EKS Cheat Sheet & Troubleshooting Reference

A curated reference of essential aws-cli and kubectl commands for administering Amazon EKS clusters, troubleshooting Karpenter v1 autoscaling, diagnosing VPC CNI networking, managing Pod Identity, and debugging workloads.

---

🔑 Authentication & Kubeconfig

Update local Kubeconfig

# Update kubeconfig with a specific AWS profile and region
aws eks update-kubeconfig \
  --profile $PROFILE \
  --region eu-west-1 \
  --name $CLUSTERNAME

# Verify cluster connectivity
kubectl cluster-info
kubectl auth can-i '*' '*' --all-namespaces

Inspect current caller identity and EKS token

# View active AWS identity
aws sts get-caller-identity --profile $PROFILE

# Generate and inspect EKS Bearer Token
aws eks get-token --cluster-name $CLUSTERNAME --profile $PROFILE

---

🧩 EKS Add-on Management

# List add-ons installed on the cluster
aws eks list-addons --cluster-name $CLUSTERNAME --profile $PROFILE

# Describe a specific installed add-on and its health status
aws eks describe-addon \
  --cluster-name $CLUSTERNAME \
  --addon-name vpc-cni \
  --profile $PROFILE

# Get the latest version for a specific add-on for a Kubernetes version
aws eks describe-addon-versions \
  --kubernetes-version 1.31 \
  --addon-name vpc-cni \
  --query 'sort_by(addons, &addonName)[].{Name: addonName, Version: addonVersions[0].addonVersion}' \
  --output table

# List all available AWS add-on versions
aws eks describe-addon-versions \
  --kubernetes-version 1.31 \
  --owner aws \
  --query 'sort_by(addons, &addonName)[].{Name: addonName, Latest: addonVersions[0].addonVersion, Default: addonVersions[0].compatibilities[0].defaultVersion}' \
  --output table

# Inspect configurable schema options for an add-on
aws eks describe-addon-configuration \
  --addon-name vpc-cni \
  --addon-version v1.19.0-eksbuild.1 \
  --profile $PROFILE \
  --output yaml

---

⚡ Karpenter v1 Autoscaling & Node Operations

Karpenter v1 Resource Inspection

# List all Karpenter NodePools and EC2NodeClasses
kubectl get nodepool,nodeclass,nodeclaim -A

# Inspect active NodeClaims and their instance types / zones / capacity types
kubectl get nodeclaims -o wide

# Describe a specific NodePool configuration
kubectl describe nodepool primary-nodepool

# View live Karpenter controller logs
kubectl logs -f -n karpenter -l app.kubernetes.io/name=karpenter -c controller

Node Diagnostics & Taints

# View all nodes with instance type, zone, architecture, and capacity type
kubectl get nodes -L node.kubernetes.io/instance-type,topology.kubernetes.io/zone,karpenter.sh/capacity-type,kubernetes.io/arch

# Check resource allocation and capacity on all nodes
kubectl top nodes

# Describe taints and labels on a specific node
kubectl get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

# Drain a node safely for maintenance
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

---

🔐 IAM & EKS Pod Identity

# List Pod Identity associations on the cluster
aws eks list-pod-identity-associations \
  --cluster-name $CLUSTERNAME \
  --profile $PROFILE

# Describe a specific Pod Identity association
aws eks describe-pod-identity-association \
  --cluster-name $CLUSTERNAME \
  --association-id <association-id> \
  --profile $PROFILE

# List IAM ServiceAccounts (eksctl / legacy IRSA)
eksctl get iamserviceaccount --cluster $CLUSTERNAME --profile $PROFILE

# Verify environment variables injected by Pod Identity in a pod
kubectl exec -it <pod-name> -n <namespace> -- env | grep AWS_CONTAINER

---

🌐 VPC CNI & Network Diagnostics

# Check VPC CNI DaemonSet pods
kubectl get pods -n kube-system -l k8s-app=aws-node -o wide

# Check ENIConfigs in the cluster (when using custom networking / secondary CIDRs)
kubectl get eniconfigs

# Check IP allocations on a specific node
kubectl describe daemonset aws-node -n kube-system

# Check AWS CNI logs on a specific worker node
kubectl exec -it -n kube-system daemonset/aws-node -c aws-node -- /app/aws-cni-support.sh

---

⚖️ AWS Load Balancer Controller & TargetGroupBindings

# Check AWS Load Balancer Controller logs
kubectl logs -f -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller

# List TargetGroupBindings created by the controller
kubectl get targetgroupbindings -A

# Describe a TargetGroupBinding to verify healthy pod IP registrations
kubectl describe targetgroupbinding <tgb-name> -n <namespace>

# List Ingress and Gateway API resources
kubectl get ingress,gateway,httproute -A

---

📦 ECR Public & Private Registry Authentication

ECR Public Registry (for Helm charts like Karpenter / ACK)

# Log in to ECR Public gallery
aws ecr-public get-login-password --region us-east-1 \
  | helm registry login --username AWS --password-stdin public.ecr.aws

ECR Private Registry

# Log in to private ECR repository with Docker / Podman
aws ecr get-login-password --region eu-west-1 \
  | docker login --username AWS --password-stdin <aws-account-id>.dkr.ecr.eu-west-1.amazonaws.com

---

🧹 Quick Cluster Cleanup & Pod Debugging

# Find pods stuck in Pending or CrashLoopBackOff across all namespaces
kubectl get pods -A --field-selector status.phase!=Running,status.phase!=Succeeded

# Find events related to scheduling failures (e.g. Insufficient cpu/memory)
kubectl get events -A --sort-by='.lastTimestamp' | grep -iE "failed|failedscheduling|warning"

# Force delete a stuck terminating pod
kubectl delete pod <pod-name> -n <namespace> --grace-period=0 --force