<p>error when creating "pod-defination.yml": </p>

<blockquote>
  <p>pods "myapp" is forbidden: pod does not have
  "kubernetes.io/config.mirror" annotation, node
  "ip-172-31-38-73.us-east-2.compute.internal" can only create mirror
  pods</p>
</blockquote>

<pre><code>apiVersion: v1  

kind: Pod 

metadata:
   labels:
     app: myapp
spec:
   containers:
      - name: nginx-container
      - image: nginx
</code></pre>

Jaydeep Gami
<p>So, you have 3 problems in one here. This is partial answer unfortunately.</p>

<p>1)  @Dinesh is absolutely right with an image.</p>

<pre><code>   containers:
      - name: nginx-container
      - image: nginx
</code></pre>

<p>With your config it tries to use 2 images - <code>nginx-container</code> and <code>nginx</code>. Instead of this you want only <code>nginx</code> with name: nginx-container</p>

<p>correct is </p>

<pre><code>spec:
  containers:
  - name: nginx-container
    image: nginx
</code></pre>

<p>2) You should always set <code>name:</code> in metadata - this is required field. Without specifying .metadata.name you will get <code>resource name may not be empty</code></p>

<pre><code>Object: &amp;{map["apiVersion":"v1" "kind":"Pod" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "labels":map["app":"myapp"] "namespace":"default"] "spec":map["containers":[map["image":"nginx" "name":"nginx-container"]]]]}
from server for: "pod-defination.yml": resource name may not be empty
</code></pre>

<p>As per <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/#required-fields" rel="nofollow noreferrer">Understanding Kubernetes Objects</a></p>

<blockquote>
  <p>In the .yaml file for the Kubernetes object you want to create, you’ll
  need to set values for the following fields:</p>
  
  <ul>
  <li>apiVersion - Which version of the Kubernetes API you’re using to    create this object </li>
  <li>kind - What kind of object you want to create</li>
  <li>metadata - Data that helps uniquely identify the object, including a    name string, UID, and optional namespace </li>
  <li>spec - What state you desire    for the object</li>
  </ul>
</blockquote>

<p>Also as per <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata" rel="nofollow noreferrer">metadata API Conventions</a></p>

<blockquote>
  <p>Every object kind MUST have the following metadata in a nested object
  field called "metadata":</p>
  
  <ul>
  <li>namespace: a namespace is a DNS compatible label that objects are subdivided into. The default namespace is 'default'. See the namespace
  docs for more.</li>
  <li>name: a string that uniquely identifies this object within the current namespace (see the identifiers docs). This value is used in
  the path when retrieving an individual object.</li>
  <li>uid: a unique in time and space value (typically an RFC 4122 generated identifier, see the identifiers docs) used to distinguish
  between objects with the same name that have been deleted and
  recreated</li>
  </ul>
</blockquote>

<p>3)pod does not have "kubernetes.io/config.mirror" annotation</p>

<blockquote>
  <p>pods "blabla" is forbidden: pod does not have
  "kubernetes.io/config.mirror" annotation, node "blablabla" can only
  create mirror pods</p>
</blockquote>

<p>Above error is typical for situations when you have an issue with [NodeRestriction admission plugin]{<a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction</a>}</p>

<blockquote>
  <p>An admission controller is a piece of code that intercepts requests to
  the Kubernetes API server prior to persistence of the object, but
  after the request is authenticated and authorized. […] Admission
  controllers may be “validating”, “mutating”, or both. Mutating
  controllers may modify the objects they admit; validating controllers
  may not. […] If any of the controllers in either phase reject the
  request, the entire request is rejected immediately and an error is
  returned to the end-user.</p>
</blockquote>

<p>NodeRestriction admission controller:</p>

<blockquote>
  <p>This admission controller limits the Node and Pod objects a kubelet
  can modify. In order to be limited by this admission controller,
  kubelets must use credentials in the system:nodes group, with a
  username in the form system:node:. Such kubelets will only
  be allowed to modify their own Node API object, and only modify Pod
  API objects that are bound to their node. In Kubernetes 1.11+,
  kubelets are not allowed to update or remove taints from their Node
  API object.</p>
</blockquote>

<p>As per <a href="https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html" rel="nofollow noreferrer">EKS kubernetes platform versions</a> we can see that <code>NodeRestriction</code> is part of Enabled Admission Controllers.</p>

<blockquote>
  <p>​NamespaceLifecycle, LimitRanger, ServiceAccount, DefaultStorageClass,
  ResourceQuota, DefaultTolerationSeconds, NodeRestriction,
  MutatingAdmissionWebhook, ValidatingAdmissionWebhook, PodSecurityPolicy</p>
</blockquote>

<p>3 month ago there was already <a href="https://stackoverflow.com/questions/58439973/is-it-possible-adviseable-to-turn-off-the-noderestriction-plugin-on-eks">same question</a> but it left without any replies.</p>

<p>As EKS in managed by AWS control plane - seems it is not possible modify built-in admission controllers, but you can look into the Dynamic Admission Controllers and Admission Webhooks.   More info can be found in <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">Dynamic Admission Control</a>.</p>

<p>As per <a href="https://aws.amazon.com/about-aws/whats-new/2018/10/amazon-eks-enables-support-for-kubernetes-dynamic-admission-cont/" rel="nofollow noreferrer">Amazon EKS Enables Support for Kubernetes Dynamic Admission Controllers</a> - EKS supports dynamic admission controllers, allowing customers to deploy custom webhooks that enable additional open source tools for controlling network traffic and monitoring Kubernetes clusters on AWS.</p>

<p>I would recommend you use <a href="https://github.com/kubernetes/kops" rel="nofollow noreferrer">kops</a> to manually create cluster with all the option you need.</p>

<p>Hope it helps</p>
