = new Aws.Iam.RolePolicyAttachment("worker-node-policy", new() 
    {
        Role = nodeRole.Name,
        PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    });

    var cniPolicy = new Aws.Iam.RolePolicyAttachment("cni-policy", new() 
    {
        Role = nodeRole.Name,
        PolicyArn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    });

    var registryPolicy = new Aws.Iam.RolePolicyAttachment("registry-policy", new() 
    {
        Role = nodeRole.Name,
        PolicyArn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    });

    var nodeGroup = new Eks.ManagedNodeGroup("node-group", new() 
    {
        Cluster = eksCluster,
        NodeRole = nodeRole,
    });

    return new Dictionary<string, object?>();
});

```

--------------------------------

### Validate VPC and Subnet Configuration for EKS Cluster

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/errors.md

This TypeScript example demonstrates how to create a VPC and then validate that public and private subnets exist before creating an EKS cluster. It ensures that the subnet IDs are valid and belong to the correct VPC.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as awsx from "@pulumi/awsx";
import * as eks from "@pulumi/eks";

const vpc = new awsx.ec2.Vpc("my-vpc", {
    cidrBlock: "10.0.0.0/16",
});

// Verify subnets before passing to Cluster
const subnets = pulumi.all([vpc.publicSubnetIds, vpc.privateSubnetIds])
    .apply(([pub, priv]) => {
        if (!pub || pub.length === 0) {
            throw new Error("No public subnets available");
        }
        if (!priv || priv.length === 0) {
            throw new Error("No private subnets available");
        }
        return { public: pub, private: priv };
    });

const cluster = new eks.Cluster("my-cluster", {
    vpcId: vpc.vpcId,
    publicSubnetIds: subnets.public,
    privateSubnetIds: subnets.private,
});
```

--------------------------------

### Referencing Stack Config Provider in Code

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/provider.md

Code example showing how Pulumi automatically uses provider configuration defined in stack files. No explicit provider instantiation is needed when configuration is present.

```typescript
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

// Pulumi automatically creates provider from config
const cluster = new eks.Cluster("prod-cluster", {});
```

--------------------------------

### Create EKS Cluster in Custom VPC

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster.md

This example shows how to provision an EKS cluster within a custom VPC, specifying subnet IDs and node group scaling parameters. It requires awsx for VPC creation.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as awsx from "@pulumi/awsx";
import * as eks from "@pulumi/eks";

// Create a VPC for the cluster
const vpc = new awsx.ec2.Vpc("eks-vpc", {
    cidrBlock: "10.0.0.0/16",
    enableDnsHostnames: true,
});

// Create an EKS cluster in the custom VPC
const cluster = new eks.Cluster("my-cluster", {
    vpcId: vpc.vpcId,
    publicSubnetIds: vpc.publicSubnetIds,
    privateSubnetIds: vpc.privateSubnetIds,
    desiredCapacity: 3,
    minSize: 1,
    maxSize: 5,
    instanceType: "t3.medium",
});

export const kubeconfig = cluster.kubeconfig;
```

--------------------------------

### Create Managed Node Group with EFA Support

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/managed-node-group.md

This example shows how to create a managed node group with Elastic Fabric Adapter (EFA) support enabled. This is typically used for high-performance computing (HPC) workloads requiring high throughput and low latency networking.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    skipDefaultNodeGroup: true,
});

// Create a node group with EFA support
const efaNodeGroup = new eks.ManagedNodeGroup("efa-node-group", {
    cluster: cluster,
    desiredSize: 2,
    minSize: 0,
    maxSize: 4,
    instanceType: "p4d.24xlarge",
    amiType: "AL2_x86_64_GPU",
    efaEnabled: true,
    labels: {
        workload: "hpc",
        efa: "enabled",
    },
});

export const efaNodeGroupId = efaNodeGroup.nodeGroup.id;
```

--------------------------------

### Go EKS Cluster Creation

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/INDEX.md

Illustrates how to create an EKS cluster in Go using the Pulumi EKS SDK. Requires the `eks` package to be imported.

```go
import "github.com/pulumi/pulumi-eks/sdk/go/eks"

// Usage
cluster, err := eks.NewCluster(ctx, "my-cluster", nil)
```

