Automation on EKS
Automation on EKS answers three separate questions, and the tools here each answer one of them:
| Question | Layer | Tools |
|---|---|---|
| How does a commit become a tested, published image? | Continuous delivery | AWS CodePipeline, or any CI system |
| How does the cluster come to match what is declared in Git? | GitOps | Argo CD, Flux |
| How do workloads get the AWS resources they depend on? | Control planes | AWS Controllers for Kubernetes (ACK), Crossplane, kro |
How they fit together
commit ─► pipeline: build, test, scan, push image ─► updates the image digest in the config repo
│
GitOps controller watches the repo
│
applies Deployments, Services … AND infrastructure requests
│
control plane controllers create queues, buckets, databases, IAM
The pipeline never needs credentials for the cluster, the cluster’s desired state is entirely in Git, and infrastructure follows the same review and rollback path as application changes.
Continuous delivery
- AWS CodePipeline — an AWS-native pipeline with CodeBuild, the EKS deploy action, access for pipeline roles and private clusters.
For pipeline structure regardless of tool, see pipeline design and GitHub Actions.
GitOps
- Argo CD — a central controller with a UI; hub-and-spoke deployment to many clusters using IAM instead of static credentials.
- Flux — a controller in every cluster, pull-only, with native Helm releases and SOPS decryption through KMS.
Both are sound. Choose Argo CD when people want visibility and a central view; choose Flux when you want each cluster to converge by itself with no hub. The principles are in GitOps basics.
Control planes
- ACK — AWS resources as Kubernetes objects, one controller per service, maintained by AWS.
- Crossplane — multi-cloud providers plus your own APIs defined with compositions.
- kro — group existing resources into a new API with a single definition; pairs naturally with ACK.
| ACK | Crossplane | kro | |
|---|---|---|---|
| Creates cloud resources | Yes, AWS only | Yes, many providers | No — orchestrates other controllers |
| Custom platform APIs | No | Yes | Yes |
| Learning curve | Low | High | Low |
These complement rather than replace Terraform: foundations that change rarely and benefit from a reviewed plan stay there; resources that belong to an application’s lifecycle can move to a control plane.
Managed options
EKS offers Argo CD, ACK and kro as managed EKS Capabilities, where AWS runs the controllers outside your cluster. That removes upgrades and scaling of the tooling itself, at the cost of some customisation. Worth considering before self-installing, especially for a hub cluster.
Choosing a starting point
- Start with GitOps for workloads. It gives the largest gain for the least risk.
- Keep infrastructure in Terraform until teams are clearly blocked waiting for it.
- Add ACK for the few resource types teams request most often.
- Add kro or Crossplane when you want to offer those as simple, opinionated APIs — golden paths.