EKS Anywhere

# Install eksctl-anywhere CLI
brew install aws/tap/eks-anywhere

# Generate cluster configuration
export CLUSTER_NAME=my-eks-anywhere
export VSPHERE_DATACENTER=dc-01
export VSPHERE_DATASTORE=datastore-01
export VSPHERE_FOLDER=/dc-01/vm/eks-anywhere
export VSPHERE_NETWORK="VM Network"
export VSPHERE_SERVER=vcenter.example.com

eksctl anywhere generate clusterconfig $CLUSTER_NAME \
  --provider vsphere > cluster.yaml

# Review and edit cluster.yaml, then create
export EKSA_VSPHERE_USERNAME='administrator@vsphere.local'
export EKSA_VSPHERE_PASSWORD='my-password'
eksctl anywhere create cluster -f cluster.yaml

# cluster.yaml - minimal vSphere cluster spec
apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: Cluster
metadata:
  name: my-cluster
spec:
  kubernetesVersion: "1.29"
  controlPlaneConfiguration:
    count: 3
    machineGroupRef:
      kind: VSphereMachineConfig
      name: control-plane
  workerNodeGroupConfigurations:
    - count: 3
      machineGroupRef:
        kind: VSphereMachineConfig
        name: worker-node
  externalEtcdConfiguration:
    count: 3
    machineGroupRef:
      kind: VSphereMachineConfig
      name: etcd
  networking:
    cniConfig:
      cilium: {}
  clusterNetwork:
    pods:
      cidrBlocks: ["192.168.0.0/16"]
    services:
      cidrBlocks: ["10.96.0.0/12"]

# Register EKS Anywhere cluster with EKS Connector
# 1. Register the cluster in AWS
aws eks register-cluster \
  --name my-eks-anywhere-cluster \
  --connector-config roleArn=arn:aws:iam::123:role/AmazonEKSConnectorAgentRole,provider=EKS_ANYWHERE

# 2. Apply the connector manifest to the cluster
# Download and apply agent manifest generated by the register command
kubectl apply -f eks-connector.yaml
kubectl apply -f eks-connector-binding.yaml

# Configure registry mirror in cluster.yaml for airgapped deployment
apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: Cluster
metadata:
  name: airgapped-cluster
spec:
  # ... other spec fields
  registryMirrorConfiguration:
    endpoint: harbor.internal.example.com:443
    port: "443"
    caCertContent: |
      -----BEGIN CERTIFICATE-----
      ... your CA cert ...
      -----END CERTIFICATE-----
    authenticate: true
    mirrorNamespaces:
      - public.ecr.aws