Skip to content

EKS Add-on Management

EKS logo

Amazon EKS supports curated add-on packages to provide core operational capabilities — such as pod networking (vpc-cni), DNS resolution (coredns), proxying (kube-proxy), storage (aws-ebs-csi-driver), and security (eks-pod-identity-agent).

While some add-ons install automatically during cluster bootstrap, AWS does not automatically upgrade them when you upgrade your Kubernetes version. This guide outlines how to discover versions, inspect configuration schemas, and manage add-on lifecycles via CLI and Terraform.

Add-on Discovery & Version Compatibility

1. List all available add-ons for a Kubernetes version

export VERSION="1.36"
aws eks describe-addon-versions \
  --kubernetes-version $VERSION \
  --query 'sort_by(addons, &addonName)[].{Addon: addonName, Type: type, Publisher: owner}' \
  --output table

2. List AWS-managed add-ons and their latest versions

export VERSION="1.36"
aws eks describe-addon-versions \
  --kubernetes-version $VERSION \
  --owner aws \
  --query 'sort_by(addons, &addonName)[].{Addon: addonName, LatestVersion: addonVersions[0].addonVersion, DefaultVersion: addonVersions[0].compatibilities[0].defaultVersion}' \
  --output table

3. Check all compatible versions for a specific add-on

export VERSION="1.36"
aws eks describe-addon-versions \
  --kubernetes-version $VERSION \
  --addon-name vpc-cni \
  --query 'addons[0].addonVersions[].addonVersion' \
  --output json

Add-on Configuration Schemas

Many add-ons support custom environment variables, resource limits, and feature toggles. You can retrieve the complete configuration JSON/YAML schema directly from AWS.

# Retrieve configuration schema for a specific add-on version
aws eks describe-addon-configuration \
  --addon-name vpc-cni \
  --addon-version v1.19.0-eksbuild.1 \
  --profile $PROFILE \
  --output yaml

Managing Add-ons on Your Cluster

List installed add-ons

aws eks list-addons \
  --cluster-name $CLUSTERNAME \
  --profile $PROFILE

Inspect add-on health and active configuration

aws eks describe-addon \
  --cluster-name $CLUSTERNAME \
  --addon-name vpc-cni \
  --profile $PROFILE

Install an add-on via AWS CLI

aws eks create-addon \
  --cluster-name $CLUSTERNAME \
  --addon-name aws-ebs-csi-driver \
  --addon-version v1.38.0-eksbuild.1 \
  --resolve-conflicts OVERWRITE \
  --profile $PROFILE

Update an existing add-on

aws eks update-addon \
  --cluster-name $CLUSTERNAME \
  --addon-name vpc-cni \
  --addon-version v1.19.0-eksbuild.1 \
  --resolve-conflicts OVERWRITE \
  --profile $PROFILE

Managing Add-ons with Terraform

Managing add-ons via Terraform provides declarative version control, custom JSON-encoded configurations, and automated IAM role association using EKS Pod Identity.

Example: VPC-CNI with Prefix Delegation & Network Policies

resource "aws_eks_addon" "vpc_cni" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "vpc-cni"
  addon_version               = "v1.19.0-eksbuild.1"
  resolve_conflicts_on_create = "OVERWRITE"
  resolve_conflicts_on_update = "OVERWRITE"

  configuration_values = jsonencode({
    env = {
      ENABLE_PREFIX_DELEGATION          = "true"
      WARM_PREFIX_TARGET                = "1"
      ENABLE_POD_ENI                    = "true"
      POD_SECURITY_GROUP_ENFORCING_MODE = "standard"
    }
    enableNetworkPolicy = "true"
  })

  tags = {
    "k8s-addon" = "vpc-cni"
    "ManagedBy" = "Terraform"
  }
}

Example: EKS Pod Identity Agent

resource "aws_eks_addon" "pod_identity_agent" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "eks-pod-identity-agent"
  addon_version               = "v1.3.4-eksbuild.1"
  resolve_conflicts_on_create = "OVERWRITE"
  resolve_conflicts_on_update = "OVERWRITE"
}

Example: EBS CSI Driver with Custom StorageClass

resource "aws_eks_addon" "aws_ebs_csi_driver" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "aws-ebs-csi-driver"
  addon_version               = "v1.38.0-eksbuild.1"
  resolve_conflicts_on_create = "OVERWRITE"
  resolve_conflicts_on_update = "OVERWRITE"
  service_account_role_arn    = aws_iam_role.ebs_csi_driver.arn
}

Conflict Resolution Strategies

When updating add-on versions or reconciling drift between Terraform and running DaemonSets, setting resolve_conflicts_on_update = "OVERWRITE" ensures Terraform successfully reapplies the declared configuration values without getting blocked by Kubernetes server-side apply conflicts.