EKS Capabilities: ArgoCD, ACK, and kro Without Controllers

EKS Capabilities: ArgoCD, ACK, and kro Without Controllers

AWS EKS introduced capabilities on Dec 1, 2025, allowing developers to deploy S3 buckets using ACK and ArgoCD without installing controllers. This eliminates the need to manage operational components on worker nodes.

Why This Matters

EKS capabilities abstract Kubernetes-native tools like ArgoCD and ACK, reducing operational overhead. However, the pricing model introduces complexity: a base hourly charge plus usage-based fees for managed resources. Misconfigured IAM roles or missing permissions (e.g., ArgoCD’s inability to list cluster resources) can cause deployment failures, as seen in the blog’s bug fix.

Key Insights

• “8-hour App Engine outage, 2012”: Not applicable here, but EKS capabilities aim to avoid such downtime by centralizing management.
• “Sagas over ACID for e-commerce”: Not directly relevant, but GitOps (via ArgoCD) enables transactional deployment patterns.
• “Temporal used by Stripe, Coinbase”: Not applicable; the blog focuses on AWS-managed capabilities.

Working Example

# Terraform for EKS capability IAM role
resource "aws_iam_role" "eks_capability_role" {
  name = "eks-capability-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = { Service = "capabilities.eks.amazonaws.com" }
      Action = "sts:AssumeRole"
    }]
  })
}

# ArgoCD Application to deploy S3 bucket via ACK
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: eks-capability
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/jatinmehrotra/aws-reinvent-2025
    targetRevision: HEAD
    path: eks-capabilities/ack_yaml
  destination:
    name: reinvent-2025
    namespace: ack
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# ACK resource to create S3 bucket
apiVersion: s3.services.k8s.aws/v1alpha1
kind: Bucket
metadata:
  name: my-test-bucket
  namespace: default
spec:
  name: jj-bucket-name-12345

Practical Applications

• Use Case: Deploy applications and infrastructure with GitOps using ArgoCD and ACK.
• Pitfall: Forgetting to grant ClusterAdmin permissions to the EKS capability role can block ArgoCD from syncing resources.

References:

• https://dev.to/aws-builders/i-created-s3-buckets-using-argocd-ack-with-eks-capabilities-no-controllers-installed-cm0