Pulumi LBr Labs EKS

This repo provides a multi-language component that creates a "batteries included" cluster ready for you to attach your EKS nodes to.

It creates:

an EKS cluster with CloudTrail logging enabled, and secret encryption enabled
Installs an operator that eases the process of adding Role Mappings to the aws-auth
A node group designed to run "system" workloads with a taint
The AWS EBS CSI Addon with an IAM role using IAM Roles for Service accounts
The AWS VPC CNI Addon with an IAM role using IAM Roles for Service accounts
The CoreDNS Addon
An internal and external NGINX ingress controller with relevant ingress classes
External DNS, with an IAM role that can modify Route53 domains using IAM Roles for service accounts
Cert Manager, with an IAM role that can modify Route53 domains using IAM Roles for service accounts

It is designed to be an opinionated implementation of EKS, without the overhead of having to install all of the things required for your cluster to be functional.

It also provides a mechanism to quickly attached a workload node to your newly created cluster, and create an IAM role for Service accounts with your cluster's OIDC provider.

Examples

Examples for all languages are in the examples directory.

Note, you need to create a VPC, and also add your worker nodes.

Amazon VPC CNI network policy support

You can opt into Amazon EKS network policy support by configuring the vpcCniConfig input on the cluster:

const cluster = new lbrlabs_eks.Cluster("cluster", {
  clusterSubnetIds: vpc.privateSubnetIds,
  letsEncryptEmail: "mail@lbrlabs.com",
  systemNodeSubnetIds: vpc.publicSubnetIds,
  vpcCniConfig: {
    enableNetworkPolicy: true,
    nodeAgent: {
      enablePolicyEventLogs: true,
      metricsBindAddr: 8162,
      healthProbeBindAddr: 8163,
    },
  },
});

This setting is optional. AWS support still depends on the installed VPC CNI addon version and applies to Linux EC2 nodes, not Fargate or Windows nodes.

FAQs

Can you add support for X

Add an issue, but this is mainly designed to be useful for workloads I run, so I reserve the right to refuse.

Can you make X optional?

I have no plans to make any of the batteries included optional at this time

Installing

This package is available in many languages in the standard packaging formats.

Node.js (Java/TypeScript)

To use from JavaScript or TypeScript in Node.js, install using either npm:

$ npm install @lbrlabs/pulumi-eks

or yarn:

$ yarn add @lbrlabs/pulumi-eks

Python

To use from Python, install using pip:

$ pip install lbrlabs_pulumi_eks

Go

To use from Go, use go get to grab the latest version of the library

$ go get github.com/lbrlabs/pulumi-lbrlabs-eks/sdk/go/...

.NET

To use from Dotnet, use dotnet add package to install into your project. You must specify the version if it is a pre-release version.

$ dotnet add package Lbrlabs.PulumiPackage.Eks

Reference

See the Pulumi registry for API docs:

https://www.pulumi.com/registry/packages/lbrlabs-eks/api-docs/

Metadata

Release files for lbrlabs-pulumi-eks 1.9.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for lbrlabs-pulumi-eks 1.9.0
File	Size	Uploaded
lbrlabs_pulumi_eks-1.9.0.tar.gz	23.1 kB	Aug 9, 2026	Details

Release files / lbrlabs_pulumi_eks-1.9.0.tar.gz

Download URL	lbrlabs_pulumi_eks-1.9.0.tar.gz
Size	23.1 kB
Tags	Source
SHA-256 checksum How to use checksums	`cfcd1ee9e20605b26eb0ee2c3523e4bcd353b4ab0191d79757006279e34cf813`
BLAKE2b-256 checksum How to use checksums	`d27f9e471f0fce966d314c9e93fb917f5bed4c32412e3273d5470377379e8cce`
Upload date	Aug 9, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.10.20`