# Customer configs - Existing EKS Cluster

**URL:** <https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013>\
**Category:** Supporting your customers\
**Created:** [October 14, 2022, 3:45pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013 "2022-10-14T15:45:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikant.pa](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@shrikant.pa](https://community.replicated.com/u/shrikant.pa)\
**Post date:** [October 14, 2022, 3:45pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/1 "2022-10-14T15:45:49Z")

</div>

We have a customer who wants to install app in their existing EKS cluster using airgap bundle.  
After providing them the installation instruction they came back with below questions.

_For security and compliance reasons we need to provide annotations, Pod SecurityContext, Container SecurityContext, k8s service annotations, Pod Label. How do we achive this for KotsAdmin and Application? Can we update the manifest files for KotsAdmin and Application before installation?_

Can someone guide me on how to achieve this as part of installation?

---

<div class="post-metadata">

**Author:** ![jdewinne](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/jdewinne/32/152_2.png) [@jdewinne](https://community.replicated.com/u/jdewinne)\
**Post date:** [October 14, 2022, 4:31pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/2 "2022-10-14T16:31:24Z")

</div>

Hi @shrikant.pa ! Great question.  
One option: `kubectl kots install` has a flag `--strict-security-context` that can be used. Our documentation details also other [additional flags](https://docs.replicated.com/reference/kots-cli-install) that can be used.

Other option: The customer can also [generate the manifest](https://docs.replicated.com/reference/kots-cli-admin-console-generate-manifests) using the `kots admin-console generate-manifests` command. That should give them 100% flexibility to change them to their own needs. Do know that if they change the manifests and it breaks `kotsadm` we might not be able to support.

---

<div class="post-metadata">

**Author:** ![shrikant.pa](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@shrikant.pa](https://community.replicated.com/u/shrikant.pa)\
**Post date:** [October 14, 2022, 4:40pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/3 "2022-10-14T16:40:43Z")

</div>

Thanks @jdewinne.

There are no flags for labels or other things. So I am assuming only option is generating the manifest.  
I have also asked them to provide a spec of these customizations. I will post it here once available.

---

<div class="post-metadata">

**Author:** ![shrikant.pa](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@shrikant.pa](https://community.replicated.com/u/shrikant.pa)\
**Post date:** [October 21, 2022, 6:03pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/4 "2022-10-21T18:03:02Z")

</div>

This is the security SPEC customer wants to apply. How does --strict-security-context works in below context?

```auto
spec:
  serviceAccountName: <non-default-K8s-serviceaccount-name>
  securityContext:
    fsGroup: <min: 1000 max: 65535>
  containers:
  - name: <container-name>
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsGroup: <min: 1000 max: 65535>
      runAsNonRoot: true
      runAsUser: <min: 1000 max: 65535>
      capabilities:
        drop:
        - ALL

```

---

<div class="post-metadata">

**Author:** ![Chris\_Sanders](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/chris_sanders/32/501_2.png) [@Chris\_Sanders](https://community.replicated.com/u/Chris_Sanders)\
**Post date:** [October 21, 2022, 7:21pm UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/5 "2022-10-21T19:21:57Z")

</div>

The command line flags allow you to tell KOTS to be a bit more restrictive with what it requires/expects. This include minimal-rbac which can help if the cluster scoped permissions aren’t desired.

However, those are the only options implemented today. The product manager of KOTS has confirmed they have seen requests for more direct customization including labels, annotations, etc. Until those are available modifying the manifests from `generate-manifest` as described above is the only way to do very specific customizations.

If you would like to talk to our product team to ensure they understand your use case for future feature additions please use [https://vendor.replicated.com](https://vendor.replicated.com) → support → Request a Feature and you formally request new features for your use case.

---

<div class="post-metadata">

**Author:** ![roderik](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/roderik/32/570_2.png) [@roderik](https://community.replicated.com/u/roderik)\
**Post date:** [October 24, 2022, 6:33am UTC](https://community.replicated.com/t/customer-configs-existing-eks-cluster/1013/6 "2022-10-24T06:33:14Z")

</div>

I have the same ticket open, tagged as `sc::59455`