Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Create a kro capability using the AWS CLI

This topic describes how to create a kro (Kube Resource Orchestrator) capability using the AWS CLI.

Prerequisites

Step 1: Create an IAM Capability Role

Create a trust policy file:

cat > kro-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "capabilities.eks.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}
EOF

Create the IAM role:

aws iam create-role \
  --role-name KROCapabilityRole \
  --assume-role-policy-document file://kro-trust-policy.json

Step 2: Create the kro capability

Create the kro capability resource on your cluster. Replace region-code with the AWS Region where your cluster is located (such as us-west-2) and my-cluster with your cluster name.

aws eks create-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-kro \
  --type KRO \
  --role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/KROCapabilityRole \
  --delete-propagation-policy RETAIN

The command returns immediately, but the capability takes some time to become active as EKS creates the required capability infrastructure and components. EKS will install the Kubernetes Custom Resource Definitions related to this capability in your cluster as it is being created.

Step 3: Verify the capability is active

Wait for the capability to become active. Replace region-code with the AWS Region that your cluster is in and replace my-cluster with the name of your cluster.

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-kro \
  --query 'capability.status' \
  --output text

The capability is ready when the status shows ACTIVE.

You can also view the full capability details:

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-kro

Step 4: Grant permissions to manage Kubernetes resources

By default, kro can only create and manage ResourceGraphDefinitions and their instances. To allow kro to create and manage the underlying Kubernetes resources defined in your ResourceGraphDefinitions, associate the AmazonEKSClusterAdminPolicy access policy with the capability’s access entry.

Get the capability role ARN:

CAPABILITY_ROLE_ARN=$(aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-kro \
  --query 'capability.roleArn' \
  --output text)

Associate the cluster admin policy:

aws eks associate-access-policy \
  --region region-code \
  --cluster-name my-cluster \
  --principal-arn $CAPABILITY_ROLE_ARN \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster

Step 5: Verify custom resources are available

After the capability is active, verify that kro custom resources are available in your cluster:

kubectl api-resources | grep kro.run

You should see the ResourceGraphDefinition resource type listed.

Next steps