What is EKS and how do you interact with it via the CLI

Crisp answer: EKS (Elastic Kubernetes Service) manages the Kubernetes control plane as a service. You interact with it using standard kubectl plus the AWS CLI and eksctl for cluster management operations.

Setting up kubeconfig:

# Add or update the kubeconfig for an EKS cluster
aws eks update-kubeconfig \
  --name my-cluster \
  --region eu-west-2

# For a specific profile or role:
aws eks update-kubeconfig \
  --name my-cluster \
  --region eu-west-2 \
  --role-arn arn:aws:iam::123456789:role/EKSAdminRole

# Verify context
kubectl config current-context
kubectl config get-contexts
kubectl get nodes

Cluster management:

# List clusters
aws eks list-clusters --region eu-west-2

# Describe cluster (endpoint, version, VPC, subnets, SGs)
aws eks describe-cluster --name my-cluster --region eu-west-2

# Check cluster version
aws eks describe-cluster --name my-cluster --query cluster.version --output text

# Upgrade cluster version
aws eks update-cluster-version \
  --name my-cluster \
  --kubernetes-version 1.30 \
  --region eu-west-2

# Check upgrade status
aws eks describe-update --name my-cluster --update-id <update-id>

Node groups:

# List node groups
aws eks list-nodegroups --cluster-name my-cluster

# Describe a node group
aws eks describe-nodegroup \
  --cluster-name my-cluster \
  --nodegroup-name workers

# Update node group (trigger rolling node replacement)
aws eks update-nodegroup-version \
  --cluster-name my-cluster \
  --nodegroup-name workers \
  --kubernetes-version 1.30

# Scale a node group
aws eks update-nodegroup-config \
  --cluster-name my-cluster \
  --nodegroup-name workers \
  --scaling-config minSize=2,maxSize=10,desiredSize=4

Add-ons:

# List available add-ons and their versions
aws eks describe-addon-versions --kubernetes-version 1.30 --region eu-west-2

# List installed add-ons
aws eks list-addons --cluster-name my-cluster

# Install an add-on
aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name coredns \
  --addon-version v1.11.1-eksbuild.4

# Update an add-on
aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name vpc-cni \
  --addon-version v1.18.1-eksbuild.1

# Check add-on status
aws eks describe-addon \
  --cluster-name my-cluster \
  --addon-name coredns

IRSA setup:

# Create OIDC provider for the cluster (required for IRSA)
eksctl utils associate-iam-oidc-provider \
  --cluster my-cluster \
  --approve

# Get the OIDC provider URL
aws eks describe-cluster \
  --name my-cluster \
  --query "cluster.identity.oidc.issuer" \
  --output text

Access entries (EKS access management):

# Grant IAM role access to the cluster (replaces aws-auth ConfigMap in EKS 1.29+)
aws eks create-access-entry \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/DevTeamRole

aws eks associate-access-policy \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/DevTeamRole \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy \
  --access-scope type=cluster

What to say in the interview:

"For day-to-day EKS work I use aws eks update-kubeconfig to get the context, then standard kubectl from there. For cluster lifecycle I use the AWS CLI: update-cluster-version to trigger control plane upgrades, update-nodegroup-version to roll the nodes, and list-addons to check add-on versions. The upgrade sequence matters: control plane first, then add-ons, then node groups — each step must be healthy before the next. I also use access entries in newer clusters instead of editing the aws-auth ConfigMap manually, because editing a ConfigMap incorrectly can lock you out of the cluster entirely."