Quick Read: Amazon EKS Clusters Explained

Key Takeaways

• An Amazon EKS cluster is managed Kubernetes — AWS runs the control plane (API server, etcd, scheduler); you run the worker nodes and workloads.
• Worker nodes come in three flavors: self-managed EC2, managed node groups, or Fargate (serverless, no node management at all).
• EKS integrates deeply with AWS networking (VPC CNI), IAM (IRSA — IAM Roles for Service Accounts), and load balancing (AWS Load Balancer Controller).
• Cluster creation can be done via eksctl, Terraform, or the console — eksctl is fastest for getting a working cluster in minutes.
• Cost and operational overhead both drop significantly if you lean on managed node groups or Fargate instead of self-managing EC2 workers.

What an EKS Cluster Is, Structurally

Kubernetes has two halves: the control plane (API server, scheduler, etcd, controller manager) and the data plane (the nodes that actually run your pods). With self-hosted Kubernetes, you manage both. With Amazon EKS, AWS manages the control plane — patched, highly available across multiple AZs, backed by SLA — and you bring or let AWS manage the data plane.

Choosing a Compute Model

Creating a Cluster with eksctl

eksctl remains the fastest path to a working cluster.

# Create an EKS cluster with a managed node group
eksctl create cluster \
  --name f9-prod-cluster \
  --region us-east-1 \
  --version 1.29 \
  --nodegroup-name standard-workers \
  --node-type m5.large \
  --nodes 3 \
  --nodes-min 2 \
  --nodes-max 6 \
  --managed

# Equivalent declarative config: cluster.yaml
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: f9-prod-cluster
  region: us-east-1
  version: "1.29"
managedNodeGroups:
  - name: standard-workers
    instanceType: m5.large
    desiredCapacity: 3
    minSize: 2
    maxSize: 6

eksctl create cluster -f cluster.yaml

Terraform for Repeatable Infrastructure

Most production teams provision EKS through Terraform rather than one-off CLI commands, using the widely adopted terraform-aws-modules/eks module.

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "f9-prod-cluster"
  cluster_version = "1.29"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  eks_managed_node_groups = {
    standard = {
      instance_types = ["m5.large"]
      min_size       = 2
      max_size       = 6
      desired_size   = 3
    }
  }
}

IAM Roles for Service Accounts (IRSA)

Rather than giving every pod the EC2 instance role's permissions, EKS supports IRSA, letting individual Kubernetes service accounts assume scoped IAM roles via OIDC federation.

eksctl create iamserviceaccount \
  --cluster f9-prod-cluster \
  --namespace default \
  --name app-service-account \
  --attach-policy-arn arn:aws:iam::123456789012:policy/AppS3ReadPolicy \
  --approve

# Kubernetes deployment referencing the IRSA-bound service account
apiVersion: apps/v1
kind: Deployment
metadata:
  name: f9-app
spec:
  template:
    spec:
      serviceAccountName: app-service-account
      containers:
        - name: app
          image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/f9-app:latest

Networking Essentials

• The VPC CNI plugin assigns each pod a real VPC-routable IP address, so pods behave like first-class VPC citizens for security group and NACL purposes.
• The AWS Load Balancer Controller provisions ALBs/NLBs automatically from Kubernetes Ingress and Service resources.
• Private subnets for worker nodes, with a NAT gateway for outbound internet, is the standard production pattern.

Operating the Cluster

# Common day-two commands
kubectl get nodes
kubectl get pods -A
kubectl top nodes            # requires metrics-server
aws eks update-kubeconfig --name f9-prod-cluster --region us-east-1

Enable control plane logging (API server, audit, authenticator) through the console or CLI for visibility into cluster-level events:

aws eks update-cluster-config \
  --name f9-prod-cluster \
  --logging '{"clusterLogging":[{"types":["api","audit","authenticator"],"enabled":true}]}'

FAQ

What's the difference between EKS and ECS? ECS is AWS's own container orchestrator with a simpler model; EKS runs upstream Kubernetes, giving you portability and the full Kubernetes ecosystem at the cost of more complexity.

Does EKS support Fargate for all workloads? Most stateless workloads work well on Fargate, but some use cases (DaemonSets, privileged containers, certain storage drivers) require EC2-backed nodes.

How much does an EKS cluster cost? There's a per-cluster hourly control plane fee plus the cost of whatever EC2 instances or Fargate capacity runs your workloads — the control plane fee is fixed regardless of cluster size.

Can I run multiple environments in one EKS cluster? Yes, via namespaces for logical separation, though many teams prefer separate clusters per environment for stronger blast-radius isolation.

Get Expert Help Running EKS in Production

Standing up a cluster is the easy part — IRSA, networking, autoscaling, and cost control at scale take real Kubernetes-on-AWS experience. f9infotech's DevOps team can design, migrate, or operate your EKS environment end to end.