Skip to content

aws-samples/sample-eks-cluster-discovery-tool

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
README.md
README.md
 
 
eks_cluster_audit.sh
eks_cluster_audit.sh
 
 
run_eks_audit.sh
run_eks_audit.sh
 
 

Repository files navigation

EKS Cluster Discovery Script

A comprehensive read-only audit tool that collects Kubernetes cluster state using kubectl. Produces a structured report with 49 sections, table of contents, and JSON summary.

⚠️ Important Note for Production Clusters

This script has been designed with throttling protection and API server safeguards. Output limits have been added to prevent overwhelming the API server when discovering thousands of objects.

This script is not recommended for production clusters. Always test on a non-production cluster first. If you must run on production, do so during non-traffic hours or maintenance windows.

Recommendations:

  • Always run on non-prod first to estimate runtime and validate behavior
  • If running on production, schedule during low-traffic periods or maintenance windows
  • For large clusters, use -L (large cluster mode) and -d (API delay) flags
  • Monitor API server latency during execution

Extra caution for XXL clusters (3000+ nodes, 10,000+ pods): Even with built-in limits, discovering thousands of nodes, pods, namespaces, and other resources generates significant API load. For XXL production clusters, run only during maintenance windows, or use targeted namespace discovery (-n <namespace>) instead of full cluster scans.

While this script only performs read operations, the volume of API calls can still impact API server performance.

What This Script Does

This script performs a full discovery of your EKS cluster, capturing configuration, resource inventory, and operational state across all Kubernetes components. It helps teams understand what's running in the cluster without making any changes.

Use Cases

  • Operations Review: Assess cluster health, identify problematic pods, and review resource utilization before maintenance windows or deployments
  • Platform Engineering: Document cluster architecture, validate configurations, and ensure consistency across environments
  • Infrastructure Assessment: Inventory all workloads, storage, networking, and autoscaling configurations for capacity planning
  • Security Audits: Review RBAC settings, network policies, pod security standards, secrets management, and privileged container usage
  • Incident Response: Quickly capture cluster state during outages for post-incident analysis
  • Compliance: Generate evidence of cluster configuration for audit requirements
  • Knowledge Transfer: Onboard new team members with a complete snapshot of cluster resources
  • Migration Planning: Document existing state before cluster upgrades or migrations

Prerequisites

Required Tools

Tool Purpose Installation
Bash 4.0+ Script runtime (uses associative arrays) See below
kubectl Kubernetes CLI Install guide
jq JSON parsing brew install jq (macOS) / apt-get install jq (Linux)
bc Floating point math Usually pre-installed on Linux
timeout Command timeouts (coreutils) brew install coreutils (macOS)

Bash Version Check

The script requires Bash 4.0+ for associative array support. Check your version:

bash --version

macOS users: The default /bin/bash is version 3.x. Install newer Bash:

# Install via Homebrew
brew install bash

# Run script with newer Bash (no need to change default shell)
/opt/homebrew/bin/bash ./eks_cluster_audit.sh    # Apple Silicon
/usr/local/bin/bash ./eks_cluster_audit.sh       # Intel Mac

Linux users: Most distributions include Bash 4.0+. If not:

# Debian/Ubuntu
sudo apt-get install bash

# RHEL/CentOS
sudo yum install bash

Other Requirements

  • Valid kubeconfig configured (~/.kube/config or KUBECONFIG env var)
  • Network access to the EKS cluster API server
  • RBAC permissions to read cluster resources

Quick Start

# Make executable (first time only)
chmod +x eks_cluster_audit.sh
chmod +x run_eks_audit.sh

# Run with defaults (all namespaces, 24h events, current directory)
./eks_cluster_audit.sh

# Run in background (survives SSH disconnect) - RECOMMENDED FOR LARGE CLUSTERS
./run_eks_audit.sh

# View help
./eks_cluster_audit.sh --help

Command Line Options

Option Description Default
-n, --namespace <ns> Target specific namespace all
-s, --since <duration> Events time window (1h, 24h, 7d) 24h
-o, --output-dir <dir> Output directory current directory
-t, --timeout <seconds> kubectl timeout per command 30
-T, --timeout-large <sec> Extended timeout for large JSON fetches 120
-r, --retries <count> Retry count for transient failures 3
-d, --api-delay <ms> Delay between API calls in milliseconds 100
-L, --large-cluster Enable large cluster mode (namespace-by-namespace) false
-C, --combined-report Generate combined single-file report (warns if >50MB) false
-h, --help Show help message
-v, --version Show version

