Create a cluster

Create a production EKS cluster called eks-prod in us-west-2 with an On-Demand system group and a Spot platform group.

Ask Nova

Rather not read it all? Ask Nova this. It walks you through each step and does the ones it can when you approve.

Create a production-grade Kubernetes cluster in your own cloud account and let AstroPulse run it: Amazon EKS on AWS, Google Kubernetes Engine on Google Cloud, or Azure Kubernetes Service on Azure. The console walks you through it, and a dry run checks the whole cluster against your account before anything is created. You pay your cloud for the cluster directly.

The example creates eks-prod on Amazon EKS with a small On-Demand system group and a Spot platform group. Google Cloud and Azure take the same steps; their pages say what differs: EKS, GKE, AKS.

Before you start

• A cloud account you can approve a connection in: an AWS account, a Google Cloud project, or an Azure subscription with a resource group. The Connect step gives you the exact steps.
• Room in that account's quotas for the machines you pick.
• Already run a cluster? Register it instead.

In the console

Open Infrastructure › Kubernetes › New cluster. Each step ends with Continue to …; the next step opens once this one is complete. The wizard keeps your draft if you reload, and Manifest beside the steps shows the file it is building.

1. Name and cloud. Choose Bring your own account. Enter Cluster Name eks-prod (your cluster's name, in AstroPulse and in your cloud), pick Amazon Web Services under Cloud, and pick the Region us-west-2 (the AWS region the cluster runs in; pick one near your users that offers the machines you need). Availability Zones lists the region's zones and which ones node groups use unless you pick zones for a group.

   Open zoom view

   The Name and cloud step with eks-prod on Amazon Web Services in us-west-2

   

2. Account. Under How Kubernetes runs, pick Amazon EKS. Self-hosted Kubernetes builds Kubernetes on virtual machines instead (Self-hosted Kubernetes). Under Your cloud account, enter the 12-digit Account ID (aws sts get-caller-identity prints it), or pick an account listed after Connected:.

   Open zoom view

   The Account step with Amazon EKS and an AWS account ID

   

3. Connect. Select Connect this account. A new tab opens your cloud's setup page: on AWS, a pre-filled CloudFormation stack to create. The step reads "Waiting for the setup to finish in Amazon Web Services" and moves on by itself once AstroPulse can reach the account. An account already connected for this cluster reads "Already connected to Amazon Web Services."; Check again checks it again.

   Open zoom view

   The Connect step showing the account already connected

   

   

   How do I connect AWS account 123456789012 for eks-prod in us-west-2?

   Ask Nova

   Nova gives you the setup commands for your cloud. You run them; Nova does not connect the account itself.

4. Kubernetes. Keep AstroPulse default for Kubernetes Version and Managed node groups for Compute Mode. Auto Mode lets AWS add and remove machines and skips the Node groups step. Keep Amazon Linux 2023 (Recommended) as the AMI Family, and add Tags for your AWS resources if you want them.

   Open zoom view

   The Kubernetes step with the default version, managed node groups and the AMI family

   

   GPU node groups need 1.36 or newer

   If you pick a version, GPU node groups need Kubernetes 1.36 or newer. astroctl cloud aws k8s-versions lists what EKS offers in your region.

5. Network. Leave Use Existing VPC off: "A new VPC will be created with production-ready defaults." Turn it on to use your own VPC and subnets (Bring your own VPC).

   Open zoom view

   The Network step creating a new VPC

   

   Private nodes

   The new VPC has a public and a private subnet in each of three zones. Nodes run in the private subnets and reach the internet through a NAT gateway; load balancers use the public ones.

6. Node groups. Select Add Node Group twice. Under Compute, keep Pick machine types and select Choose machines to pin machines from the catalog, or pick Request GPU hardware to name a GPU and let AstroPulse resolve the machines.

   • system (a name for your own node group): machine type m6i.large, Nodes 1, Pricing On-Demand.
   • platform: machine types m6i.large, m5.large, m6a.large and m7i.large, Nodes 2, Pricing Spot, much cheaper, though AWS can take a node back at short notice. Several machine types give Spot more places to find capacity.
   • Leave both on All 3 zones, so each can place nodes in the region's first three zones.

   Open zoom view

   The Node groups step with two groups: system with m6i.large, 1 node, On-Demand; and platform with m6i.large, m5.large, m6a.large and m7i.large, 2 nodes, Spot; both on All 3 zones

   

   Why two groups

   AstroPulse's system pods, its agent and the add-on controllers, stay on the On-Demand system group, so one Spot reclaim cannot stop them all. With only Spot groups, the dry run on Review warns System pods run only on Spot nodes and asks for an On-Demand group with at least 1 node.

   The warning an all-Spot cluster gets.Open zoom view

   The warning an all-Spot cluster gets.

   

   What it costs

   Estimated cost, beside the steps, adds up each node group per month and the cloud's charges outside the nodes, such as the control plane and the NAT gateways, with how each was priced. Charges billed by traffic, such as data transfer, may read Not metered. Storage is not included.

7. Notifications. Optional. Tick Email or Slack (Enterprise) to get cluster updates: creation progress and status changes, for every cluster in the organization. Owners also get approval requests this way. Nothing is saved until you create the cluster.

   Open zoom view

   The Notifications step with Email and Slack, and what cluster updates cover

   

8. Review. The dry run starts by itself and checks the whole cluster against your account. You should see: Dry run passed, with All checks listed under it. A failed check says why and how to fix it. Manifest shows the file, and Create with astroctl has the same file to download.

   Open zoom view

   The Review step with the dry run passed and its checks

   

   

   Why did the dry run for eks-prod fail, and how do I fix it?