--------------------------------

### Enable Pulumi Debug Logging

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/errors.md

Enable Pulumi's internal debug logging to get more detailed output during deployment. Set the PULUMI_DEBUG environment variable to 1.

```bash
# Enable Pulumi debug logging
PULUMI_DEBUG=1 pulumi up
```

--------------------------------

### Configure EKS Cluster for Safe Deletion

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/errors.md

This example shows how to disable deletion protection on an EKS cluster and ensure that node groups are deleted before the cluster itself. This is crucial for safe cluster cleanup.

```typescript
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    deletionProtection: false, // Allow deletion
});

// Ensure all node groups are deleted before cluster
const nodeGroup = new eks.ManagedNodeGroup("nodes", {
    cluster: cluster,
}, { dependsOn: [cluster] });

export const clusterName = cluster.eksCluster.name;
```

--------------------------------

### Initialize Pulumi Stack

Source: https://github.com/pulumi/pulumi-eks/blob/master/examples/modify-default-eks-sg/README.md

Initialize a new Pulumi stack for the project, naming it 'dev'.

```bash
pulumi stack init dev
```

--------------------------------

### Initial Pulumi Update to Create Cluster and Import SG

Source: https://github.com/pulumi/pulumi-eks/blob/master/examples/modify-default-eks-sg/README.md

Perform the initial Pulumi update to create the EKS cluster and import its default security group.

```bash
pulumi up
```

--------------------------------

### Get Nodes for Managed Node Groups

Source: https://github.com/pulumi/pulumi-eks/blob/master/docs/eks-v3-migration.md

This bash command retrieves the names of nodes belonging to a specific managed EKS node group. Replace `$NODE_GROUP_NAME` with the actual name of your node group.

```bash
kubectl get nodes -l eks.amazonaws.com/nodegroup=$NODE_GROUP_NAME -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'
```

--------------------------------

### ClusterCreationRoleProvider vs. Direct AWS Provider

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster-creation-role-provider.md

Illustrates how to create an EKS cluster using ClusterCreationRoleProvider in Node.js versus using the AWS Provider directly with assumeRole configuration, which supports all languages.

```typescript
// Using ClusterCreationRoleProvider (Node.js)
const roleProvider = new eks.ClusterCreationRoleProvider("provider", {
    role: deploymentRole,
});
const cluster = new eks.Cluster("cluster", {
    creationRoleProvider: roleProvider,
});

// Using AWS Provider directly (all languages)
const awsProvider = new aws.Provider("provider", {
    assumeRole: {
        roleArn: deploymentRole.arn,
    },
});
const cluster = new eks.Cluster("cluster", {}, {
    provider: awsProvider,
});
```