Examples

# Discover entire cluster
./eks_cluster_audit.sh

# Discover only production namespace
./eks_cluster_audit.sh --namespace production

# Events from last hour, save to /tmp
./eks_cluster_audit.sh --since 1h --output-dir /tmp

# Increase timeout for slow clusters
./eks_cluster_audit.sh --timeout 60

# Large cluster settings (5min timeout for big JSON, 5 retries)
./eks_cluster_audit.sh -T 300 -r 5

# XXL cluster (namespace-by-namespace processing, 200ms API delay)
./eks_cluster_audit.sh -L -d 200 -T 300 -r 5

# Generate combined single-file report (disabled by default)
./eks_cluster_audit.sh -C

# Combined options
./eks_cluster_audit.sh -n kube-system -s 12h -o /var/log/eks-audit -t 45

Running on Large/XXL Clusters

For clusters with many resources where the script may take hours:

Large Cluster Mode (-L)

For XXL clusters with thousands of objects, use large cluster mode to avoid API server overload:

# XXL cluster recommended settings
./eks_cluster_audit.sh -L -d 200 -T 300 -r 5

# What -L does:
# - Processes resources namespace-by-namespace instead of --all-namespaces
# - Reduces memory usage and API server load
# - Prevents timeout on large JSON fetches

1. Use the Wrapper Script (Recommended)

./run_eks_audit.sh                    # Runs in background with nohup
./run_eks_audit.sh -- -T 300 -r 5     # Pass options to audit script
./run_eks_audit.sh -s                 # Check if running
./run_eks_audit.sh -k                 # Stop running audit
tail -f /tmp/eks_audit_*.log          # Watch progress

2. Use screen or tmux

screen -S eks-audit
./eks_cluster_audit.sh -T 300 -r 5
# Detach: Ctrl+A, D
# Reattach: screen -r eks-audit

3. Use nohup Directly

nohup ./eks_cluster_audit.sh -T 300 > /tmp/audit.log 2>&1 &

Wrapper Script Options (run_eks_audit.sh)

Option Description
-f, --foreground Run in foreground (default: background with nohup)
-l, --log <file> Log file path (default: /tmp/eks_audit_TIMESTAMP.log)
-s, --status Check if audit is running
-k, --kill Stop running audit
-h, --help Show help

Output

Creates discovery_output_<YYYYMMDD_HHMMSS>/ directory containing:

00_index.txt           - File listing
00_full_report.txt     - Combined report (only if -C flag used)
01_cluster_info.txt    - Individual section files
...
50_summary_json.txt    - JSON summary

Report includes:

  • Table of Contents for navigation (49 sections)
  • ## SECTION: headers for each resource type
  • Compact kubectl get -o wide output (no raw YAML)
  • Detailed describe only for key/problematic resources
  • ## SUMMARY_JSON section with machine-readable counts and features

Guardrails

The script includes safeguards to prevent runaway execution:

Guardrail Description
Timeouts Standard: 30s, Large JSON: 120s (configurable)
Pod Limits Full listing only if <200 pods; otherwise summary only
Describe Limits Only problematic pods (Pending, CrashLoop, ImagePull, OOMKilled, >5 restarts)
Output Truncation Large lists capped at 50-100 items
Progress Shows [N/49] progress for each section
Retry Logic Transient failures retry up to 3 times (configurable)
Chunked Processing Large resource sets processed in batches
API Throttling Configurable delay between API calls (-d flag)
Large Cluster Mode Namespace-by-namespace processing (-L flag)

