EKS
Amazon Elastic Kubernetes Service (EKS) is the AWS-managed Kubernetes control plane. AWS runs the API servers and etcd; you run the worker nodes and the workloads. In the Web App Blueprint, EKS is the runtime for the API container and for every cluster add-on that supports it.
What it does
EKS gives you a Kubernetes cluster without operating the control plane yourself. You choose the Kubernetes version, the subnets, the node groups and the managed add-ons. AWS patches and scales the control plane, exposes the API endpoint, and writes control-plane logs to CloudWatch. Identity is handled by access entries, which map IAM roles to Kubernetes permissions without editing a config map.
How BuiltForProd uses it
The eks unit in the acme-aws-blueprint-webapp-infra repository creates one cluster per stage, named acme-usw2-dev-eks for dev. Its module wraps the registry module terraform-aws-modules/eks/aws (version 21.25.1) with the platform's defaults:
- Kubernetes 1.36, placed in the private subnets that the AWS Baseline publishes to Parameter Store at
/acme/usw2/dev/vpc/private_subnet_ids. The private API endpoint is always on; the public endpoint is on by default and can be switched off when self-hosted runners are in use. - One managed node group of
t3.mediuminstances with IMDSv2 required. Sizing is a per-stage value inenvironments/<stage>/us-west-2/terragrunt.stack.hcl: dev has a minimum of 2 and a maximum of 3 nodes, staging and prod a minimum of 3 and a maximum of 4, because ArgoCD in HA mode needs three nodes. - All five control-plane log types (api, audit, authenticator, controllerManager, scheduler) go to CloudWatch with 365-day retention.
- Managed add-ons
vpc-cni,coredns,kube-proxy,eks-pod-identity-agentandmetrics-server. The VPC CNI runs its network policy agent, so the application chart's default-deny NetworkPolicy is enforced, and metrics-server supplies the resource metrics API the application's HorizontalPodAutoscalers read. - Access entries for the
acme-terraform-deployerrole and the PlatformAdminAccess permission set, both with cluster admin. The upstream "cluster creator" entry is disabled so the plan is identical whoever runs it.
Every other unit in the stage depends on this one. The AWS Load Balancer Controller, ExternalDNS, the External Secrets Operator, Fluent Bit and ArgoCD are installed onto the cluster with the Helm provider, and the app-namespace unit creates the blueprint-app namespace and its service account.
Two kinds of node
The managed node group is the stable baseline that runs Kubernetes and the system-critical workloads. Karpenter provisions and removes capacity for application workloads. Cluster Autoscaler scales the managed node group itself.
A taint enforces the split rather than convention. The node group carries CriticalAddonsOnly=true:NoSchedule, and every component this repository installs into the cluster sets the matching toleration: the load balancer controller, both ExternalDNS releases, External Secrets, ArgoCD, Fluent Bit, metrics-server and the two autoscalers. The application chart sets none, so its pods cannot land on the baseline and go to Karpenter capacity instead. Setting enable_critical_addons_taint to false shares the node group with the application again.
The node group also carries the Cluster Autoscaler discovery tags, k8s.io/cluster-autoscaler/enabled and k8s.io/cluster-autoscaler/<cluster name>, which EKS propagates to the Auto Scaling group beneath it. The upstream node group resource ignores changes to the desired size, so an apply never fights the controller over it.
Terms you will see
| Term | Meaning |
|---|---|
| Control plane | The Kubernetes API servers and etcd that AWS operates for you. |
| Managed node group | A set of EC2 worker nodes that EKS creates, updates and drains on your behalf. |
| Access entry | The EKS record that grants an IAM role a Kubernetes access policy, such as cluster admin. |
| Managed add-on | A cluster component (CNI, CoreDNS, kube-proxy, Pod Identity agent, metrics-server) that EKS installs and upgrades. |
| Taint and toleration | The node marking that repels pods, and the pod setting that accepts it. |
| Pod Identity | The EKS mechanism that gives a Kubernetes service account an IAM role. |
Where to read more
- Web App Blueprint overview
- Kubernetes for what runs inside the cluster
- Karpenter and Cluster Autoscaler for the two tiers of capacity
- ArgoCD for how workloads reach it
- EC2 for the worker nodes