--------------------------------

### Create EKS Cluster and Node Groups with EFA Support

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

This Go program defines an EKS cluster, IAM roles, and two managed node groups. One node group is for general system pods, and the other is configured with EFA support, GPU instances, specific scaling, and taints for EFA-enabled workloads. It also deploys the EFA device plugin using Helm.

```go
package main

import (
	"encoding/json"

	awseks "github.com/pulumi/pulumi-aws/sdk/v6/go/aws/eks"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam"
	"github.com/pulumi/pulumi-awsx/sdk/v2/go/awsx/ec2"
	"github.com/pulumi/pulumi-eks/sdk/v4/go/eks"
	"github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes"
	helmv3 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/helm/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		eksVpc, err := ec2.NewVpc(ctx, "eks-vpc", &ec2.VpcArgs{
			EnableDnsHostnames: pulumi.Bool(true),
			CidrBlock:          "10.0.0.0/16",
		})
		if err != nil {
			return err
		}
		eksCluster, err := eks.NewCluster(ctx, "eks-cluster", &eks.ClusterArgs{
			VpcId:                eksVpc.VpcId,
			AuthenticationMode:   eks.AuthenticationModeApi,
			PublicSubnetIds:      eksVpc.PublicSubnetIds,
			PrivateSubnetIds:     eksVpc.PrivateSubnetIds,
			SkipDefaultNodeGroup: true,
		})
		if err != nil {
			return err
		}
		k8SProvider, err := kubernetes.NewProvider(ctx, "k8sProvider", &kubernetes.ProviderArgs{
			Kubeconfig: eksCluster.Kubeconfig,
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"Version": "2012-10-17",
			"Statement": []map[string]interface{}{
				map[string]interface{}{
					"Action": "sts:AssumeRole",
					"Effect": "Allow",
					"Sid":    "",
					"Principal": map[string]interface{}{
						"Service": "ec2.amazonaws.com",
					},
				},
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		nodeRole, err := iam.NewRole(ctx, "node-role", &iam.RoleArgs{
			AssumeRolePolicy: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewRolePolicyAttachment(ctx, "worker-node-policy", &iam.RolePolicyAttachmentArgs{
			Role:      nodeRole.Name,
			PolicyArn: pulumi.String("arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewRolePolicyAttachment(ctx, "cni-policy", &iam.RolePolicyAttachmentArgs{
			Role:      nodeRole.Name,
			PolicyArn: pulumi.String("arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewRolePolicyAttachment(ctx, "registry-policy", &iam.RolePolicyAttachmentArgs{
			Role:      nodeRole.Name,
			PolicyArn: pulumi.String("arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"),
		})
		if err != nil {
			return err
		}

        // The node group for running system pods (e.g. coredns, etc.)
		_, err = eks.NewManagedNodeGroup(ctx, "system-node-group", &eks.ManagedNodeGroupArgs{
			Cluster:  eksCluster,
			NodeRole: nodeRole,
		})
		if err != nil {
			return err
		}

        // The EFA device plugin for exposing EFA interfaces as extended resources
		_, err = helmv3.NewRelease(ctx, "device-plugin", &helmv3.ReleaseArgs{
			Version: pulumi.String("0.5.7"),
			RepositoryOpts: &helmv3.RepositoryOptsArgs{
				Repo: pulumi.String("https://aws.github.io/eks-charts"),
			},
			Chart:     pulumi.String("aws-efa-k8s-device-plugin"),
			Namespace: pulumi.String("kube-system"),
			Atomic:    pulumi.Bool(true),
			Values: pulumi.Map{
				"tolerations": pulumi.Any(
					[]map[string]interface{}{
                        {
                            "key":      "efa-enabled",
                            "operator": "Exists",
                            "effect":   "NoExecute",
                        }
					},
				),
			},
		}, pulumi.Provider(k8SProvider))
		if err != nil {
			return err
		}

        // The node group for running EFA enabled workloads
		_, err = eks.NewManagedNodeGroup(ctx, "efa-node-group", &eks.ManagedNodeGroupArgs{
			Cluster:  eksCluster,
			NodeRole: nodeRole,
			InstanceTypes: pulumi.StringArray{
				pulumi.String("g6.8xlarge"),
			},
			Gpu: pulumi.Bool(true),
			ScalingConfig: &eks.NodeGroupScalingConfigArgs{
				MinSize:     pulumi.Int(2),
				DesiredSize: pulumi.Int(2),
				MaxSize:     pulumi.Int(4),
			},
			EnableEfaSupport:               true,
			PlacementGroupAvailabilityZone: pulumi.String("us-west-2b"),

            // Taint the nodes so that only pods with the efa-enabled label can be scheduled on them
			Taints: eks.NodeGroupTaintArray{
				&eks.NodeGroupTaintArgs{
					Key:    pulumi.String("efa-enabled"),
					Value:  pulumi.String("true"),
					Effect: pulumi.String("NO_EXECUTE"),
				},
			},

            // Instances with GPUs usually have nvme instance store volumes, so we can mount them in RAID-0 for kubelet and containerd
            // These are faster than the regular EBS volumes
			NodeadmExtraOptions: eks.NodeadmOptionsArray{
				&eks.NodeadmOptionsArgs{
					ContentType: pulumi.String("application/node.eks.aws"),
					Content: pulumi.String(`apiVersion: node.eks.aws/v1alpha1
kind: NodeConfig
spec:
  instance:
    localStorage:
      strategy: RAID0
`),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

```

--------------------------------

### Addon Methods

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/INDEX.md

Details the constructor for managing EKS Addons.

```APIDOC
## Addon Methods

### Constructor

- **Constructor** — `new Addon(name, args, opts?)
```