Output Limits by Resource Type

Resource Limit Notes
Node instance types 50
Node capacity 50
Node conditions detail 20 Per-node API calls limited
Node system info 50
Node resource allocation 20 Per-node API calls limited
Deployments list 100 Truncated with message
Deployment details 50 items, 500 lines Detailed config view
StatefulSets details 30 items, 300 lines
DaemonSets details 30 items, 300 lines
Pods full list Only if <200 pods Otherwise skipped
Problematic pods 10 per type Pending, CrashLoop, ImagePull, OOM
Top restarters 10 Pods with >5 restarts
Jobs 50
ConfigMaps 100
Secrets 100 Metadata only
Events by reason 20
Warning events 50
PVs/PVCs 50 each
CRDs 100
Webhooks (mutating) 30 Per-webhook API calls limited
Webhooks (validating) 30 Per-webhook API calls limited
kube-system DaemonSets 20 Per-resource describe limited
kube-system Deployments 20 Per-resource describe limited
kube-system Services 20 Per-resource describe limited
ResourceQuotas 20 Per-resource describe limited
LimitRanges 20 Per-resource describe limited
Namespace summary 50 Per-namespace API calls limited
Multi-tenancy namespaces 30 Early break on output
Security namespace check 20 Early break on output
Describe output 60 lines per resource MAX_DESCRIBE_ITEMS=20 total
Logs 50 lines

What's Collected (49 Sections)

Click to expand full section details

1. CLUSTER_INFO

  • Timestamp and scope of discovery
  • Current kubectl context name
  • Cluster API server URL
  • Kubernetes client and server versions
  • Events time window setting

2. NODES

  • Total node count
  • Full node listing with -o wide (IP, OS, kernel, container runtime)
  • Node conditions: Ready, DiskPressure, MemoryPressure status
  • Node allocatable resources: CPU, memory, max pods per node

3. NAMESPACES

  • Total namespace count
  • Complete namespace listing with status and age

4. DEPLOYMENTS

  • Total deployment count
  • Deployment listing with replicas, up-to-date, available counts
  • Detailed per-deployment configuration:
    • Replica count and update strategy (RollingUpdate/Recreate)
    • Container images, resource requests/limits (CPU, memory)
    • Probe configuration: liveness, readiness, startup (yes/no)
    • Environment variable count, envFrom count, volume mount count
    • Service account name

5. STATEFULSETS

  • Total StatefulSet count
  • StatefulSet listing with ready replicas
  • Detailed per-StatefulSet configuration:
    • Replica count and update strategy
    • Service name for headless service
    • Container images and resource requests/limits
    • Probe configuration
    • VolumeClaimTemplate count

6. DAEMONSETS

  • Total DaemonSet count
  • DaemonSet listing with desired/current/ready counts
  • Detailed per-DaemonSet configuration:
    • Update strategy type
    • Node selectors (key=value pairs)
    • Toleration count
    • Container images and resource requests/limits

7. PODS

  • Total pod count
  • Pod status summary (Running, Pending, Failed, Succeeded counts)
  • Issue counts: Pending, Failed, CrashLoopBackOff, ImagePullError, OOMKilled
  • Full pod listing (if <200 pods, otherwise summary only)
  • Detailed describe for problematic pods:
    • Pending pods with events (scheduling failures)
    • CrashLoopBackOff pods with last 30 lines of describe
    • ImagePull error pods with events
    • OOMKilled pods with container restart counts
    • Top restarters (>5 restarts) with per-container restart counts

8. SERVICES

  • Total service count
  • Service type distribution (ClusterIP, LoadBalancer, NodePort, ExternalName counts)
  • Service listing with cluster IP, external IP, ports

9. ENDPOINTS

  • Endpoint and EndpointSlice counts
  • First 50 endpoints with addresses
  • First 50 EndpointSlices

10. INGRESS

  • Total ingress count
  • IngressClass listing
  • Ingress controller detection: NGINX, ALB, Traefik (pod counts)
  • Ingress listing with hosts, paths, backends
  • Key ingress describe (up to 5)

11. HPA

  • Total HPA count
  • HPA listing with min/max/current replicas, targets
  • Key HPA describe with scaling metrics and conditions

12. VPA

  • Total VPA count
  • VPA listing (if installed)
  • Key VPA describe with recommendations:
    • Target CPU/memory recommendations
    • Lower/upper bound recommendations

