Eks Triage

---
name: eks-triage
description: Use when an AWS EKS cluster has problems that are specific to EKS rather than generic Kubernetes — managed nodegroup nodes won't join / stay NotReady, the aws-node (VPC CNI) DaemonSet CrashLoops, pods stuck ContainerCreating with CNI/ENI errors, IRSA/IAM permission denials, Karpenter/cluster-autoscaler refusing to scale, subnet IP exhaustion, addon rollouts self-locking, or AZ/EBS volume-affinity conflicts. Read-only `kubectl` + `aws eks/ec2` triage that names the AWS-layer root cause.
---

# eks-triage

EKS hands you a managed control plane, but the failures that actually page you live
in the seam between Kubernetes and AWS: IAM, the VPC CNI, ENIs, subnets, nodegroups,
addons, and autoscalers. Those don't show up in a plain `kubectl describe` story —
you have to cross into the AWS API to see them. This skill drives that crossing in a
fixed, read-only order and reports the **AWS-layer root cause**, not a log dump.

Use `k8s-triage` for symptoms that are pure Kubernetes (CrashLoop from an app bug,
bad readiness probe, OOM). Use **this** when the problem smells like AWS underneath:
nodes that never register, CNI that can't hand out IPs, IRSA that silently isn't
working. The tell is usually "the workload config looks fine but it still won't run."

## When to use

Reach for this when someone reports, on an EKS cluster:

- a managed (or self-managed) **nodegroup whose nodes never become `Ready`**, or go
  `NotReady` / never `kubectl get nodes` at all
- **`aws-node` (VPC CNI) DaemonSet CrashLoopBackOff**, or pods stuck… install to load the full skill