--------------------------------

### Reference Pulumi Configuration in Code

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/configuration.md

Reference Pulumi stack configuration values within your TypeScript code to dynamically set EKS cluster properties. This example shows how to retrieve region, Kubernetes version, and logging enablement.

```typescript
import * as pulumi from "@pulumi/pulumi";

const config = new pulumi.Config();
const region = config.require("aws:region");
const kubeVersion = config.get("eks:kubernetesVersion") || "1.28";
const enableLogging = config.getBoolean("eks:enableLogging") ?? true;

const cluster = new eks.Cluster("my-cluster", {
    version: kubeVersion,
    enabledClusterLogTypes: enableLogging ? ["api", "audit"] : [],
});
```

--------------------------------

### VpcCniAddon Methods

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/INDEX.md

Details the constructor for managing the VPC CNI Addon for EKS.

```APIDOC
## VpcCniAddon Methods

### Constructor

- **Constructor** — `new VpcCniAddon(name, args, opts?)
```

--------------------------------

### Use Pulumi Secrets for Sensitive Role ARNs

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster-creation-role-provider.md

This example shows how to use `config.requireSecret` to load a sensitive role ARN from Pulumi configuration and use it to instantiate a `ClusterCreationRoleProvider`. This ensures the role ARN is encrypted and not exposed in plaintext.

```typescript
const config = new pulumi.Config();
const roleArn = config.requireSecret("eks-role-arn");

const roleProvider = new eks.ClusterCreationRoleProvider("provider", {
    roleArn: roleArn,
});

const cluster = new eks.Cluster("cluster", {
    creationRoleProvider: roleProvider,
});
```

--------------------------------

### TypeScript: Get Kubeconfig with Role ARN

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster.md

Generates a kubeconfig for cluster authentication, specifying a role ARN to assume instead of using the default AWS credential provider chain. The kubeconfig is automatically stringified for use with the pulumi/kubernetes provider.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

// Create a cluster with the default configuration
const cluster = new eks.Cluster("my-cluster", {});

// Get kubeconfig with a specific role assumption
const kubeconfig = cluster.getKubeconfig({
    roleArn: "arn:aws:iam::123456789012:role/MyRole",
});

// Use kubeconfig in downstream resources
export const kubeconfigString = kubeconfig.apply(k => k.result);
```

--------------------------------

### Migrating ClusterCreationRoleProvider to ProviderCredentialOpts

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/cluster-creation-role-provider.md

Shows the Node.js syntax for ClusterCreationRoleProvider and its Python equivalent using providerCredentialOpts for migrating to other Pulumi languages.

```typescript
// Node.js with ClusterCreationRoleProvider
const roleProvider = new eks.ClusterCreationRoleProvider("provider", {
    roleArn: "arn:aws:iam::123456789012:role/EKSRole",
});
const cluster = new eks.Cluster("cluster", {
    creationRoleProvider: roleProvider,
});
```

```python
# Python equivalent using providerCredentialOpts
cluster = eks.Cluster("cluster",
    provider_credential_opts=eks.KubeconfigOptionsArgs(
        role_arn="arn:aws:iam::123456789012:role/EKSRole",
    ),
)
```

--------------------------------

### Get Nodes for Self-Managed Node Groups

Source: https://github.com/pulumi/pulumi-eks/blob/master/docs/eks-v3-migration.md

This AWS CLI command retrieves the private DNS names of instances associated with a self-managed EKS node group's Auto Scaling Group. Replace `$ASG_GROUP_NAME` with the actual name of the Auto Scaling group.

```bash
aws ec2 describe-instances --filter "Name=tag:aws:autoscaling:groupName,Values=$ASG_GROUP_NAME" \
    | jq -r '.Reservations[].Instances[].PrivateDnsName'
```

--------------------------------

### Create Managed Node Group with Custom IAM Role

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/managed-node-group.md

This example demonstrates creating a managed node group with a custom IAM role. It includes the necessary steps to create the role, attach required AWS managed policies, and then associate the role with the node group.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

const cluster = new eks.Cluster("my-cluster", {
    skipDefaultNodeGroup: true,
});

// Create a custom IAM role for nodes
const nodeRole = new aws.iam.Role("custom-node-role", {
    assumeRolePolicy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "ec2.amazonaws.com",
            },
        }],
    }),
});

// Attach required policies
new aws.iam.RolePolicyAttachment("worker-node-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
});

new aws.iam.RolePolicyAttachment("cni-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
});

new aws.iam.RolePolicyAttachment("registry-policy", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
});

// Create the managed node group with custom role
const nodeGroup = new eks.ManagedNodeGroup("my-node-group", {
    cluster: cluster,
    nodeRole: nodeRole,
    desiredSize: 3,
    minSize: 1,
    maxSize: 10,
});

export const nodeGroupArn = nodeGroup.nodeGroup.arn;
```

