EKS — Amazon Elastic Kubernetes Service

EKS supports two modes:

• mock (default): metadata-only controller API.
• live (opt-in via OVERCAST_EKS_MODE=live): launches a k3s control-plane container on CreateCluster.

Behavior notes

• In mock mode, cluster status is immediately ACTIVE and endpoint/CA fields are synthetic placeholders.
• In live mode, cluster status starts CREATING and transitions to ACTIVE after k3s /readyz responds. The k3s image is pulled first, so the first cluster on a machine that has never run one waits on that download.
• In live mode, a control plane that cannot be started reaches FAILED instead of staying CREATING, and DescribeCluster reports why under cluster.health.issues — the Docker error verbatim for an image that cannot be pulled or a container that cannot be created or started.
• In live mode, DescribeCluster endpoint uses https://<OVERCAST_HOSTNAME-or-localhost>:<mapped-port>.
• In live mode, ListClusters filters out legacy mock-record clusters (*.mock.eks.local) to avoid mixed-mode leakage.
• In live mode, cluster-scoped read/update APIs for update/insight/config flows reject legacy mock-record clusters with 501 to keep behavior mode-consistent.
• In live mode, UpdateClusterConfig follows the same mixed-mode rule and rejects legacy mock-record clusters with 501.
• In live mode, nodegroup CRUD/update/list endpoints also reject legacy mock-record clusters with 501 for the same mixed-mode safety boundary.
• In live mode, access-entry and access-policy association endpoints also reject legacy mock-record clusters with 501.
• In live mode, identity-provider-config and pod-identity-association endpoints also reject legacy mock-record clusters with 501.
• In live mode, fargate-profile and cluster-scoped add-on endpoints also reject legacy mock-record clusters with 501.
• In live mode, DeleteCluster remains allowed for legacy mock-record clusters so mixed-mode leftovers can be cleaned up.
• UpdateKubeconfig is an Overcast extension rather than an AWS API operation: aws eks update-kubeconfig is a CLI-side command that calls DescribeCluster and writes the file locally. Overcast serves the generated kubeconfig at POST /_overcast/eks/clusters/{name}/kubeconfig, which no AWS SDK calls.
• In live mode, UpdateKubeconfig returns generated kubeconfig once the cluster reaches ACTIVE and runtime CA data is available; when CA is missing it attempts an on-demand backfill from the k3s runtime container before returning 503.
• Nodegroups are metadata-only in both modes and do not start compute.

Live mode limits and non-goals

• live mode is intentionally opt-in and has a much larger resource footprint than the default mock mode.
• Startup and idle-memory headline claims for Overcast are measured with OVERCAST_EKS_MODE=mock.
• Live-mode EKS launches a k3s control-plane container only; it does not provision real EKS worker capacity.
• Nodegroup, Fargate profile, add-on, access entry/policy, identity provider config, and pod identity association APIs are control-plane metadata surfaces; they do not enforce IAM policy semantics or schedule Kubernetes workloads on managed EKS infrastructure.
• Legacy mock-created EKS records remain blocked by design in live mode (501) for read/update/mutation APIs; DeleteCluster stays allowed for cleanup.

Summary

Category	✅ Supported
Clusters	29
Helpers	1
Nodegroups	6
Fargate	4
Tags	3
Addons	7

