Home / AWS / Fix AWS EKS EKSCTL Addon Not Creating

AWS

Fix AWS EKS EKSCTL Addon Not Creating

Resolve EKSCTL addon creation failures by checking IAM OIDC provider, service account annotations, and addon version compatibility.

Published: Apr 1, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

EKSCTL uses EKS managed addons (vpc-cni, coredns, aws-ebs-csi-driver) to simplify cluster management. When addon creation fails, the addon remains in degraded state, and pods relying on that addon's functionality encounter errors.

Symptoms

Addon creation failed:

```bash $ eksctl create addon --cluster my-cluster --name vpc-cni --force

Error: failed to create addon "vpc-cni" for cluster "my-cluster": addon "vpc-cni" is in degraded state ```

IAM role issues:

```bash $ eksctl create addon --cluster my-cluster --name aws-ebs-csi-driver

Error: IRSA not configured: cluster does not have an IAM OIDC provider ```

Version mismatch:

```bash $ eksctl create addon --cluster my-cluster --name coredns --version v1.8.0

Error: addon version "v1.8.0" is not compatible with Kubernetes version "1.27" ```

Common Causes

1.IAM OIDC provider missing - Cluster created without OIDC for IRSA
2.Service account not annotated -Addon needs IRSA but SA lacks role ARN
3.Addon version incompatible - Version doesn't match cluster K8s version
4.Existing conflict - Self-managed addon already installed
5.Permission denied - eksctl lacks IAM permissions
6.Network issues - VPC CNI addon can't configure networking
7.Resource quotas - Insufficient resources for addon pods

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check IAM OIDC Provider

```bash # Check if cluster has OIDC provider eksctl utils describe-stacks --cluster my-cluster --region us-west-2

# Look for OIDC provider in output # If missing, create it: eksctl utils associate-iam-oidc-provider --cluster my-cluster --approve

# Verify OIDC provider exists aws iam list-open-id-connect-providers \ --query 'OpenIDConnectProviderList[*].Arn' ```

Step 2: List Available Addon Versions

```bash # Get compatible addon versions for your cluster eksctl utils addon-versions --cluster my-cluster

# Or via AWS CLI aws eks describe-addon-versions \ --addon-name vpc-cni \ --kubernetes-version 1.27 \ --query 'Addons[*].AddonVersions[*].[AddonVersion,Compatibility]' ```

Step 3: Create Addon with Correct Version

```bash # Create addon with compatible version eksctl create addon \ --cluster my-cluster \ --name vpc-cni \ --version v1.12.0-eksbuild.1 \ --force

# Create with service account role eksctl create addon \ --cluster my-cluster \ --name aws-ebs-csi-driver \ --service-account-role-arn arn:aws:iam::123456789:role/EbsCsiDriverRole \ --force ```

Step 4: Check Existing Addons

```bash # List existing addons (managed and self-managed) eksctl get addons --cluster my-cluster

# Check addon status aws eks describe-addon \ --cluster-name my-cluster \ --addon-name vpc-cni \ --query 'Addon.{Status:Status,Health:HealthIssues}'

# Common statuses: # - ACTIVE: Working correctly # - DEGRADED: Has health issues # - CREATING: Being created # - FAILED: Creation failed ```

Step 5: Handle Existing Self-Managed Addon Conflict

```bash # If self-managed addon exists, you need to remove it first # Check for existing DaemonSet/Deployment kubectl get daemonset -n kube-system kubectl get deployment -n kube-system

# Remove self-managed CNI before installing managed addon kubectl delete daemonset aws-node -n kube-system

# Then create managed addon eksctl create addon --cluster my-cluster --name vpc-cni --force ```

Step 6: Create IAM Role for Addon

```bash # Create IAM role for addon with IRSA eksctl create iamserviceaccount \ --cluster my-cluster \ --name ebs-csi-controller-sa \ --namespace kube-system \ --role-name EbsCsiDriverRole \ --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ --approve

# For VPC CNI, attach policy: eksctl create iamserviceaccount \ --cluster my-cluster \ --name aws-node \ --namespace kube-system \ --role-name VpcCniRole \ --attach-policy-arn arn:aws:iam::aws:policy/AmazonEKSVPCCNIPolicy \ --approve ```

Step 7: Verify Addon Health

