# EKS Cluster > ZopDay creates each EKS cluster with one managed node group on Amazon Linux 2023 and an API endpoint open to public and private access. The Provision screen preselects Kubernetes 1.35 and 2 nodes. Through the API, leaving these out gives Kubernetes 1.31 on t3.large nodes. Components install only if you pick them, plus a baseline before the first deploy. Source: https://zop.dev/integrations/provision/aws/eks-cluster Updated: 2026-08-19 --- Amazon EKS is AWS's managed Kubernetes control plane. ZopDay creates an EKS cluster as a cluster job. ZopDay calls AWS directly with the cloud account you connected, and the job page shows each step as it runs. ## What steps does ZopDay run to create an EKS cluster A cluster job sets up the network, creates IAM roles, creates the cluster and waits for it to be ready. Next it creates a DNS zone (only if you supplied a domain) and an ECR repository. Then it registers the cluster as a deployment space. Finally it installs components, but only the ones you picked. The network step builds a new VPC unless you choose an existing one. The IAM step creates two roles named after the cluster. A cluster called shop gets `shop-eks-cluster-role` and `shop-eks-node-role`. The cluster itself is created in the private subnets. Once the control plane is ACTIVE, the job creates one managed node group named after the cluster (`shop-nodes` for a cluster called shop). The node group uses the Amazon Linux 2023 (AL2023) AMI type. It uses the Arm (arm64) variant when you pick a Graviton family such as `m7g`. ## Which EKS versions, node counts and machine types can you set The Provision screen preselects Kubernetes 1.35 and lists versions back to 1.30. You enter a node count (2 by default) and pick a machine type. No machine type is preselected. You do not set a minimum or maximum node count. ZopDay sets the node group's lower limit to the node count and its upper limit to twice the node count: 2 and 4 by default. If you create the cluster through the ZopDay API and leave these out, ZopDay uses Kubernetes 1.31, `t3.large` and 2 nodes. These limits are only bounds. The group stays at the node count, and nothing scales it until the Cluster Autoscaler component is installed. ## How is the EKS API endpoint reached and who can sign in The cluster's API endpoint has both public and private access turned on, so ZopDay can reach it to install components and deploy. The authentication mode is `API_AND_CONFIG_MAP`. The IAM identity behind your connected cloud account gets cluster-admin access when the cluster is created. ZopDay signs in with a short-lived, presigned AWS STS token instead of a stored kubeconfig. ## Secrets encryption stays at the AWS default ZopDay does not turn on secrets encryption when it creates the cluster. Kubernetes secrets are therefore not envelope-encrypted with a customer-managed KMS key. Whatever encryption AWS applies to EKS by default still applies. ## Which EKS components are installed, and when The AWS catalogue has 13 components: ingress-nginx, cert-manager, Cluster Autoscaler, Metrics Server, the EBS CSI driver (which makes `gp3` the default storage class), KEDA, the Prometheus stack, Service Alerts, Loki, Fluent Bit, Reloader, External Secrets and the Secrets Store CSI driver. None are selected at the start, and nothing installs at creation unless you pick it. Before the first service deploy lands, ZopDay checks the cluster against a standard AWS set: ingress-nginx, cert-manager, the Prometheus stack, Cluster Autoscaler and the EBS CSI driver. It installs whichever are missing. ## What gets created alongside the cluster - **Two IAM roles**: the cluster role with `AmazonEKSClusterPolicy`, and the node role with `AmazonEKSWorkerNodePolicy`, `AmazonEKS_CNI_Policy` and `AmazonEC2ContainerRegistryReadOnly`. - **The network ZopDay builds for the cluster**: public and private subnets in 2 zones, an internet gateway, and one NAT gateway per zone. - **An ECR repository** named after the cluster. - **A Route 53 hosted zone** when you supply a domain. The job creates no OIDC provider and no IRSA roles, so add-ons get no dedicated IAM role from ZopDay. No IAM users or access keys are created. ## What does deleting an EKS cluster job remove Deleting the job removes the ECR repository with its images and the hosted zone. It removes the load balancers and volumes Kubernetes created inside the cluster, but keeps volumes with a Retain policy. It then removes the node group, the cluster and its two IAM roles. The NAT gateways, subnets and VPC are removed too, but only when ZopDay created the network. An existing VPC is left alone.