   Ask Nova

   Nova reads the dry run's findings and explains each one with its fix.

9. Create. Select Create eks-prod. The console says "Cluster requested"; select Open the cluster to follow it. The page shows each stage as it is provisioned and reads Ready and Connected once it is up.

   Open zoom view

   The eks-prod cluster page with Ready and Connected, three nodes and the agent reporting

   

   

   Create eks-prod in us-west-2 with an On-Demand system group of one m6i.large and a Spot platform group of two nodes.

   Ask Nova

   Nova fills in the spec, checks it with the dry run, shows the plan, and creates the cluster when you approve.

You should see

The cluster's page, eks-prod, reads Ready. Node groups lists system and platform with the nodes you asked for, and Events shows every step of the create. If it stops, Events says why.

Open zoom view

The Node groups tab listing two groups: system with m6i.large, On-Demand, 1 node; platform with m6i.large, m5.large, m6a.large, m7i.large, Spot, 2 nodes

Open zoom view

The Events tab with no unresolved creation failure

What the dry run checks

The dry run runs the same checks as the create, against your account, and changes nothing: the account connection, quotas, the machine types in each zone the nodes use, the network, and the Kubernetes version. A GPU node group shows the machines AstroPulse chose for it under Machines AstroPulse chose. Change anything and Review runs the dry run again on the new manifest; Continue to create opens once it passes.

What you choose later

Add-ons are not part of the create; install them once the cluster is ready (Next). Node groups, the Kubernetes version and tags change from the cluster's Update tab: Update and upgrade.

Other ways in

• SDK and API: the same manifest. See the API reference.

With astroctl

Connect the account for the cluster first, then apply the manifest. Review shows the same manifest under Create with astroctl, ready to download. To start from the template instead:

Terminal

astroctl cloud aws connect --account-id 123456789012 --region us-west-2 --cluster-name eks-prod
astroctl infra k8s template eks > eks-prod.yaml
astroctl infra k8s apply -f eks-prod.yaml --dry-run
astroctl infra k8s apply -f eks-prod.yaml

123456789012 stands for your AWS account ID. The template is annotated; --schema on it lists every field. For Google Cloud and Azure, use astroctl cloud gcp connect or astroctl cloud azure connect and astroctl infra k8s template gke or aks. Every flag: astroctl infra k8s apply and astroctl cloud aws connect.

Settings

The settings every cloud shares. Each cloud's own settings are on its page.

Cluster Namespec.clusterNameRequired

The cluster's name in AstroPulse and in your cloud.

Accepts

Lowercase letters, numbers and -, starting and ending with a letter or number, up to 50 characters.

Cloudspec.providerRequired

The cloud the cluster runs in.

Accepts

• aws Amazon Web Services Amazon's cloud.
• azure Microsoft Azure Microsoft's cloud.
• gcp Google Cloud Google's cloud.

Regionspec.regionRequired

Where the cluster runs.

See

astroctl cloud <aws|gcp|azure> regions list

How Kubernetes runsspec.provisioner.typeRequired

Who runs the control plane. selfHosted runs on AWS and Google Cloud.

Accepts

• selfHosted Self-hosted A cluster AstroPulse creates and runs on machines in your cloud account.
• eks Amazon EKS A cluster AstroPulse creates on Amazon Elastic Kubernetes Service.
• gke GKE A cluster AstroPulse creates on Google Kubernetes Engine.
• aks AKS A cluster AstroPulse creates on Azure Kubernetes Service.

Node groupsspec.clusterSpec.dataPlane.nodeGroups

The machines workloads run on: each group's name, machines or GPU, node count and pricing. Left out on EKS Auto Mode and GKE Autopilot, where the cloud runs the nodes.

See

GPU node groups

If it's refused

"Use lowercase letters, numbers and '-', starting and ending with a letter or number"

Cause

The cluster name has another character, or starts or ends with -.

Fix

Change the Cluster Name, for example eks-prod.

"The field 'accountId' has invalid value '12345'. It should be an AWS account id, which is 12 digits"

Cause

The account ID is not a 12-digit AWS account ID.

Fix

Copy it from aws sts get-caller-identity, without spaces or dashes.

"No connection found for cluster eks-prod in AWS account 123456789012, region us-west-2: connect the account, then try again."

Cause

The account is not connected for this cluster name and region. A connection belongs to one cluster.

Fix

Go back to the Connect step and select Connect this account, or run astroctl cloud aws connect with the same cluster name and region.

"The account refused AstroPulse's access while checking it."

Cause

The dry run could not use the connection: the setup stack was removed, did not finish, or is out of date.

Fix

Connect the account again from the Connect step, then run the dry run again.

Clean up

A cluster keeps costing until you delete it. An org Owner opens it under Infrastructure › Kubernetes, selects Delete, waits for the Delete Cluster dialog's dry run to pass, types the cluster name, then selects Delete Permanently. This uninstalls every add-on first. What the delete keeps in your account: Delete a cluster.

What would deleting eks-prod remove?

Ask Nova

Nova shows the delete's dry run and gives you the command to run. It never deletes a cluster itself.

Next

A production cluster usually gets these add-ons next, from its Add-ons tab (Install add-ons):

• Ingress: one load balancer that routes traffic to your applications.
• Certificates: TLS certificates that renew on their own.
• DNS Automation: DNS records for your hostnames.
• Vulnerability Scanning: scans the images running on the cluster for known vulnerabilities.
• Cost Visibility: what each namespace, application and node group costs.

Install Ingress on eks-prod.

Ask Nova

Nova shows the add-on's dry run and installs it when you approve.

Then deploy an application, or compare clouds: EKS, GKE, AKS or self-hosted.