FAQ

Does eksreview modify my cluster?

No, not unless you ask it to. It runs read-only by default, using only get/describe/list-style operations. Any change happens only through /fix and requires an explicit confirmation before it runs. You can remove command execution entirely with --no-shell. See the Safety Model.

Does my cluster data leave my machine?

The only data sent off your machine is what goes to Amazon Bedrock for the model (your prompts and the check results the agent reasons over). Reports, the knowledge base, and session state are stored locally. Nothing is uploaded anywhere else. See Data & Cleanup and Handling sensitive information.

What does it cost?

The tool is free and open source, but it calls Claude on Amazon Bedrock, so you incur Bedrock token charges depending on the model and how much work each session does. The EKS/EC2/IAM calls are read-only and effectively free. Use /context to track approximate session cost and /model sonnet to lower it. See Cost.

Which models does it use?

Claude Opus (default) and Sonnet on Amazon Bedrock, via global inference profiles by default. You can switch with /model or pin a regional inference profile with MODEL_ID. See Models & Regions.

Are the results deterministic?

No. eksreview is powered by a generative AI model, so its analysis is non-deterministic and, to a degree, subjective. Running the same review twice can word recommendations differently, order them differently, or occasionally reach slightly different conclusions. The underlying checks that read your cluster are deterministic, but the prioritization, risk assessment, and remediation guidance the model produces are not. Treat the output as expert guidance to review and validate, not as a certified or guaranteed audit.

Does it run on Windows?

macOS and Linux are supported natively. On Windows, run it under WSL, since the install.sh and eksreview launchers are bash scripts. See Prerequisites.

Do I need to run kubectl or set up a kubeconfig?

No. eksreview connects to the Kubernetes API itself using the provided access details. You do need your IAM identity mapped into each cluster you review (an EKS access entry or aws-auth). See Permissions.

Do I need write/admin permissions?

No. For reviews, upgrade-readiness checks, and /investigate, the read-only IAM policy is enough. You only need elevated permissions if you intend to apply remediations with /fix.

Can Bedrock and my EKS cluster be in different AWS accounts?

Yes. The model credentials are independent of the cluster credentials. Use a Bedrock API key (AWS_BEARER_TOKEN_BEDROCK) or the BEDROCK_AWS_* variables for the model, and your default chain for the cluster. See Credentials & Cross-Account.

Can it review more than one cluster?

Yes. Ask it conversationally to review several clusters in one session and it works through them one at a time. The same IAM identity must be mapped into each cluster. See Example Prompts.

A review didn't run / all checks failed. What now?

This is almost always caused by a missing region, missing or wrong credentials, or a cluster your credentials can't see. See Troubleshooting.