13. KEDA

  • ScaledObject and TriggerAuthentication counts
  • ScaledObject listing with scale target, triggers
  • Key ScaledObject describe with trigger configuration

14. PDB

  • Total PodDisruptionBudget count
  • PDB listing with min available, max unavailable, allowed disruptions
  • Key PDB describe

15. JOBS

  • Total Job count
  • Job listing (first 50) with completions, duration, status

16. CRONJOBS

  • Total CronJob count
  • CronJob listing with schedule, suspend status, last schedule time

17. CONFIGMAPS

  • Total ConfigMap count
  • ConfigMap listing (first 100) with data key count

18. SECRETS

  • Total Secret count
  • Secret type distribution (kubernetes.io/service-account-token, Opaque, etc.)
  • Secret listing (METADATA ONLY - no values): name, type, creation timestamp
  • First 100 secrets shown

19. EVENTS

  • Total event count within time window
  • Events by reason (top 20): Scheduled, Pulled, Created, FailedScheduling, etc.
  • Warning events (last 50) sorted by timestamp

20. STORAGE

  • StorageClass, PV, PVC counts
  • StorageClass listing with provisioner, reclaim policy, volume binding mode
  • PersistentVolume listing (first 50) with capacity, access modes, status
  • PersistentVolumeClaim listing (first 50) with status, volume, capacity

21. NETWORKPOLICIES

  • Total NetworkPolicy count
  • NetworkPolicy listing
  • Key NetworkPolicy describe (up to 10) with ingress/egress rules

22. RBAC

  • ClusterRole, ClusterRoleBinding counts
  • Role, RoleBinding, ServiceAccount counts

23. CRDS

  • Total CRD count
  • CRDs by API group (top 30)
  • CRD listing with group, version, scope (first 100)
  • CRDs categorized by type:
    • Autoscaling CRDs (scaledobject, vpa)
    • Networking CRDs (gateway, virtualservice, ingress)
    • Security CRDs (policy, certificate, constraint)
    • Storage CRDs (snapshot, backup, volume)
    • GitOps CRDs (application, gitrepository, helmrelease)
    • Observability CRDs (servicemonitor, prometheus, grafana)

24. WEBHOOKS

  • Mutating webhook count and listing:
    • Webhook name, service endpoint, failure policy
    • Side effects, match policy
    • Rules: API groups, resources, operations
    • Namespace selector
  • Validating webhook count and listing (same details)

25. CNI

  • CNI type detection: VPC CNI, Calico, Cilium, Weave, Flannel
  • AWS VPC CNI details (if present):
    • DaemonSet overview and full describe
    • All environment variables
    • Key settings analysis: WARM_ENI_TARGET, WARM_IP_TARGET, MINIMUM_IP_TARGET
    • Prefix delegation status (ENABLE_PREFIX_DELEGATION)
    • Custom networking status (AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG)
    • Security Groups for Pods (ENABLE_POD_ENI, POD_SECURITY_GROUP_ENFORCING_MODE)
    • Network policy controller status
    • IPv6 settings
    • External SNAT settings
    • CNI version
    • ENIConfig resources (for custom networking)
    • VPC Resource Controller deployment
    • SecurityGroupPolicy resources
    • aws-node pod status and recent logs
  • Calico details (if present):
    • Pods, DaemonSet describe
    • IPPools, BGPConfigurations, FelixConfigurations
    • GlobalNetworkPolicies, NetworkPolicies, BGPPeers
  • Cilium details (if present):
    • Pods, DaemonSet describe
    • CiliumNetworkPolicies, CiliumClusterwideNetworkPolicies
    • CiliumEndpoints

26. NETWORKING_ADVANCED

  • kube-proxy mode detection (iptables vs IPVS)
  • kube-proxy DaemonSet describe and ConfigMap
  • AWS Load Balancer Controller:
    • Deployment describe
    • TargetGroupBindings listing
    • IngressClassParams
  • Load Balancer services listing
  • CoreDNS:
    • Deployment describe
    • ConfigMap (Corefile)
    • Pod status
  • IP utilization per node:
    • Allocated IPs vs capacity
    • ENI attachment counts

27. KUBE_SYSTEM_RESOURCES

  • All resources in kube-system namespace:
    • Pods, Deployments, DaemonSets, Services
    • ConfigMaps, Secrets (metadata only)
    • ServiceAccounts
  • Infrastructure namespaces inventory (amazon-cloudwatch, amazon-guardduty, etc.)