--------------------------------

### VpcCniAddon Constructor

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/vpc-cni-addon.md

Initializes a new instance of the VpcCniAddon component. This constructor requires a name, configuration arguments, and optional resource options.

```APIDOC
## VpcCniAddon Constructor

### Description
Initializes a new instance of the `VpcCniAddon` component, which manages the Amazon VPC CNI plugin for Kubernetes.

### Signature
```typescript
constructor(name: string, args: VpcCniAddonArgs, opts?: pulumi.ComponentResourceOptions)
```

### Parameters
#### Parameters
- **name** (string) - Required - The unique name of the VpcCniAddon resource.
- **args** (VpcCniAddonArgs) - Required - Configuration arguments for the VPC CNI add-on. The `clusterName` property is required.
- **opts** (pulumi.ComponentResourceOptions) - Optional - Additional resource options controlling behavior and dependencies.

### Configuration Arguments (VpcCniAddonArgs)
#### Required Arguments
- **clusterName** (string) - Required - The name of the EKS cluster.

#### Add-on Configuration
- **addonVersion** (string) - Optional - The version of the EKS VPC CNI add-on. If not specified, uses the latest version compatible with the cluster's Kubernetes version.
- **clusterVersion** (string) - Optional - The Kubernetes version of the cluster. Used to determine the addon version if `addonVersion` is not specified.
- **resolveConflictsOnCreate** (string) - Optional - How to resolve field value conflicts when migrating from a self-managed CNI to the managed add-on. Valid values: `NONE`, `OVERWRITE`. Defaults to `OVERWRITE`.
- **resolveConflictsOnUpdate** (string) - Optional - How to resolve field value conflicts during add-on updates. Valid values: `NONE`, `OVERWRITE`, `PRESERVE`. Defaults to `OVERWRITE`.
- **tags** ({[key: string]: string}) - Optional - AWS tags to apply to the VPC CNI add-on resource. Defaults to `{}`.

#### Networking Configuration
- **customNetworkConfig** (boolean) - Optional - Whether to use custom network configuration. When enabled, pods can be launched on nodes without an associated secondary IP address. Defaults to `false`.
- **cniCustomNetworkCfg** (boolean) - Optional - Deprecated alias for `customNetworkConfig`. Use `customNetworkConfig` instead. Defaults to `false`.
- **nodePortSupport** (boolean) - Optional - Whether to enable support for NodePort services. Defaults to `true`.
- **externalSnat** (boolean) - Optional - Whether to apply source NAT (SNAT) to outbound traffic from pods. When true, the node's security group will be used for pod traffic. Defaults to `false`.
- **cniExternalSnat** (boolean) - Optional - Deprecated alias for `externalSnat`. Use `externalSnat` instead. Defaults to `false`.

#### Advanced Networking Features
- **enablePrefixDelegation** (boolean) - Optional - Whether to enable prefix delegation for IP address allocation. Improves pod launch performance by allocating multiple IPs to nodes at once. Defaults to `true`.
- **enablePodEni** (boolean) - Optional - Whether to enable support for Pod ENI (Elastic Network Interface). Allows pods to have their own network interfaces and security groups. Defaults to `false`.
- **warmIpTarget** (number) - Optional - The target number of IP addresses to keep available for pod assignment on each node. Defaults to `5`.
- **warmPrefixTarget** (number) - Optional - The target number of IP address prefixes (when prefix delegation is enabled) to keep available on each node. Defaults to `1`.
- **enableNetworkPolicy** (boolean) - Optional - Whether to enable support for Kubernetes NetworkPolicy resources. Defaults to `false`.

#### MTU and Physical Configuration
- **eniMtu** (number) - Optional - The MTU (Maximum Transmission Unit) size for the ENI. Valid range: 576-9001. Use 1500 for standard networks, 9001 for jumbo frames. Defaults to `9001`.
- **vethPrefix** (string) - Optional - The prefix for veth interfaces created for pods. Defaults to `eth`.
- **eniConfigLabelDef** (string) - Optional - The Kubernetes label used to identify the ENI configuration for nodes. Defaults to `k8s.amazonaws.com/eniConfig`.

#### Filtering and RPFilter Configuration
- **cniConfigureRpfilter** (boolean) - Optional - Whether to configure rp_filter for the primary interface. Helps prevent reverse-path filtering issues in certain network configurations. Defaults to `false`.
```

