Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Working with capability resources

This topic describes common operations for managing capability resources across all capability types.

EKS capability resources

EKS capabilities are AWS resources that enable managed functionality on your Amazon EKS cluster. Capabilities run in EKS, eliminating the need to install and maintain controllers and other operational components on your worker nodes. Capabilities are created for a specific EKS cluster, and remain affiliated with that cluster for their entire lifecycle.

Each capability resource has:

Understanding capability status

Capability resources have a status that indicates their current state. You can view capability status and health in the EKS console or using the AWS CLI.

Console:

AWS CLI:

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-capability-name

Capability statuses

CREATING: Capability is being set up. You can navigate away from the console—the capability will continue creating in the background.

ACTIVE: Capability is running and ready to use. If resources aren’t working as expected, check resource status and IAM permissions. See Troubleshooting EKS Capabilities for guidance.

UPDATING: Configuration changes are being applied. Wait for the status to return to ACTIVE.

DELETING: Capability is being removed from the cluster.

CREATE_FAILED: Setup encountered an error. Common causes include:

Check the capability health section for specific error details.

UPDATE_FAILED: Configuration update failed. Check the capability health section for details and verify IAM permissions.

Create capabilities

To create a capability on your cluster, see the following topics:

List capabilities

You can list all capability resources on a cluster.

Console

AWS CLI

Use the list-capabilities command to view all capabilities on your cluster. Replace region-code with the AWS Region that your cluster is in and replace my-cluster with the name of your cluster.

aws eks list-capabilities \
  --region region-code \
  --cluster-name my-cluster
         

{
    "capabilities": [
        {
            "capabilityName": "my-ack",
            "arn": "arn:aws:eks:us-west-2:111122223333:capability/my-cluster/ack/my-ack/abc123",
            "type": "ACK",
            "status": "ACTIVE",
            "createdAt": "2025-11-02T10:30:00.000000-07:00",
            "modifiedAt": "2025-11-02T10:32:15.000000-07:00",
        },
        {
            "capabilityName": "my-kro",
            "arn": "arn:aws:eks:us-west-2:111122223333:capability/my-cluster/kro/my-kro/abc123",
            "type": "KRO",
            "status": "ACTIVE",
            "version": "v0.6.3",
            "createdAt": "2025-11-02T10:30:00.000000-07:00",
            "modifiedAt": "2025-11-02T10:32:15.000000-07:00",
        },
        {
            "capabilityName": "my-argocd",
            "arn": "arn:aws:eks:us-west-2:111122223333:capability/my-cluster/argocd/my-argocd/abc123",
            "type": "ARGOCD",
            "status": "ACTIVE",
            "version": "3.1.8-eks-1",
            "createdAt": "2025-11-21T08:22:28.486000-05:00",
            "modifiedAt": "2025-11-21T08:22:28.486000-05:00"
        }
    ]
}

Describe a capability

Get detailed information about a specific capability, including its configuration and status.

Console

AWS CLI

Use the describe-capability command to view detailed information. Replace region-code with the AWS Region that your cluster is in, replace my-cluster with the name of your cluster, and replace capability-name with the capability name (ack, argocd, or kro).

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name capability-name
         

Example output:

{
  "capability": {
    "capabilityName": "my-ack",
    "capabilityArn": "arn:aws:eks:us-west-2:111122223333:capability/my-cluster/ack/my-ack/abc123",
    "clusterName": "my-cluster",
    "type": "ACK",
    "roleArn": "arn:aws:iam::111122223333:role/AmazonEKSCapabilityACKRole",
    "status": "ACTIVE",
    "configuration": {},
    "tags": {},
    "health": {
      "issues": []
    },
    "createdAt": "2025-11-19T17:11:30.242000-05:00",
    "modifiedAt": "2025-11-19T17:11:30.242000-05:00",
    "deletePropagationPolicy": "RETAIN"
  }
}

Update the configuration of a capability

You can update certain aspects of a capability’s configuration after creation. The specific configuration options vary by capability type.

AWS CLI

Use the update-capability command to modify a capability:

aws eks update-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name capability-name \
  --role-arn arn:aws:iam::[.replaceable]111122223333:role/NewCapabilityRole
         

Delete a capability

When you no longer need a capability on your cluster, you can delete the capability resource.

Console

AWS CLI

Use the delete-capability command to delete a capability resource:

Replace region-code with the AWS Region that your cluster is in, replace my-cluster with the name of your cluster, and replace capability-name with the capability name to delete.

aws eks delete-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name capability-name
         

Next steps