EKS Concepts

On EKS there are no master nodes in your account. The control plane is AWS-managed and never shows up in your EC2 list or kubectl get nodes.

A container is one running image. A pod is the unit Kubernetes schedules, and it can hold several containers that share one IP.

A Deployment's pods are interchangeable. A StatefulSet's pods each keep a stable name and their own volume.

A namespace scopes names and RBAC, but on its own it doesn't block network traffic between namespaces. That takes Network Policies.

A Service gives pods one stable address at layer 4. An Ingress adds HTTP routing by host and path in front of many Services.

CoreDNS turns a name into the Service's IP. kube-proxy turns that Service IP into a pod's IP.

Liveness failure restarts the container; readiness failure only stops traffic to it. Checking a slow dependency in a liveness probe causes restart loops.

A request is a reservation used for placement; a limit is a hard cap. A container can use more than its request, up to its limit.

A Deployment's pods are interchangeable, and any volume claim they use is the same one for all. A StatefulSet's pods each get their own name and their own volume.

A Deployment runs a set number of replicas wherever they fit. A DaemonSet ties the count to nodes: one per node.

A Deployment restarts pods that exit, to keep them running. A Job is done once its pods succeed.

Overlay plugins give pods addresses from a separate range and wrap their traffic in tunnels. The VPC CNI uses real VPC addresses, with no encapsulation.

A LoadBalancer Service gets its own load balancer, one per Service, at layer 4. An Ingress shares one HTTP load balancer across many Services.

Gateway API is the newer, more expressive successor. It splits the entry point (Gateway) from the routes (HTTPRoute), so platform and app teams own different parts.

Network Policies filter pod-to-pod traffic by labels inside the cluster. Security groups for pods apply AWS security groups to a pod, mostly to control access to AWS resources like RDS.

Ingress is one object, with most features in vendor-specific annotations. Gateway API is several typed objects with those features built in.

A mesh runs a proxy beside every Pod to route traffic. VPC Lattice is a managed AWS service outside the cluster that routes across VPCs and accounts. You need at most a signing sidecar when you use IAM auth.

Security groups for pods are AWS-level rules on a pod's network interface. Network Policies are Kubernetes rules between pods, based on labels.

Putting nodes in private subnets doesn't make the API private. Endpoint access is a separate cluster setting.

max-pods only caps how many pods the kubelet accepts. Raising it without more IPs just creates pods that can't get an address.

Ingress handles traffic coming into the cluster. A mesh handles traffic between services inside it.

A node group holds instance types you chose and needs Cluster Autoscaler to resize it. Karpenter picks instance types per pending pod and launches them itself.

EKS Anywhere runs the whole cluster, control plane included, on your own infrastructure. Hybrid Nodes keep the control plane in AWS and add your machines as nodes.

A toleration only allows a pod onto a tainted node; it doesn't send it there. Affinity is what attracts it, so dedicated nodes usually need both.

By default a pod asks for whole GPUs, and they aren't shared like CPU, so packing, cost and slow starts from large images and models need planning.

HPA adds pods. Karpenter or Cluster Autoscaler add nodes when those pods don't fit.

HPA on its own usually scales on metrics like CPU, and a CPU-based HPA never goes below one replica. KEDA feeds an HPA event metrics and scales to and from zero itself.

Cluster Autoscaler resizes Auto Scaling groups you defined. Karpenter chooses instance types per workload and launches them directly.

Cluster Autoscaler resizes node groups you defined. Karpenter picks the instance type per pending pod and launches it itself.

A PodDisruptionBudget limits how many of an app's pods may be evicted at once. A NodePool disruption budget limits how many of that NodePool's nodes Karpenter may disrupt at once.

Savings Plans lower On-Demand rates in exchange for a 1- or 3-year $/hour commitment, and they don't apply to Spot. Spot needs no commitment and is cheaper, but it can be reclaimed.

Fargate gives each pod its own node that AWS fully manages. Auto Mode runs normal EC2 nodes for many pods, so DaemonSets still work, but you can't log in to or customize the nodes.

Replicas say how many pods should run. A PodDisruptionBudget says how many may be taken down on purpose at the same time.

An OOM kill is the kernel killing one container that went over its memory limit. An eviction is the kubelet removing whole pods to protect the node.

On EKS, IAM proves who you are to the cluster. RBAC decides what you're allowed to do inside it.

Access entries control who can call the cluster's API. Pod Identity controls what a pod can do in AWS.

Without either, pods can fall back to the node's instance role, so every pod on that node shares the same AWS permissions.

Pod Security Admission enforces three fixed profiles. Kyverno or Gatekeeper let you write any rule, like "images only from our registry".

Admission policies block bad objects before they're stored. Inspector and GuardDuty find problems in images and in workloads that are already running.

Pod Security Admission is built in and fixed to three profiles. Policy engines are add-ons that enforce whatever rules you write.

base64 is encoding anyone can reverse, not encryption. Protection comes from RBAC and encrypting Secrets at rest.

A Kubernetes Secret lives in the cluster. These tools keep AWS as the source of truth: External Secrets copies values into Secrets, and the CSI driver mounts them as files.

EBS is block storage attached to one node at a time, in one zone. EFS is a shared file system many pods can mount across zones.

A gp3 EBS volume attaches to one node at a time, in one zone. EFS is a network file system that pods on many nodes, in every zone with a mount target, can mount at once.

Helm fills templates with variables. Kustomize patches plain YAML with overlays, with no templating.

Helm fills templates with values and tracks releases. Kustomize patches real YAML and keeps no release history.

A CI pipeline pushes changes into the cluster and needs cluster credentials. GitOps pulls from Git from inside the cluster, so CI never needs cluster access.

A Deployment's rolling update replaces pods as they become ready, not by share of traffic or by business metrics, and it doesn't roll back on its own.

Terraform changes things when you run it. ACK controllers keep reconciling like any Kubernetes controller, so AWS resources fit the same GitOps flow as your apps.

A chart you install yourself is yours to version and upgrade. An EKS add-on's versions are tested by AWS against your cluster version.

metrics-server only keeps current CPU and memory, for autoscaling and kubectl top. It isn't a monitoring system and keeps no history.

Cost Explorer shows what you spent on EC2 instances. Allocation splits that spend across the pods and teams that used it.

Load testing checks behaviour under more traffic. Failure testing checks behaviour when parts of the system break.

Upgrading the control plane doesn't upgrade nodes. Nodes may lag the control plane within the supported version skew, but never run ahead of it.