--------------------------------

### Addon Constructor

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/addon.md

Initializes a new instance of the Addon component. Requires a name, AddonArgs for configuration, and optional component resource options.

```typescript
constructor(name: string, args: AddonArgs, opts?: pulumi.ComponentResourceOptions)
```

--------------------------------

### Create a Basic EKS Cluster

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/README.md

Creates a default EKS cluster with minimal configuration. Exports the kubeconfig for cluster access.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";

// Create an EKS cluster with default configuration
const cluster = new eks.Cluster("my-cluster", {});

// Export the kubeconfig for cluster access
export const kubeconfig = cluster.kubeconfig;
```

--------------------------------

### Provider Methods

Source: https://github.com/pulumi/pulumi-eks/blob/master/_autodocs/api-reference/INDEX.md

Details the constructor for the EKS Provider.

```APIDOC
## Provider Methods

### Constructor

- **Constructor** — `new Provider(name, args?, opts?)
```

--------------------------------

### EKS Cluster with Managed Node Group

Source: https://github.com/pulumi/pulumi-eks/blob/master/provider/cmd/pulumi-gen-eks/docs/managedNodeGroup.md

Provisions an EKS cluster and a managed node group with necessary IAM roles and policies. This example sets up a VPC, an EKS cluster, an IAM role for worker nodes, and attaches essential IAM policies for EKS worker nodes, CNI, and container registry access. Finally, it creates a managed node group associated with the cluster and the IAM role.

```java
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.awsx.ec2.Vpc;
import com.pulumi.awsx.ec2.VpcArgs;
import com.pulumi.eks.Cluster;
import com.pulumi.eks.ClusterArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.RolePolicyAttachment;
import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
import com.pulumi.eks.ManagedNodeGroup;
import com.pulumi.eks.ManagedNodeGroupArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    } 

    public static void stack(Context ctx) {
        var eksVpc = new Vpc("eksVpc", VpcArgs.builder()
            .enableDnsHostnames(true)
            .cidrBlock("10.0.0.0/16")
            .build());

        var eksCluster = new Cluster("eksCluster", ClusterArgs.builder()
            .vpcId(eksVpc.vpcId())
            .authenticationMode("API")
            .publicSubnetIds(eksVpc.publicSubnetIds())
            .privateSubnetIds(eksVpc.privateSubnetIds())
            .skipDefaultNodeGroup(true)
            .build());

        var nodeRole = new Role("nodeRole", RoleArgs.builder()
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", "sts:AssumeRole"),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Sid", ""),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "ec2.amazonaws.com")
                        ))
                    )))
                )))
            .build());

        var workerNodePolicy = new RolePolicyAttachment("workerNodePolicy", RolePolicyAttachmentArgs.builder()
            .role(nodeRole.name())
            .policyArn("arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy")
            .build());

        var cniPolicy = new RolePolicyAttachment("cniPolicy", RolePolicyAttachmentArgs.builder()
            .role(nodeRole.name())
            .policyArn("arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy")
            .build());

        var registryPolicy = new RolePolicyAttachment("registryPolicy", RolePolicyAttachmentArgs.builder()
            .role(nodeRole.name())
            .policyArn("arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly")
            .build());

        var nodeGroup = new ManagedNodeGroup("nodeGroup", ManagedNodeGroupArgs.builder()
            .cluster(eksCluster)
            .nodeRole(nodeRole)
            .build());
    }
}

```

--------------------------------

### Link Local EKS SDK Build

Source: https://github.com/pulumi/pulumi-eks/blob/master/CONTRIBUTING.md

Links a locally built version of the @pulumi/eks package into your Pulumi program's node_modules. This is done after building the SDK using 'make install_nodejs_sdk'.

```bash
$ yarn link @pulumi/eks
```