```bash # Check addon health issues aws eks describe-addon \ --cluster-name my-cluster \ --addon-name vpc-cni \ --query 'Addon.HealthIssues'

# Check addon pods kubectl get pods -n kube-system -l k8s-app=aws-node

# Check pod logs kubectl logs -n kube-system -l k8s-app=aws-node ```

Step 8: Fix Degraded Addon

```bash # Force update addon eksctl update addon \ --cluster my-cluster \ --name vpc-cni \ --force

# Or delete and recreate eksctl delete addon --cluster my-cluster --name vpc-cni eksctl create addon --cluster my-cluster --name vpc-cni --version LATEST ```

Step 9: Check Addon Configuration

```bash # Get addon configuration aws eks describe-addon-configuration \ --addon-name vpc-cni \ --addon-version v1.12.0-eksbuild.1

# Apply custom configuration eksctl create addon \ --cluster my-cluster \ --name vpc-cni \ --configuration-values '{"env":{"ENABLE_PREFIX_DELEGATION":"true"}}' ```

Step 10: Verify Permissions

```bash # Check eksctl user has required permissions # Required IAM actions: # - eks:CreateAddon # - eks:DescribeAddon # - eks:DescribeAddonVersions # - iam:PassRole (if using service account role)

# If permission denied, check your IAM user/role aws sts get-caller-identity

# Verify eks:CreateAddon permission aws eks create-addon \ --cluster-name my-cluster \ --addon-name vpc-cni \ --addon-version v1.12.0-eksbuild.1 ```

EKS Managed Addons Reference

Addon	Purpose	Required IAM
vpc-cni	Pod networking	AmazonEKSVPCCNIPolicy
coredns	DNS resolution	None
aws-ebs-csi-driver	EBS volumes	AmazonEBSCSIDriverPolicy
kube-proxy	Network proxy	None

Verification

```bash # Check addon status after fix eksctl get addons --cluster my-cluster

# Should show ACTIVE status aws eks describe-addon \ --cluster-name my-cluster \ --addon-name vpc-cni \ --query 'Addon.Status'

# Verify addon pods running kubectl get pods -n kube-system -l k8s-app=aws-node ```

[Fix AWS EKS IAM Role for Service Account](/articles/fix-aws-eks-iam-role-for-service-account)
[Fix AWS EKS Pod to Pod Communication](/articles/fix-aws-eks-pod-to-pod-communication)
[Fix AWS EKS Node Not Ready](/articles/fix-aws-eks-node-not-ready)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS EKS EKSCTL Addon Not Creating AWS EKS EKSCTL Addon Not Creating AWS AWS EKS EKSCTL Addon Not Creating troubleshooting AWS EKS EKSCTL Addon Not Creating fix Resolve EKSCTL addon creation failures by checking IAM OIDC provider, service account annotations, and addon version compatibility AWS Resolve EKSCTL addon creation failures by checking IAM OIDC provider, service account annotations, and addon version compatibility

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 1, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS EKS EKSCTL Addon Not Creating

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check IAM OIDC Provider

Step 2: List Available Addon Versions

Step 3: Create Addon with Correct Version

Step 4: Check Existing Addons

Step 5: Handle Existing Self-Managed Addon Conflict

Step 6: Create IAM Role for Addon

Step 7: Verify Addon Health

Step 8: Fix Degraded Addon

Step 9: Check Addon Configuration

Step 10: Verify Permissions

EKS Managed Addons Reference

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS EKS EKSCTL Addon Not Creating

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check IAM OIDC Provider

Step 2: List Available Addon Versions

Step 3: Create Addon with Correct Version

Step 4: Check Existing Addons

Step 5: Handle Existing Self-Managed Addon Conflict

Step 6: Create IAM Role for Addon

Step 7: Verify Addon Health

Step 8: Fix Degraded Addon

Step 9: Check Addon Configuration

Step 10: Verify Permissions

EKS Managed Addons Reference

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading