eks-validate

name	eks-validate
description	Generate a validation script for an AWS KAS/NVCF EKS foundation. Checks AWS account identity, VPC/subnets, EKS state and OIDC, node group composition, ECR pull permissions, optional S3 RBAC/probe, GPU Operator readiness, GPU resources, and an ephemeral CUDA smoke pod.
version	1.1.0
author	NVIDIA Omniverse Streaming
tags	["aws","eks","validation","gpu"]
tools	["Shell","Read","Write"]

EKS Foundation Validation

What This Skill Produces

Generate generated/<cluster-name>-validate.sh, a validation script that emits PASS/WARN/FAIL lines and writes generated/<cluster-name>-validate-report.json.

The report shape intentionally matches the Azure aks-validate style:

{
  "cluster": "eks-nvcf-validation-usw2",
  "timestamp": "2026-05-27T12:34:56Z",
  "summary": { "pass": 8, "warn": 1, "fail": 0 },
  "checks": [
    { "id": "account",      "status": "PASS", "detail": "active account matches 123456789012 in us-west-2" },
    { "id": "vpc",          "status": "PASS", "detail": "VPC vpc-abc 10.10.0.0/16; subnets: subnet-a, subnet-b, subnet-c" },
    { "id": "eks",          "status": "PASS", "detail": "ACTIVE; v1.30; OIDC enabled" },
    { "id": "nodes",        "status": "PASS", "detail": "system=1, compute=1, gpu=1 (g6.12xlarge, us-west-2a)" },
    { "id": "ecr-pull",     "status": "PASS", "detail": "ECR read allowed for node role(s)" },
    { "id": "s3-rbac",      "status": "WARN", "detail": "Skipped (no S3_BUCKET_NAME)" },
    { "id": "gpu-op",       "status": "PASS", "detail": "9/9 pods Ready; chart v25.3.1" },
    { "id": "gpu-resource", "status": "PASS", "detail": "1 node advertises nvidia.com/gpu=4" },
    { "id": "cuda-smoke",   "status": "PASS", "detail": "nvidia-smi pod returned 0; L40S detected" },
    { "id": "s3-probe",     "status": "WARN", "detail": "Skipped (no S3_PROBE_SERVICE_ACCOUNT)" }
  ]
}

Inputs

Required:

Input	Notes
CLUSTER_NAME	EKS cluster name and kubeconfig context.
AWS_REGION	Target AWS region.

Optional:

Input	Default	Notes
AWS_ACCOUNT_ID	unset	If set, active caller account must match.
ECR_REPOSITORY_PREFIX	${CLUSTER_NAME}	Prefix used by ecr and ecr-mirror.
GPU_OPERATOR_VERSION	unset	If set, checked against Helm metadata when available.
CUDA_IMAGE	nvidia/cuda:12.4.0-base-ubuntu22.04	Image for smoke test.
SKIP_CUDA	false	Skip CUDA smoke with WARN.
ALLOW_GPU_ZERO	false	Treat no GPU nodes/resources as WARN instead of FAIL.
S3_BUCKET_NAME	unset	Enables optional S3 RBAC check.
S3_PROBE_NAMESPACE	default	Namespace for optional in-cluster S3 probe.
S3_PROBE_SERVICE_ACCOUNT	unset	ServiceAccount expected to have S3 access, usually via IRSA/EKS Pod Identity.
S3_PROBE_IMAGE	amazon/aws-cli:2.15.0	Image for optional in-cluster S3 probe.
SKIP_S3_PROBE	false	Skip S3 probe with WARN.
TIMEOUT_MIN	5	Per-check timeout cap.

Required tools:

• aws
• kubectl
• jq

Check Parity

Azure check	AWS equivalent
rg	account validates active AWS account and region context.
vnet	vpc validates EKS VPC, CIDR, and attached subnets.
aks	eks validates EKS ACTIVE, Kubernetes version, and OIDC issuer.
nodes	nodes validates system/compute/GPU node labels plus GPU instance type/zone detail.
acr-pull	ecr-pull validates ECR read access for EKS node role(s).
blob-rbac	s3-rbac optionally validates S3 permissions when S3_BUCKET_NAME is set.
gpu-op	gpu-op validates GPU Operator pod readiness and chart version when discoverable.
gpu-resource	gpu-resource validates advertised nvidia.com/gpu.
cuda-smoke	cuda-smoke runs an ephemeral nvidia-smi pod and cleans it up.
blob-probe	s3-probe optionally runs an in-cluster AWS CLI pod using the supplied service account.