28. AUTOSCALING_INFRA

  • EKS Auto Mode detection:
    • Auto Mode managed nodes (eks.amazonaws.com/compute-type=auto label)
    • NodePools and EC2NodeClasses (managed by EKS)
    • Mixed mode detection (Auto Mode + MNG/self-managed)
  • Cluster Autoscaler:
    • Pod and deployment detection
    • Container args and environment variables
    • ConfigMap configuration
    • Service account with IRSA role
    • Recent logs (scale events, errors)
    • Status ConfigMap
    • Best practices check: version compatibility, auto-discovery mode, key flags, IAM configuration
  • Karpenter:
    • Pod and deployment detection
    • Version and configuration (environment variables)
    • Service account with IRSA
    • NodePools (v1beta1+): disruption policy, consolidation, limits, requirements
    • EC2NodeClasses: AMI family, subnets, security groups, instance profile, metadata options
    • Legacy Provisioners and AWSNodeTemplates (pre-v0.32)
    • NodeClaims: instance type, zone, capacity, conditions
    • Recent logs (provisioned, disruption events)
    • Karpenter events
    • Best practices: AMI pinning, interruption handling, consolidation settings

29. OBSERVABILITY

  • Metrics Collection:
    • Prometheus: Operator pods, StatefulSets
    • kube-state-metrics: Kubernetes object state metrics
    • Metrics Server: HPA/VPA and kubectl top support
    • CNI Metrics Helper: VPC CNI IP address monitoring
    • Node Exporter: Node-level metrics
    • DCGM Exporter: GPU metrics
  • Prometheus Ecosystem:
    • ServiceMonitors, PodMonitors listing
    • PrometheusRules, Alertmanager
  • Visualization:
    • Grafana: pods, services
  • AWS Native Observability:
    • CloudWatch Container Insights: Agent pods, DaemonSet
    • ADOT (AWS Distro for OpenTelemetry): pods, collectors
    • X-Ray: daemon pods
  • Logging:
    • Fluent Bit/Fluentd: pods, ConfigMaps
    • Vector: log aggregator pods
  • Third-Party APM:
    • Datadog: agent pods, DaemonSets
    • Dynatrace: OneAgent pods, operator
    • New Relic: infrastructure pods
    • Splunk: forwarder pods
    • Elastic Stack (ELK): Elasticsearch, Kibana, Logstash
  • Network Flow Monitoring:
    • Cilium Hubble: network observability
    • Calico Flow Logs: network policy logging
  • OpenTelemetry:
    • Operator pods
    • OpenTelemetryCollector resources
    • Instrumentation resources
  • Observability Summary: consolidated status of all tools

30. SERVICE_MESH

  • Istio:
    • Control plane pods (istiod)
    • Sidecar injection status
    • VirtualServices, DestinationRules, Gateways
    • PeerAuthentications, AuthorizationPolicies
  • Linkerd:
    • Control plane pods
    • ServiceProfiles
  • AWS App Mesh:
    • Controller pods
    • Meshes, VirtualNodes, VirtualServices, VirtualRouters

31. GITOPS

  • ArgoCD:
    • Server, repo-server, application-controller pods
    • Applications listing with sync status, health
    • AppProjects
    • ApplicationSets
  • FluxCD:
    • Source controller, kustomize controller, helm controller pods
    • GitRepositories, HelmRepositories
    • Kustomizations, HelmReleases

