Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Create a kro capability using eksctl

This topic describes how to create a kro (Kube Resource Orchestrator) capability using eksctl.

Step 1: Create an IAM Capability Role

Create a trust policy file:

cat > kro-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "capabilities.eks.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}
EOF

Create the IAM role:

aws iam create-role \
  --role-name KROCapabilityRole \
  --assume-role-policy-document file://kro-trust-policy.json

Step 2: Create the kro capability

Create the kro capability using eksctl. Replace region-code with the AWS Region that your cluster is in and replace my-cluster with the name of your cluster.

eksctl create capability \
  --region region-code \
  --cluster my-cluster \
  --name my-kro \
  --type KRO \
  --role-arn arn:aws:iam::[.replaceable]111122223333:role/KROCapabilityRole

The command returns immediately, but the capability takes some time to become active.

Step 3: Verify the capability is active

Check the capability status. Replace region-code with the AWS Region that your cluster is in and replace my-cluster with the name of your cluster.

eksctl get capability \
  --region region-code \
  --cluster my-cluster \
  --name my-kro

The capability is ready when the status shows ACTIVE.

Step 4: Grant permissions to manage Kubernetes resources

By default, kro can only create and manage ResourceGraphDefinitions and their instances. To allow kro to create and manage the underlying Kubernetes resources defined in your ResourceGraphDefinitions, associate the AmazonEKSClusterAdminPolicy access policy with the capability’s access entry.

Get the capability role ARN:

CAPABILITY_ROLE_ARN=$(aws eks describe-capability \
  --region region-code \
  --cluster my-cluster \
  --name my-kro \
  --query 'capability.roleArn' \
  --output text)

Associate the cluster admin policy:

aws eks associate-access-policy \
  --region region-code \
  --cluster my-cluster \
  --principal-arn $CAPABILITY_ROLE_ARN \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster

Step 5: Verify custom resources are available

After the capability is active, verify that kro custom resources are available in your cluster:

kubectl api-resources | grep kro.run

You should see the ResourceGraphDefinition resource type listed.

Next steps