76.6 Project 45: Production EKS cluster on AWS
Friends, EKS is Kubernetes with an AWS-managed control plane. Today we write a production plan: VPC, node groups, kubeconfig, add-ons, IRSA, logging and upgrade order — without spending unless you choose to.
मित्रांनो, EKS म्हणजे AWS-managed control plane. आज VPC, node groups, kubeconfig, add-ons, IRSA, logging, upgrade order — खर्च optional.
दोस्तों, EKS मतलब AWS-managed control plane. आज VPC, node groups, kubeconfig, add-ons, IRSA, logging, upgrade order — खर्च optional.
What you will build in this project
- eks-plan.yaml notebook.
- IRSA ServiceAccount example.
- CLI tips for kubeconfig and add-ons.
- Upgrade order note.
1. Start from a real company story
At Zepto in Bengaluru, Rohan rebuilt a single-AZ EKS after a zone blip took checkout down.
Three AZs and private API endpoints became the checklist. Rough past cost: about ₹80 lakh in lost orders.
Today we write that checklist.
Ravindra Bagale's Tip
Students enable a public API with 0.0.0.0/0 because kubectl is easy. Lock CIDRs or go private. Keep that habit.
Students public API 0.0.0.0/0 ठेवतात. CIDR lock किंवा private. सवय ठेवा.
Students public API 0.0.0.0/0 रखते हैं. CIDR lock या private. आदत रखिए.
2. Start and prepare
Step 1: Why EKS
Why: Managed control plane. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: a1
Type this:
echo 'EKS is Amazon Elastic Kubernetes Service: control plane managed by AWS'
You will see:
EKS is Amazon Elastic Kubernetes Service: control plane managed by AWS
What it means: What EKS is.
Example 2: a2
Type this:
echo 'You still own node groups networking add-ons and IAM'
You will see:
You still own node groups networking add-ons and IAM
What it means: Shared responsibility.
Example 3: a3
Type this:
echo 'Today we sketch a production-shaped plan with CLI tips — no spend required for the notebook'
You will see:
Today we sketch a production-shaped plan with CLI tips — no spend required for the notebook
What it means: Lab note.
Step 2: AWS CLI list
Why: Identity. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: aws sts. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: b1
Type this:
echo 'aws sts get-caller-identity'
You will see:
aws sts get-caller-identity
What it means: Confirm AWS identity.
Example 5: b2
Type this:
echo 'aws eks list-clusters --region ap-south-1'
You will see:
aws eks list-clusters --region ap-south-1
What it means: List clusters in Mumbai.
Example 6: b3
Type this:
echo 'Plan VPC first: public and private subnets across three AZs'
You will see:
Plan VPC first: public and private subnets across three AZs
What it means: Network first.
Step 3: Plan YAML
Why: Write the plan. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: printf plan. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: c1
Type this:
mkdir -p /tmp/k8s45 && printf '%s\n' 'cluster_name: shop-prod' 'region: ap-south-1' 'version: "1.29"' 'vpc:' ' cidr: 10.20.0.0/16' ' private_subnets: [10.20.1.0/24, 10.20.2.0/24, 10.20.3.0/24]' ' public_subnets: [10.20.11.0/24, 10.20.12.0/24, 10.20.13.0/24]' 'node_groups:' ' general:' ' instance_types: [m5.large]' ' desired: 3' ' min: 2' ' max: 6' > /tmp/k8s45/eks-plan.yaml && cat /tmp/k8s45/eks-plan.yaml
You will see:
cluster_name: shop-prod
What it means: Notebook plan as YAML.
Example 8: c2
Type this:
echo 'eksctl create cluster -f cluster.yaml # when you use eksctl'
You will see:
eksctl create cluster -f cluster.yaml # when you use eksctl
What it means: eksctl tip.
Example 9: c3
Type this:
echo 'Terraform aws_eks_cluster is the IaC path used in later projects'
You will see:
Terraform aws_eks_cluster is the IaC path used in later projects
What it means: Bridge to Terraform.
3. Build the main pieces
Step 4: Endpoint kubeconfig
Why: Connect kubectl. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: update-kubeconfig. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: d1
Type this:
echo 'Private API endpoint recommended for prod; public only with CIDR allow list'
You will see:
Private API endpoint recommended for prod; public only with CIDR allow list
What it means: API endpoint tip.
Example 11: d2
Type this:
echo 'aws eks update-kubeconfig --name shop-prod --region ap-south-1'
You will see:
aws eks update-kubeconfig --name shop-prod --region ap-south-1
What it means: Write kubeconfig.
Example 12: d3
Type this:
echo 'kubectl get nodes -o wide'
You will see:
kubectl get nodes -o wide
What it means: Nodes should show Ready.
Step 5: Node groups scale
Why: Compute. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: nodegroups. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: e1
Type this:
echo 'Managed node groups vs Fargate: nodes for most apps; Fargate for bursty jobs'
You will see:
Managed node groups vs Fargate: nodes for most apps; Fargate for bursty jobs
What it means: Compute choices.
Example 14: e2
Type this:
echo 'aws eks list-nodegroups --cluster-name shop-prod --region ap-south-1'
You will see:
aws eks list-nodegroups --cluster-name shop-prod --region ap-south-1
What it means: List node groups.
Example 15: e3
Type this:
echo 'Enable cluster autoscaler or Karpenter for scale'
You will see:
Enable cluster autoscaler or Karpenter for scale
What it means: Autoscaling tip.
Step 6: Add-ons IRSA
Why: AWS rights for Pods. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: addons. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: f1
Type this:
echo 'Add-ons: vpc-cni coredns kube-proxy ebs-csi are baseline'
You will see:
Add-ons: vpc-cni coredns kube-proxy ebs-csi are baseline
What it means: Managed add-ons.