32. COST_OPTIMIZATION

  • Kubecost: pods, services, cost-analyzer deployment
  • Goldilocks:
    • Controller and dashboard pods
    • VPA recommendations per namespace
  • OpenCost: pods, services
  • Spot instance analysis:
    • Nodes with capacity-type=spot label
    • Spot vs on-demand distribution
  • Single replica deployments (availability risk)
  • Pods without resource requests (scheduling risk)
  • Storage cost analysis:
    • gp2 vs gp3 StorageClasses
    • Unused PVCs
    • EFS vs EBS usage
  • Networking cost analysis:
    • Topology-aware routing services
    • External traffic policy settings
  • Workload right-sizing:
    • VPA recommendations
    • HPA scaling efficiency (at min/max)
  • Node utilization analysis

33. THIRD_PARTY_CONTROLLERS

  • AWS Controllers for Kubernetes (ACK): CRDs, pods, installed services
  • External Secrets Operator:
    • Pods, SecretStores, ClusterSecretStores
    • ExternalSecrets listing
  • Cert-Manager:
    • Pods, ClusterIssuers, Certificates
  • AWS Load Balancer Controller: pods
  • Crossplane: pods, Providers
  • Sealed Secrets: pods
  • Reloader: pods
  • Velero: pods, backup schedules
  • Other controllers detected (pattern matching)

34. SECURITY

  • Pod Security Standards (PSS/PSA):
    • Namespace labels (pod-security.kubernetes.io/enforce)
    • Enforcement levels per namespace
  • Kyverno:
    • Pods, ClusterPolicies, Policies
    • PolicyReports
  • OPA Gatekeeper:
    • Pods, ConstraintTemplates, Constraints
  • Falco: pods, FalcoRules
  • Privileged container analysis:
    • Pods running as privileged
    • Pods running as root
    • Pods with hostNetwork, hostPID, hostIPC
  • Network policy coverage per namespace
  • Pod Identity associations
  • IRSA (IAM Roles for Service Accounts) annotations
  • Secrets management: Secrets Store CSI Driver, AWS Secrets Manager integration

35. RELIABILITY

  • Probe coverage analysis:
    • Deployments without liveness probes
    • Deployments without readiness probes
  • Graceful termination:
    • terminationGracePeriodSeconds settings
    • preStop hooks
  • PDB coverage for deployments
  • Resource quota usage per namespace
  • LimitRange configurations

36. DATA_PLANE

  • Node configuration details:
    • Instance types (node.kubernetes.io/instance-type label)
    • Architecture (arm64 vs amd64)
    • Capacity type (spot vs on-demand)
    • Availability zone distribution
  • Node capacity:
    • Allocatable CPU, memory, pods per node
    • Total cluster capacity
  • Taints and tolerations:
    • Node taints listing
    • Common taint patterns

37. SCALABILITY

  • Cluster scale metrics:
    • Total pods, services, endpoints
    • Pods per node distribution
  • API server limits:
    • Max requests in flight
    • Request timeout settings
  • etcd health (if accessible)
  • CoreDNS scaling:
    • Replica count vs cluster size
    • DNS autoscaler configuration
  • Upgrade readiness:
    • Deprecated API usage
    • PodDisruptionBudget coverage

38. ML_WORKLOADS

  • GPU nodes:
    • Nodes with nvidia.com/gpu resource
    • GPU count per node
    • NVIDIA device plugin DaemonSet
  • AWS Neuron (Inferentia/Trainium):
    • Nodes with aws.amazon.com/neuron resource
    • Neuron device plugin
  • EFA (Elastic Fabric Adapter):
    • Nodes with vpc.amazonaws.com/efa resource
    • EFA device plugin
  • ML frameworks:
    • Kubeflow pods
    • Ray pods
    • Training operators (PyTorch, TensorFlow, MPI)
  • ML observability: DCGM exporter, Neuron monitor

39. IMAGE_SECURITY

  • Image registry distribution:
    • ECR, Docker Hub, GCR, Quay, other registries
    • Private vs public registry usage
  • Image pull policies:
    • Always, IfNotPresent, Never distribution
  • Latest tag detection:
    • Pods using :latest tag (risk indicator)
  • Image pull secrets per namespace

