Skip to content
EgyKode
Guided lab

Managing EKS Cluster Add-ons with Helm & IRSA

39 minIntermediate

This creates billable resources. Run it in a dev environment and destroy it when you finish. Set a budget alarm first.

Success criteria

0 of 3

What you are building#

What are EKS Cluster Add-ons and IRSA?#

  • EKS Add-ons: Core system services running inside the EKS cluster required for infrastructure functionality (such as load balancer automation and pod autoscaling).
  • IRSA (IAM Roles for Service Accounts): IAM Roles for Service Accounts allows Kubernetes pods to securely assume AWS IAM roles using OpenID Connect (OIDC) federation. Pods obtain short-lived AWS credentials automatically without embedding AWS access keys inside container environments.
text
                                IRSA OIDC AUTHENTICATION FLOW
                                
  +-----------------------------------------------------------------------------------+
  |  EKS SERVICE ACCOUNT (aws-load-balancer-controller)                               |
  |  Annotation: eks.amazonaws.com/role-arn = arn:aws:iam::123456789:role/lbc-role    |
  +----------------------------------------+------------------------------------------+
                                           |
                                           | Requests OIDC Token
                                           v
  +-----------------------------------------------------------------------------------+
  |  AWS IAM & OIDC PROVIDER                                                          |
  |  Validates ServiceAccount Token -> Issues Short-Lived AWS STS Credentials         |
  +----------------------------------------+------------------------------------------+
                                           |
                                           | Authorizes AWS API Calls
                                           v
  +-----------------------------------------------------------------------------------+
  |  AWS EC2 / Elastic Load Balancing API                                             |
  |  Provisions / Modifies AWS Application Load Balancer                              |
  +-----------------------------------------------------------------------------------+

Steps#

Step 1: Deploy IRSA IAM Role with Terraform#

Terminal
cd 05-Helm-Package-Management/Lab15-Helm-Cluster-Addons/irsa
terraform init
terraform apply -auto-approve

Step 2: Add Official Helm Repositories#

Terminal
helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
helm repo add eks https://aws.github.io/eks-charts
helm repo update

Step 3: Deploy Metrics Server & AWS LBC Add-ons#

Terminal
cd ..
helm upgrade --install metrics-server metrics-server/metrics-server -n kube-system -f releases/metrics-server-values.yaml
helm upgrade --install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system -f releases/aws-load-balancer-controller-values.yaml

Verify it worked#

Terminal
kubectl get pods -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller

Expected Output:

text
NAME                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-7b89c6d4f5-x9z8y   1/1     Running   0          2m
aws-load-balancer-controller-7b89c6d4f5-v1w2u   1/1     Running   0          2m

Clean up#

Run this even if you did not finish. Everything above is destroyable, and an account full of half-built experiments is how a surprise bill starts.

Terminal
helm list -A
helm uninstall <release> -n <namespace>
aws elbv2 describe-load-balancers --query 'LoadBalancers[].LoadBalancerName'
# Unattached EBS volumes are billed per GB-month:
aws ec2 describe-volumes --filters Name=status,Values=available --query 'Volumes[].[VolumeId,Size]' --output table

Cost of this lab: Billable. Cluster add-ons commonly provision real infrastructure — a load balancer, EBS volumes for persistent storage — that outlives helm uninstall if a finalizer fails.

The concept behind it

Ready to try it without help?Do the challenge