Amazon EKS

Amazon Elastic Kubernetes Service (EKS) is a certified conformant Kubernetes managed service that runs upstream Kubernetes on AWS.

While the Kubernetes API contracts, resource definitions (Pod, Deployment, Service, StatefulSet), and scheduling mechanisms remain 100% universal, EKS delegates infrastructure primitives—such as networking, identity, storage, and node lifecycle—to dedicated AWS cloud services.

flowchart LR
    subgraph Universal["Universal Kubernetes Abstraction"]
        K8sAuth["X.509 / OIDC Token"]
        K8sSA["ServiceAccount"]
        K8sNet["CNI IPAM & Service"]
        K8sNode["Kubelet Node Lifecycle"]
        K8sPVC["PersistentVolumeClaim"]
        K8sIngress["Ingress / Gateway API"]
    end

    subgraph AWS["EKS AWS Implementation"]
        IAMAuth["IAM & EKS Access Entries"]
        PodId["EKS Pod Identity / IRSA"]
        VPCCNI["Amazon VPC CNI (ENIs & IPs)"]
        Karpenter["Karpenter & Auto Mode / MNG"]
        CSI["EBS / EFS / FSx CSI Drivers"]
        ALB["AWS Load Balancer Controller / VPC Lattice"]
    end

    K8sAuth -->|Maps to| IAMAuth
    K8sSA -->|Assumes| PodId
    K8sNet -->|Provisions| VPCCNI
    K8sNode -->|Auto-provisions| Karpenter
    K8sPVC -->|Attaches| CSI
    K8sIngress -->|Configures| ALB

---

Universal Concept → EKS Implementation Matrix

Use this matrix to translate core upstream Kubernetes primitives (taught in Levels 01–09) to their production AWS counterparts:

Domain	Universal Kubernetes Concept	AWS / EKS Implementation	Core Concept Link	EKS Track Link
Cluster AuthN	X.509 Client Certificates, Webhook Token	AWS IAM (sts:GetCallerIdentity) + EKS Access Entries	L07 — Security	EKS Security
Cluster AuthZ	RBAC (Role, ClusterRoleBinding)	Kubernetes RBAC combined with IAM Access Policies	03 — RBAC	EKS Security
Workload Identity	Projected ServiceAccount Tokens	EKS Pod Identity (Modern) & IRSA (IAM Roles for Service Accounts)	02 — Service Accounts	EKS Security
Pod Networking	Overlay CNI (Calico, Flannel, Cilium)	Amazon VPC CNI (Direct AWS VPC IP per Pod via ENIs)	L04 — Networking	EKS Networking
Network Isolation	NetworkPolicy resource	VPC CNI Network Policy Engine (eBPF) or Cilium	05 — Network Policy	EKS Networking
Node Autoscaling	Cluster Autoscaler (ASG polling)	Karpenter (Just-in-time NodePool provisioning) or EKS Auto Mode	09 — Cluster Autoscaler	EKS Compute
Compute Pools	Bare-metal / Static VM Kubelets	Managed Node Groups (MNG), AWS Fargate, or Self-Managed Nodes	L01 — Architecture	EKS Compute
Block Storage	ReadWriteOnce Volumes (HostPath / Ceph)	Amazon EBS CSI Driver (gp3, io2)	L05 — Storage	EKS Storage
Shared Storage	ReadWriteMany Volumes (NFS)	Amazon EFS CSI Driver or FSx for NetApp ONTAP	L05 — Storage	EKS Storage
Object Storage	S3 API client libraries in container	Mountpoint for Amazon S3 CSI Driver	L05 — Storage	EKS Storage
L4 Load Balancing	Service type: LoadBalancer	AWS Network Load Balancer (NLB) via AWS Load Balancer Controller	02 — Services	EKS Networking
L7 Routing	Ingress & Gateway API (HTTPRoute)	Application Load Balancer (ALB) & Amazon VPC Lattice Gateway Controller	04 — Ingress	EKS Networking
Secret Management	Kubernetes Secret resource (Base64)	AWS Secrets Manager / Parameter Store via Secrets Store CSI Driver (ASO)	02 — Secrets	EKS Security
Control Plane Metrics	Prometheus /metrics scraping	Amazon CloudWatch Container Insights & Amazon Managed Prometheus (AMP)	04 — Metrics Sources	EKS Observability

---

EKS Architecture Categories

1. Getting Started

Tools, prerequisites, cluster creation with eksctl/Terraform, and first application deployment.

2. Compute

Managed Node Groups, Fargate profiles, Karpenter high-velocity autoscaling, EKS Auto Mode, and Hybrid Nodes.

3. Networking

Amazon VPC CNI, Secondary CIDRs, Security Groups for Pods, eBPF Network Policies, and VPC Lattice service networks.

4. Storage

EBS CSI Driver, EFS CSI Driver, FSx for NetApp ONTAP, FSx for OpenZFS, and Mountpoint for Amazon S3.

5. Security

EKS Access Entries (replacing legacy aws-auth), EKS Pod Identity, IRSA, Secrets Management, GuardDuty runtime monitoring, and Pod Security Standards.

6. Observability

Control plane logging, CloudWatch Container Insights, AWS Distro for OpenTelemetry (ADOT), Prometheus, and Kubecost.

7. Cluster Upgrades

Zero-downtime control plane updates, node group rolling upgrades, addon compatibility matrices, and disaster recovery.

8. Automation

GitOps with Argo CD & Flux, AWS Controllers for Kubernetes (ACK), Crossplane, and CI/CD pipelines.

9. Advanced

Event-driven autoscaling with KEDA, HPA/VPA tuning, advanced multi-tenant networking, and FinOps cost optimization.

10. Troubleshooting

Common EKS failure modes (VPC CNI IP exhaustion, Node NotReady, CoreDNS degradation), diagnostic playbooks, and AWS Support tools.

---

Quick Reference

Common CLI Commands

# Provision cluster via eksctl
eksctl create cluster --name production-cluster --region us-east-1 --version 1.32
 
# Update local kubeconfig context
aws eks update-kubeconfig --region us-east-1 --name production-cluster
 
# List active nodegroups
aws eks list-nodegroups --cluster-name production-cluster
 
# Query EKS Access Entries (Modern AuthN/AuthZ)
aws eks list-access-entries --cluster-name production-cluster

Key Managed Addons

Addon	Upstream Equivalent	Purpose
vpc-cni	Upstream CNI Plugin	Allocates real VPC IPv4/IPv6 addresses directly to Pods
coredns	CoreDNS	Cluster-internal DNS service discovery
kube-proxy	kube-proxy	Implements Kubernetes Service ClusterIP packet routing
aws-ebs-csi-driver	CSI Node Driver	Attaches and mounts Amazon EBS block volumes dynamically
aws-efs-csi-driver	CSI Node Driver	Mounts scalable NFS file shares across multiple Availability Zones

External Resources

• AWS EKS Best Practices Guide
• EKS Official Documentation
• EKS Workshop
• Karpenter Official Documentation

Across the wiki

• Amazon EKS — managed Kubernetes (AWS)
• Azure Kubernetes Service (AKS) Architecture Hub — managed Kubernetes (Azure)
• Google Kubernetes Engine (GKE) — managed Kubernetes (GCP)