Amazon EKS
Amazon Elastic Kubernetes Service (EKS) is AWS's managed Kubernetes control plane. You supply the worker nodes; AWS manages the API server, etcd, and control plane availability. We provision EKS clusters with the networking, IAM, storage, and autoscaling configuration that production workloads require from the first deployment.
Capabilities
What we do with Amazon EKS
New cluster setup
EKS Cluster Provisioning
Complete EKS cluster provisioning with Terraform: VPC networking, node group configuration, managed add-ons, CoreDNS, kube-proxy, VPC CNI, and EBS CSI driver — correct from first deployment.
Pod-level IAM
IAM Roles for Service Accounts (IRSA)
Configuring IRSA so that individual Kubernetes pods can assume specific IAM roles with least-privilege permissions, replacing the insecure pattern of wide node-level IAM policies.
AWS Load Balancer Controller
Load Balancer and Ingress
AWS Load Balancer Controller installation and Ingress configuration that provisions Application Load Balancers and Network Load Balancers automatically from Kubernetes Ingress and Service resources.
Cluster Autoscaler · Karpenter
Cluster Autoscaling
Node autoscaling with Cluster Autoscaler or Karpenter, configured to add and remove nodes based on pod scheduling pressure while respecting availability zone balance and on-demand/spot instance mix.
EBS · EFS · CSI drivers
Persistent Storage
EBS CSI driver for ReadWriteOnce persistent volumes and EFS CSI driver for ReadWriteMany shared storage, with appropriate StorageClass definitions and snapshot policies.
Control plane · Node groups
Cluster Upgrades
EKS version upgrades for control plane and node groups, including add-on compatibility checks, node drain and replacement procedures, and application workload validation before and after the upgrade.
Our approach
Provisioned with Terraform
EKS clusters have a large number of interdependent configuration decisions: VPC subnets, security groups, IAM roles, OIDC provider, node group launch templates, add-on versions. We define all of this in Terraform so that the cluster configuration is documented, reviewable, and reproducible.
IRSA replaces node IAM policies
Attaching broad IAM policies to EKS node group IAM roles gives every pod on those nodes access to those permissions. IRSA associates a Kubernetes service account with an IAM role so only the pods that use that service account get those permissions. We configure IRSA for every service that needs AWS API access.
Spot instances require disruption tolerance
Spot instances can reduce EKS node costs significantly but require the application to tolerate node termination. We configure pod disruption budgets, graceful shutdown hooks, and Spot interruption handlers so that Spot node terminations do not cause service disruptions.
Managed add-ons simplify upgrades
EKS Managed Add-ons for VPC CNI, CoreDNS, kube-proxy, and EBS CSI driver receive AWS-managed updates that respect the cluster version. We use managed add-ons rather than self-managed Helm charts for these components so that upgrades are less manual.
All engineering work is done by US-based engineers. We do not offshore any development or architecture work.
Part of our container practice
FAQ
Common questions
Virginia · United States
Need Amazon EKS expertise?
If you are setting up a new EKS cluster or need help with an existing one, reach out and we will assess the configuration before any work begins.