Bash Script

Generate this script shape:

#!/bin/bash
set -uo pipefail

: "${CLUSTER_NAME:?Set CLUSTER_NAME before running}"
: "${AWS_REGION:?Set AWS_REGION before running}"

ECR_REPOSITORY_PREFIX="${ECR_REPOSITORY_PREFIX:-$CLUSTER_NAME}"
CUDA_IMAGE="${CUDA_IMAGE:-nvidia/cuda:12.4.0-base-ubuntu22.04}"
SKIP_CUDA="${SKIP_CUDA:-false}"
ALLOW_GPU_ZERO="${ALLOW_GPU_ZERO:-false}"
S3_PROBE_NAMESPACE="${S3_PROBE_NAMESPACE:-default}"
S3_PROBE_IMAGE="${S3_PROBE_IMAGE:-amazon/aws-cli:2.15.0}"
SKIP_S3_PROBE="${SKIP_S3_PROBE:-false}"
TIMEOUT_MIN="${TIMEOUT_MIN:-5}"

for tool in aws kubectl jq; do
  command -v "$tool" >/dev/null 2>&1 || {
    echo "ERROR: $tool is required but not installed" >&2
    exit 2
  }
done

kubectl --context "$CLUSTER_NAME" get nodes >/dev/null 2>&1 || {
  echo "ERROR: cannot reach cluster context $CLUSTER_NAME" >&2
  exit 2
}

mkdir -p generated
REPORT_FILE="generated/${CLUSTER_NAME}-validate-report.json"

PASS=0; WARN=0; FAIL=0
CHECKS=()
NODE_ROLE_ARNS=()

json_escape() {
  jq -Rn --arg s "$1" 
}

() {
   = status= detail=
  CHECKS+=()
    
    PASS) ((PASS++)) ;;
    WARN) ((WARN++)) ;;
    FAIL) ((FAIL++)) ;;
  
      
}


ACTIVE_ACCOUNT=
 [[ -z  ||  ==  ]]; 
  record account FAIL 
 [[ -n  &&  !=  ]]; 
  record account FAIL 
 [[ -n  ]]; 
  record account PASS 

  record account WARN 


CLUSTER_JSON=
CLUSTER_READABLE=
 [[ -z  ]]; 
  record eks FAIL 
  CLUSTER_JSON=
  CLUSTER_READABLE=



VPC_ID=
 [[ -z  ]]; 
  record vpc FAIL 

  VPC_CIDR=
   -t SUBNET_IDS < <(  | jq -r )
   [[  -eq 0 ]]; 
    record vpc FAIL 
  
    SUBNET_NAMES= 
    record vpc PASS 
  





 [[  ==  ]]; 
  EKS_STATUS=
  EKS_VERSION=
  OIDC_ISSUER=
   [[  ==  && -n  ]]; 
    record eks PASS 
   [[  ==  ]]; 
    record eks FAIL 
  
    record eks FAIL 
  



 -t NODEGROUPS < <(aws eks list-nodegroups --cluster-name  --region  --query  --output text 2>/dev/null |   )
 ng  ; 
  [[ -z  ]] && 
  role_arn=
  [[ -n  &&  !=  ]] && NODE_ROLE_ARNS+=()



NODES_JSON=
SYSTEM_COUNT=
COMPUTE_COUNT=
GPU_COUNT=
NOT_READY=ReadyTrue
GPU_DETAILS=node.kubernetes.io/instance-typeunknown, topology.kubernetes.io/zoneunknown; 
NODE_DETAIL=
 [[  -gt 0 ]]; 
  record nodes FAIL 
 [[  -eq 0 ]]; 
  record nodes FAIL 
 [[  -eq 0 &&  ==  ]]; 
  record nodes WARN 
 [[  -eq 0 ]]; 
  record nodes FAIL 

  record nodes PASS 



ECR_REPO_JSON=
ECR_REPOS=
 -t ECR_REPO_ARNS < <(  | jq -r )
ECR_REPO_COUNT=
 [[  -eq 0 ]]; 
  record ecr-pull WARN 

  ECR_AUTH_ACTION=(ecr:GetAuthorizationToken)
  ECR_REPO_ACTIONS=(ecr:BatchCheckLayerAvailability ecr:GetDownloadUrlForLayer ecr:BatchGetImage)
  all_allowed=
  sim_available=
   role_arn  ; 
    auth_sim_json=
    repo_sim_json=
     [[  -gt 0 ]]; 
      repo_sim_json=
    