---

Endpoints

Clusters

Operation	Status	Notes	AWS Docs
CreateCluster	✅ Supported	Stores cluster metadata including roleArn, version, resourcesVpcConfig, kubernetesNetworkConfig, and encryptionConfig; describe returns inline tags	docs
DescribeCluster	✅ Supported		docs
DescribeClusterVersions	✅ Supported	Returns synthetic supported Kubernetes version catalog	docs
ListClusters	✅ Supported		docs
CreateAccessEntry	✅ Supported	Stores cluster principal access entry metadata and persists inline tags	docs
DescribeAccessEntry	✅ Supported	Returns stored access entry metadata for a cluster principal ARN with inline tags	docs
UpdateAccessEntry	✅ Supported	Updates stored access entry username/groups for a cluster principal ARN	docs
DeleteAccessEntry	✅ Supported	Deletes stored access entry metadata for a cluster principal ARN	docs
ListAccessEntries	✅ Supported	Returns stored principal ARNs for cluster access entries	docs
AssociateAccessPolicy	✅ Supported	Associates a policy ARN with a stored access entry principal	docs
ListAccessPolicies	✅ Supported	Returns synthetic managed EKS access policy catalog	docs
ListAssociatedAccessPolicies	✅ Supported	Lists associated policy ARNs and access scopes for a stored access entry principal	docs
DisassociateAccessPolicy	✅ Supported	Disassociates a policy ARN from a stored access entry principal	docs
ListIdentityProviderConfigs	✅ Supported	Returns stored identity provider config summaries	docs
DescribeIdentityProviderConfig	✅ Supported	Returns the stored OIDC config nested under identityProviderConfig.oidc, with its ARN, status and inline tags	docs
AssociateIdentityProviderConfig	✅ Supported	Stores OIDC identity provider metadata, persists inline tags, and records an update entry	docs
DisassociateIdentityProviderConfig	✅ Supported	Removes stored identity provider metadata, clears inline tags, and records an update entry	docs
CreatePodIdentityAssociation	✅ Supported	Creates and stores pod identity association metadata for a cluster service account, persists inline tags, and rejects duplicate namespace/service-account bindings	docs
ListPodIdentityAssociations	✅ Supported	Returns stored pod identity associations for a cluster	docs
DescribePodIdentityAssociation	✅ Supported	Returns stored pod identity association details by association ID with inline tags	docs
UpdatePodIdentityAssociation	✅ Supported	Updates stored pod identity association role ARN by association ID	docs
DeletePodIdentityAssociation	✅ Supported	Deletes stored pod identity association metadata by association ID	docs
ListUpdates	✅ Supported	Lists recorded update IDs for a cluster	docs
ListInsights	✅ Supported	Returns synthetic health/readiness insight summaries for a cluster; honours the modeled category/kubernetesVersion/status filter and maxResults/nextToken paging	docs
DescribeInsight	✅ Supported	Returns synthetic health/readiness insight detail by insight ID	docs
UpdateClusterConfig	✅ Supported	Updates stored cluster logging, resourcesVpcConfig, and kubernetesNetworkConfig; records an update entry	docs
UpdateClusterVersion	✅ Supported	Updates stored cluster version metadata	docs
DescribeUpdate	✅ Supported	Returns previously recorded cluster/nodegroup update status by update ID	docs
DeleteCluster	✅ Supported	Deletes cluster metadata and nodegroups	docs

Helpers

Operation	Status	Notes	AWS Docs
UpdateKubeconfig	✅ Supported	Emulator extension, not an AWS API operation — aws eks update-kubeconfig is a CLI-side command that calls DescribeCluster and writes the file locally, so no SDK calls this. Overcast returns the generated kubeconfig YAML instead (503 until a live cluster’s endpoint/CA are ready)	cli

Nodegroups

Operation	Status	Notes	AWS Docs
CreateNodegroup	✅ Supported	Stores full nodegroup metadata including instanceTypes, amiType, capacityType, diskSize, taints, labels, scalingConfig, updateConfig, launchTemplate, and releaseVersion	docs
UpdateNodegroupVersion	✅ Supported	Updates stored nodegroup version, releaseVersion and launchTemplate; records an update entry. No body member is required, matching the model	docs
UpdateNodegroupConfig	✅ Supported	Updates stored nodegroup labels, taints, scalingConfig, and updateConfig; records an update entry	docs
DescribeNodegroup	✅ Supported		docs
ListNodegroups	✅ Supported		docs
DeleteNodegroup	✅ Supported	Deletes nodegroup metadata	docs

Fargate

Operation	Status	Notes	AWS Docs
ListFargateProfiles	✅ Supported	Lists stored profiles; always includes synthetic “default” profile	docs
DescribeFargateProfile	✅ Supported	Returns stored or synthetic default profile	docs
CreateFargateProfile	✅ Supported	Stores Fargate profile metadata including podExecutionRoleArn, subnets, and selectors	docs
DeleteFargateProfile	✅ Supported	Removes stored Fargate profile metadata	docs

Tags

Operation	Status	Notes	AWS Docs
ListTagsForResource	✅ Supported	Returns tags for any EKS resource ARN	docs
TagResource	✅ Supported	Adds tags to an EKS resource by ARN	docs
UntagResource	✅ Supported	Removes tags from an EKS resource by ARN	docs

Addons

Operation	Status	Notes	AWS Docs
CreateAddon	✅ Supported	Stores add-on metadata including addonVersion, configurationValues, and serviceAccountRoleArn; describe returns inline tags	docs
DescribeAddon	✅ Supported		docs
ListAddons	✅ Supported		docs
UpdateAddon	✅ Supported	Updates stored add-on version/configuration/service account role and records an update entry; resolveConflicts is echoed into the update’s params but not enforced	docs
DeleteAddon	✅ Supported	Removes add-on metadata	docs
DescribeAddonConfiguration	✅ Supported	Returns the synthetic configuration schema for the requested add-on and version; both query members are required, and an uncatalogued version is a ResourceNotFoundException	docs
DescribeAddonVersions	✅ Supported	Returns the synthetic version catalog for vpc-cni, coredns, kube-proxy and aws-ebs-csi-driver, filtered by the addonName/kubernetesVersion/types/publishers/owners query members and paged by maxResults/nextToken	docs