40. GATEWAY_API

  • Gateway API resources:
    • GatewayClasses, Gateways
    • HTTPRoutes, TCPRoutes, TLSRoutes, GRPCRoutes
    • ReferenceGrants
  • AWS VPC Lattice:
    • Gateway controller pods
    • TargetGroupPolicies
  • Envoy Gateway: pods, EnvoyProxies
  • Contour: pods, HTTPProxies
  • Kong: pods, KongPlugins, KongConsumers
  • Ambassador/Emissary: pods, Mappings, Hosts

41. DNS_CONFIG

  • CoreDNS:
    • Deployment details (replicas, resources)
    • ConfigMap (Corefile) with plugins
    • Pod status and logs
  • Cluster Proportional Autoscaler:
    • Deployment for DNS scaling
    • ConfigMap with scaling parameters
  • NodeLocal DNS:
    • DaemonSet status
    • ConfigMap
  • External DNS:
    • Deployment status
    • Arguments and configuration

42. SECRETS_MANAGEMENT

  • Secrets Store CSI Driver:
    • DaemonSet status
    • SecretProviderClasses listing
  • AWS Secrets Manager integration:
    • ASCP (AWS Secrets and Configuration Provider) pods
    • SecretProviderClass examples
  • HashiCorp Vault:
    • Vault pods
    • Vault Agent Injector

43. SERVICE_ACCOUNTS

  • IRSA (IAM Roles for Service Accounts):
    • Service accounts with eks.amazonaws.com/role-arn annotation
    • Role ARN per service account
  • Pod Identity:
    • Pod Identity associations
    • Service account to IAM role mappings
  • Token projection:
    • Service accounts with projected tokens
    • Token expiration settings

44. SCHEDULING

  • RuntimeClasses:
    • Available RuntimeClasses (gVisor, Kata, etc.)
    • Handler configurations
  • Scheduler profiles:
    • Custom scheduler deployments
    • Scheduler ConfigMaps
  • Priority Classes:
    • PriorityClass listing with values
    • Preemption policies
  • Pod topology spread constraints usage

45. BACKUP_DR

  • VolumeSnapshots:
    • VolumeSnapshotClasses
    • VolumeSnapshots listing
    • VolumeSnapshotContents
  • Velero:
    • Backup schedules
    • Backup storage locations
    • Recent backups and restores

46. MULTI_TENANCY

  • Namespace isolation:
    • NetworkPolicy coverage per namespace
    • ResourceQuota per namespace
    • LimitRange per namespace
  • Namespace labels and annotations
  • Cross-namespace service access patterns

47. RESOURCE_OPTIMIZATION

  • Spot instance usage:
    • Spot vs on-demand node distribution
    • Workloads on spot nodes
  • QoS class distribution:
    • Guaranteed, Burstable, BestEffort pod counts
  • Single replica deployments (availability risk)
  • Pods without resource limits
  • Over-provisioned pods (requests >> actual usage via metrics)

48. NAMESPACE_SUMMARY

  • Per-namespace resource counts:
    • Pods, Deployments, StatefulSets, DaemonSets
    • Services, ConfigMaps, Secrets
    • Jobs, CronJobs
  • Namespace resource utilization summary

49. SUMMARY_JSON

  • Machine-readable JSON with:
    • Timestamp and scope
    • All resource counts (nodes, pods, deployments, etc.)
    • Feature detection flags (HPA, VPA, KEDA, Karpenter, etc.)
    • CNI type and version
    • Ingress controllers detected
    • Service mesh detected
    • GitOps tools detected
    • Security tools detected
    • Observability stack detected

Security Notes

  • Secret VALUES are NEVER printed (metadata only)
  • No AWS API calls are made (kubectl only)
  • Report may contain sensitive resource names - handle appropriately
  • Pod logs may contain application data - review before sharing

Troubleshooting

Error Solution
"Bash 4.0+ required" macOS: brew install bash then run with /opt/homebrew/bin/bash ./eks_cluster_audit.sh
"declare: -A: invalid option" Same as above - Bash version too old
"Cannot connect to cluster" Check kubectl cluster-info, verify kubeconfig
"Namespace not found" Check kubectl get namespaces
"Command timed out" Use --timeout 60 or --timeout-large 300, add --retries 5
"Permission denied" Verify RBAC permissions for your user/role
"jq: command not found" Install: apt-get install jq / yum install jq / brew install jq
"bc: command not found" Install: apt-get install bc / yum install bc
"timeout: command not found" macOS: brew install coreutils
"Script killed after SSH disconnect" Use ./run_eks_audit.sh or screen/tmux