     [[ -z  || (  -gt 0 && -z  ) ]]; 
      sim_available=
      role_name=
      attached=
       [[  != ** &&  != ** ]]; 
        all_allowed=
      
    
      denied=
       [[  -gt 0 ]]; 
        repo_denied=
        denied=$((denied + repo_denied))
      
      [[  -gt 0 ]] && all_allowed=
    
  
   [[  ==  ]]; 
     [[  -gt 0 ]]; 
      record ecr-pull PASS 
    
      record ecr-pull PASS 
    
   [[  ==  ]]; 
    record ecr-pull WARN 
  
    record ecr-pull FAIL 
  



 [[ -z  ]]; 
  record s3-rbac WARN 
 [[  -eq 0 && -z  ]]; 
  record s3-rbac WARN 

  S3_ROLE_ARN=
  s3_sim=
   [[ -z  ]]; 
    record s3-rbac WARN 
  
    denied=
     [[  -eq 0 ]]; 
      record s3-rbac PASS 
    
      record s3-rbac FAIL 
    
  



PODS_JSON=
GPU_OP_TOTAL=
GPU_OP_NOT_READY=ReadyTrue
GPU_OP_READY=$((GPU_OP_TOTAL - GPU_OP_NOT_READY))
CHART_VER=
 [[  -eq 0 ]]; 
  record gpu-op FAIL 
 [[  -eq 0 ]]; 
   [[ -n  && -n  &&  !=  ]]; 
    record gpu-op WARN 
  
    record gpu-op PASS 
  

  record gpu-op FAIL 



GPU_RESOURCE_NODES=
GPU_RESOURCE_TOTAL=
 [[  -gt 0 ]]; 
  record gpu-resource PASS 
 [[  ==  ]]; 
  record gpu-resource WARN 

  record gpu-resource FAIL 



SMOKE_POD=
() {
  kubectl --context  delete pod  --ignore-not-found >/dev/null 2>&1 || 
}
 [[  ==  ]]; 
  record cuda-smoke WARN 
 [[  -eq 0 ]]; 
  record cuda-smoke WARN 

   cleanup_smoke EXIT
  kubectl --context  run  \
    --image= \
    --restart=Never \
    --overrides= \
    >/dev/null 2>&1
  end=$((SECONDS + TIMEOUT_MIN * ))
  phase=
   (( SECONDS < end )); 
    phase=
    [[  ==  ||  ==  ]] && 
     5
  

   [[  ==  ]]; 
    GPU_MODEL=
    record cuda-smoke PASS 
  
    detail=
    pod_log=
    [[ -n  ]] && detail=
    record cuda-smoke FAIL 
  
  cleanup_smoke
   - EXIT



S3_POD=
() {
  kubectl --context  delete pod  -n  --ignore-not-found >/dev/null 2>&1 || 
}
 [[  ==  || -z  || -z  ]]; 
  record s3-probe WARN 

   cleanup_s3_probe EXIT
  kubectl --context  run  -n  \
    --image= \
    --restart=Never \
    --overrides= \
    >/dev/null 2>&1
   kubectl --context   pod  -n  --=jsonpath==Succeeded --= >/dev/null 2>&1; 
    record s3-probe PASS 
  
    phase=
    record s3-probe FAIL 
  
  cleanup_s3_probe
   - EXIT



  \
        \
  | jq . > 

 
 
 

[[  -gt 0 ]] &&  1 ||  0

Validation Checklist

• Report uses Azure-compatible cluster, timestamp, summary, checks[].id, checks[].status, and checks[].detail fields.
• Preflight exits with code 2 if a tool is missing or the cluster is unreachable.
• Account check validates AWS_ACCOUNT_ID when supplied.
• VPC check reports the EKS VPC CIDR and attached subnet names/CIDRs.
• EKS check requires ACTIVE and OIDC issuer.
• Node check verifies node-type=system and node-type=gpu; ALLOW_GPU_ZERO=true downgrades missing GPU nodes to WARN.
• ECR pull check proves required read actions with IAM simulation when possible, with managed-policy fallback.
• Optional S3 RBAC and S3 probe checks WARN when not configured.
• GPU Operator check inspects pod Ready conditions, not just pod phase.
• CUDA smoke pod requests one GPU, waits for Succeeded, and is deleted on every exit path.
• No secret values, kubeconfig contents, ECR passwords, or AWS credentials are printed.