Create a kro capability using the Console - Amazon EKS
Create the kro capabilityVerify the capability is activeGrant permissions to manage Kubernetes resourcesVerify custom resources are availableNext steps

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Create a kro capability using the Console

This topic describes how to create a kro (Kube Resource Orchestrator) capability using the AWS Management Console.

Create the kro capability

  1. Open the Amazon EKS console at https://console.aws.amazon.com/eks/home#/clusters.

  2. Select your cluster name to open the cluster detail page.

  3. Choose the Capabilities tab.

  4. In the left navigation, choose kro (Kube Resource Orchestrator).

  5. Choose Create kro capability.

  6. For IAM Capability Role:

    • If you already have an IAM Capability Role, select it from the dropdown

    • If you need to create a role, choose Create kro role

      This opens the IAM console in a new tab with pre-populated trust policy. The role requires no additional IAM permissions since kro operates entirely within your cluster.

      After creating the role, return to the EKS console and the role will be automatically selected.

      Note

      Unlike ACK and Argo CD, kro does not require additional IAM permissions beyond the trust policy. kro operates entirely within your cluster and does not make AWS API calls.

  7. Choose Create.

The capability creation process begins.

Verify the capability is active

  1. On the Capabilities tab, view the kro capability status.

  2. Wait for the status to change from CREATING to ACTIVE.

  3. Once active, the capability is ready to use.

For information about capability statuses and troubleshooting, see Working with capability resources.

Grant permissions to manage Kubernetes resources

By default, kro can only create and manage ResourceGraphDefinitions and their instances. To allow kro to create and manage the underlying Kubernetes resources defined in your ResourceGraphDefinitions, associate the AmazonEKSClusterAdminPolicy access policy with the capability’s access entry.

  1. In the EKS console, navigate to your cluster’s Access tab.

  2. Under Access entries, find the entry for your kro capability role (it will have the role ARN you created earlier).

  3. Choose the access entry to open its details.

  4. In the Access policies section, choose Associate access policy.

  5. Select AmazonEKSClusterAdminPolicy from the policy list.

  6. For Access scope, select Cluster.

  7. Choose Associate.

Important

The AmazonEKSClusterAdminPolicy grants broad permissions to create and manage all Kubernetes resources and is intended to streamline getting started. For production use, create more restrictive RBAC policies that grant only the permissions needed for the specific resources your ResourceGraphDefinitions will manage. For guidance on configuring least-privilege permissions, see Configure kro permissions and Security considerations for EKS Capabilities.

Verify custom resources are available

After the capability is active, verify that kro custom resources are available in your cluster.

Using the console

  1. Navigate to your cluster in the Amazon EKS console

  2. Choose the Resources tab

  3. Choose Extensions

  4. Choose CustomResourceDefinitions

You should see the ResourceGraphDefinition resource type listed.

Using kubectl 

kubectl api-resources | grep kro.run

You should see the ResourceGraphDefinition resource type listed.

Next steps