Typical Runtime

Cluster Size Runtime Recommended Flags
Small (<50 pods) 2-3 minutes defaults
Medium (50-500 pods) 3-7 minutes defaults
Large (500-2000 pods) 7-20 minutes -T 300 -r 5
Very large (2000-5000 pods) 20-45 minutes -L -d 100 -T 300
XXL (5000+ pods) 45-90+ minutes -L -d 200 -T 300 -r 5

Output size: 1MB - 10MB depending on cluster size and features.

Read-Only Operations

This script performs read-only operations:

  • Only uses kubectl get, kubectl describe, and kubectl logs
  • No write operations (apply, delete, patch, scale, etc.)
  • No AWS API calls
  • Built-in timeouts and API throttling to reduce API server load

JSON Summary Structure

{
  "timestamp": "...",
  "scope": "...",
  "counts": {
    "nodes": 10,
    "namespaces": 25,
    "pods": 500,
    "deployments": 100,
    "services": 80
  },
  "features": {
    "autoscaling": { "hpa": true, "vpa": false, "keda": true, "karpenter": true },
    "ingress_controllers": { "nginx": true, "alb": true },
    "cni": { "vpc_cni": true },
    "service_mesh": { "istio": false, "linkerd": false },
    "observability": { "prometheus": true, "grafana": true },
    "gitops": { "argocd": true, "fluxcd": false },
    "security": { "kyverno": true, "gatekeeper": false }
  }
}

Files

File Description
eks_cluster_audit.sh Main discovery script
run_eks_audit.sh Wrapper for long-running execution (nohup, status, kill)
README.md This file

Security

See CONTRIBUTING for more information.

License

This project is licensed under the MIT-0 License.

This package depends on and may incorporate or retrieve a number of third-party software packages (such as open source packages) at install-time or build-time or run-time ("External Dependencies"). The External Dependencies are subject to license terms that you must accept in order to use this package. If you do not accept all of the applicable license terms, you should not use this package. We recommend that you consult your company's open source approval policy before proceeding.

Provided below is a list of External Dependencies and the applicable license identification as indicated by the documentation associated with the External Dependencies as of Amazon's most recent review.

THIS INFORMATION IS PROVIDED FOR CONVENIENCE ONLY. AMAZON DOES NOT PROMISE THAT THE LIST OR THE APPLICABLE TERMS AND CONDITIONS ARE COMPLETE, ACCURATE, OR UP-TO-DATE, AND AMAZON WILL HAVE NO LIABILITY FOR ANY INACCURACIES. YOU SHOULD CONSULT THE DOWNLOAD SITES FOR THE EXTERNAL DEPENDENCIES FOR THE MOST COMPLETE AND UP-TO-DATE LICENSING INFORMATION.

YOUR USE OF THE EXTERNAL DEPENDENCIES IS AT YOUR SOLE RISK. IN NO EVENT WILL AMAZON BE LIABLE FOR ANY DAMAGES, INCLUDING WITHOUT LIMITATION ANY DIRECT, INDIRECT, CONSEQUENTIAL, SPECIAL, INCIDENTAL, OR PUNITIVE DAMAGES (INCLUDING FOR ANY LOSS OF GOODWILL, BUSINESS INTERRUPTION, LOST PROFITS OR DATA, OR COMPUTER FAILURE OR MALFUNCTION) ARISING FROM OR RELATING TO THE EXTERNAL DEPENDENCIES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF AMAZON HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THESE LIMITATIONS AND DISCLAIMERS APPLY EXCEPT TO THE EXTENT PROHIBITED BY APPLICABLE LAW.

About

No description, website, or topics provided.

Resources

Readme

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity
Custom properties

Stars

6 stars

Watchers

0 watching

Forks

1 fork
Report repository

Releases

Packages

Used by

Contributors

Languages

Generated from amazon-archives/__template_MIT-0