Example 17: f2
Type this:
echo 'aws eks list-addons --cluster-name shop-prod --region ap-south-1'
You will see:
aws eks list-addons --cluster-name shop-prod --region ap-south-1
What it means: List add-ons.
Example 18: f3
Type this:
echo 'IRSA: IAM Roles for Service Accounts — pods assume AWS roles without node keys'
You will see:
IRSA: IAM Roles for Service Accounts — pods assume AWS roles without node keys
What it means: IRSA tip.
4. Automate and verify
Step 7: IRSA SA YAML
Why: Annotation. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: printf sa. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: g1
Type this:
printf '%s\n' 'apiVersion: v1' 'kind: ServiceAccount' 'metadata:' ' name: s3-reader' ' namespace: shop' ' annotations:' ' eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/shop-s3-reader' > /tmp/k8s45/sa-irsa.yaml && cat /tmp/k8s45/sa-irsa.yaml
You will see:
eks.amazonaws.com/role-arn: ...
What it means: IRSA annotation example.
Example 20: g2
Type this:
echo 'Never put long-lived AWS keys in Pod env for EKS apps'
You will see:
Never put long-lived AWS keys in Pod env for EKS apps
What it means: Secret habit.
Example 21: g3
Type this:
echo 'OIDC provider is created with the cluster for IRSA'
You will see:
OIDC provider is created with the cluster for IRSA
What it means: OIDC tip.
Step 8: Logging KMS
Why: Audit. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: logging. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: h1
Type this:
echo 'Control plane logs: api audit authenticator controller manager scheduler to CloudWatch'
You will see:
Control plane logs: api audit authenticator controller manager scheduler to CloudWatch
What it means: Logging tip.
Example 23: h2
Type this:
echo 'aws eks update-cluster-config --name shop-prod --logging ...'
You will see:
aws eks update-cluster-config --name shop-prod --logging ...
What it means: Enable logging CLI tip.
Example 24: h3
Type this:
echo 'Encrypt secrets with a customer KMS key for prod'
You will see:
Encrypt secrets with a customer KMS key for prod
What it means: KMS tip.
Step 9: Status tags
Why: Health. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: describe. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: i1
Type this:
echo 'aws eks describe-cluster --name shop-prod --query cluster.status'
You will see:
aws eks describe-cluster --name shop-prod --query cluster.status
What it means: Cluster status.
Example 26: i2
Type this:
echo 'kubectl get pods -A | head'
You will see:
kubectl get pods -A | head
What it means: System Pods healthy.
Example 27: i3
Type this:
echo 'Tag resources with Owner CostCenter Env for bills'
You will see:
Tag resources with Owner CostCenter Env for bills
What it means: Cost tags.
5. Harden and accept
Step 10: Upgrade order
Why: Upgrade. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: update-version. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: j1
Type this:
echo 'Upgrade tip: bump node AMI and add-ons before control plane minor version'
You will see:
Upgrade tip: bump node AMI and add-ons before control plane minor version
What it means: Upgrade order.
Example 29: j2
Type this:
echo 'aws eks update-cluster-version --name shop-prod --kubernetes-version 1.30'
You will see:
aws eks update-cluster-version --name shop-prod --kubernetes-version 1.30
What it means: Control plane bump CLI.
Example 30: j3
Type this:
echo 'Project 48 drills zero-downtime upgrades in detail'
You will see:
Project 48 drills zero-downtime upgrades in detail
What it means: Bridge.
Step 11: Cost guard
Why: No surprise bills. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: cost. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: k1
Type this:
echo 'Optional: do not create a real cluster in the free lab unless budget is approved'
You will see:
Optional: do not create a real cluster in the free lab unless budget is approved
What it means: Cost guard.
Example 32: k2
Type this:
echo 'Save eks-plan.yaml and sa-irsa.yaml in your notebook'
You will see:
Save eks-plan.yaml and sa-irsa.yaml in your notebook
What it means: Artifact.
Example 33: k3
Type this:
echo 'Next project deploys a small microservices shop on Kubernetes'
You will see:
Next project deploys a small microservices shop on Kubernetes
What it means: Bridge.
Step 12: Acceptance
Why: Rohan signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: z1
Type this:
echo 'Plan has VPC node groups IRSA and add-ons notes'
You will see:
Plan has VPC node groups IRSA and add-ons notes
What it means: Checklist plan.
Example 35: z2
Type this:
echo 'No long-lived keys in Pods'
You will see:
No long-lived keys in Pods
What it means: Checklist IRSA.
Example 36: z3
Type this:
echo 'Rohan: PASS'
You will see:
Rohan: PASS
What it means: Project 45 accepted.
Check yourself
Q1. Who fixed Zepto?
Rohan
Q2. Mumbai region tip?
ap-south-1
Q3. Pod AWS access pattern?
IRSA
Q4. Baseline CNI add-on?
vpc-cni
Q5. Kubeconfig command family?
aws eks update-kubeconfig
Q6. Upgrade first?
nodes and add-ons
Friends, you sketched a production EKS shape with IRSA and upgrade order. Did you understand? Let us try it once more. Use Terraform in the IaC projects to create it for real.
मित्रांनो, तुम्ही production EKS shape IRSA सह लिहिला. Terraform ने नंतर create करा.
दोस्तों, आपने production EKS shape IRSA के साथ लिखा. Terraform से बाद में create करें.
Lab: try at home
- Confirm AWS identity.
- Write VPC and node plan.
- Note kubeconfig and add-ons.
- Write IRSA SA example.
- Note logging KMS upgrade order.
Recap
- Private API for prod.
- IRSA over node keys.
- Three AZs.
- Baseline add-ons.
- Budget before create.