Careeroza

EKS

Amazon EKS (Elastic Kubernetes Service) is a fully managed, production-ready container orchestration service that allows you to run upstream Kubernetes on AWS without the operational burden of manually bootstrapping, securing, and maintaining the master infrastructure.

While Amazon ECS is an AWS-native, opinionated container service, EKS brings the entire open-source Kubernetes ecosystem directly onto AWS. It maintains complete conformance with upstream Kubernetes, meaning your standard Kubernetes manifests, Helm charts, and operators deploy seamlessly.


1. The Control Plane Architecture

The single greatest complexity of self-managing Kubernetes is keeping the master control plane highly available. EKS eliminates this by delivering a completely managed, automated Control Plane:

  • Multi-AZ Availability: When you spin up an EKS cluster, AWS automatically provisions and provisions three distinct instances of the Kubernetes API Server and a three-node etcd storage cluster spread evenly across three independent Availability Zones within the region.

  • Automated Repair & Recovery: EKS continuously monitors the health of these master nodes. If an API server becomes unresponsive or an etcd node suffers database corruption, EKS detects the anomaly, tears down the unhealthy node, and provisions a healthy replacement automatically.

  • Zero-Downtime Patching: Upgrading a cluster's minor Kubernetes version (such as moving from 1.34 to 1.35) is handled completely in-place. EKS rolls out updates to the control plane nodes sequentially, maintaining API availability so your deployments and CI/CD pipelines never drop offline during maintenance windows.


2. Core Compute Topologies (The Data Plane)

While AWS completely manages the control plane, your actual container workloads (Pods) execute on Worker Nodes inside your own AWS account and private VPC subnets. You choose how these nodes are provisioned based on three primary operational models:

EKS Auto Mode (Fully Automated)

The modern standard for cloud-native Kubernetes management. It eliminates the operational friction of managing node pools manually.

  • Operational Profile: You deploy your standard Kubernetes manifests containing your Pod specs. EKS leverages built-in, AWS-managed node orchestration scaling engines (built on Karpenter technologies) to inspect your Pod's specific CPU, memory, and topology requirements. It then automatically provisions, right-sizes, and initializes optimal EC2 capacity on-demand.

  • Built-in Maintenance: AWS takes complete ownership of the node lifecycle. It enforces automated rolling operating system patches, updates security baselines, and routinely rotates underlying EC2 instances every 21 days to prevent node degradation.


Managed Node Groups (Co-Managed EC2)

A balanced model where you control the node capacity baseline, but hand over the heavy lifting of machine lifecycle actions to AWS.

  • Operational Profile: EKS automatically provisions and scales standard EC2 instances inside an Auto Scaling Group in your account using specialized Amazon EKS Optimized AMIs.

  • Lifecycle Automation: You can drain, cordon, and upgrade the software dependencies of entire node pools with a single API command or via the console, making mass OS upgrades highly predictable.


AWS Fargate (Serverless Pods)

A completely infrastructure-free data plane model.

  • Operational Profile: Every individual Kubernetes Pod you deploy runs inside its own dedicated, isolated micro-VM security wrapper. There are no EC2 instances to track, view, or manage in your account.

  • Resource Optimization: You pay precisely for the fractional vCPU and memory profiles requested by the Pod manifest, eliminating the financial waste of having half-empty EC2 worker nodes idling in your cluster.


3. Native AWS Infrastructure Integration

EKS acts as a direct bridge, binding open-source Kubernetes primitives to core AWS cloud services:

  • VPC CNI Plugin (Native Networking): EKS uses the Amazon VPC Container Network Interface (CNI) as its default networking engine. Unlike generic Kubernetes overlays that route traffic through a complex virtual bridge network, the VPC CNI assigns every individual Pod its own dedicated Private IPv4/IPv6 address directly from your VPC subnet pool. Pods function as first-class citizens on your cloud network, allowing them to map directly to standard AWS Security Groups, flow through native route tables, and maintain optimal bare-metal network throughput performance.

  • EKS Pod Identity (Secure Access Gates): Containers frequently need to communicate with outer AWS APIs (like pulling data from an S3 bucket or modifying an RDS database table). EKS Pod Identity maps standard IAM Roles directly onto localized Kubernetes Service Accounts. When a Pod initiates an AWS API command, an internal agent dynamically provides short-lived, cryptographic token credentials directly to that specific container, completely removing the risk of hardcoding AWS Access Keys inside your Docker images.

  • AWS Load Balancer Controller: When you declare a Kubernetes standard Ingress or a Service type LoadBalancer inside your code manifests, this controller translates the request into AWS native API calls. It automatically provisions an Application Load Balancer (ALB) or Network Load Balancer (NLB) at the edge of your VPC, registers your worker node interfaces into target groups, and configures routing rules live as your Pods auto-scale.


4. Managed Cluster Tooling: EKS Capabilities

Modern production Kubernetes demands extensive auxiliary software tooling running alongside your core code (such as continuous delivery engines or cross-cloud resource sync tools). Managing the operational overhead of these platforms manually can introduce stability risks.

To streamline this, the service includes EKS Capabilities—a fully managed, extensible array of cloud-native orchestration features that run completely outside your cluster on AWS-maintained infrastructure. This offloads operational patching, scaling, and platform management directly onto AWS. Key integrations include:

  • Managed Argo CD: Automatically manages continuous, GitOps-driven deployment pipelines directly through EKS API controls, pulling declarative application states from your repositories and rendering them onto the cluster without needing manually maintained GitOps server installations.

  • AWS Controllers for Kubernetes (ACK): Allows you to provision and manage native AWS cloud resources (such as S3 buckets, DynamoDB tables, or SQS queues) directly by writing declarative standard Kubernetes Custom Resource Definitions (CRDs) inside your cluster manifest files.

  • Kube Resource Orchestrator (KRO): Streamlines custom platform engineering workflows, allowing infrastructure teams to group and compose complex arrays of separate Kubernetes resources into cleanly structured, repeatable functional component models.