Amazon EKS Concepts

Internal

• Amazon Elastic Kubernetes Service

EKS Cluster

Worker Node Group

Self-Managed Node Group

Contains self-managed worker nodes. The node group name can be used later to identity the Auto Scaling node group that is created for these worker nodes.

Cluster Service Role

See IAM Role.

AWS Infrastructure Requirements

TODO: Topology diagram

Security Groups

A dedicated security group for each cluster control plane is recommended.

EKS Platform Versions and Kubernetes Versions

Amazon EKS platform version.

SLA

https://aws.amazon.com/eks/sla/

aws-iam-authenticator

Page 17.

aws-iam-authenticator Operations

aws-iam-authenticator

.kube/config Configuration

AWS documentation refers to the Kubernetes configuration file as "kubeconfig".

.kube/config

EKS Security

API Server User Management and Access Control

https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html

When an EKS cluster is created, the IAM entity (user or role) that creates the cluster is automatically granted "system:master" permissions in the cluster's RBAC configuration.

Additional IAM users and roles can be added by editing the "aws-auth" ConfigMap. TODO, Operations.

For more details on how kubectl picks up the caller identity, see Connect to an EKS Cluster with kubectl.

IAM Role

An IAM role is needed when creating the EKS cluster. An IAM role can be created as described here. The use case should be "EKS - Cluster".

When the cluster is created, the identity that created the cluster (user or role) is added to the Kubernetes RBAC authorization table as the administrator (with system:masters permissions). Initially, only that IAM user can make calls to the Kubernetes API server using kubectl. That role is also known as "Cluster Service Role".

EKS IAM Permissions

These are technically "actions", but they are commonly referred to as "permissions", which implies that the action is part of a formal permission construct associated with the entity requiring it.

• eks:DescribeCluster

Pod Security Policy

https://docs.aws.amazon.com/eks/latest/userguide/pod-security-policy.html

Also see:

Pod Security Policy Concepts

By default, the PodSecurityPolicy admission controller is enabled, but a fully permissive security policy with no restrictions, named "eks.privileged" is applied. The permission to "use" "eks.privileged" is imparted by the "eks:podsecuritypolicy:privileged" ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eks:podsecuritypolicy:privileged
rules:
- apiGroups:
  - policy
  resourceNames:
  - eks.privileged
  resources:
  - podsecuritypolicies
  verbs:
  - use

The "eks:podsecuritypolicy:privileged" ClusterRole is bound by the "eks:podsecuritypolicy:authenticated" ClusterRoleBinding to all members of the "system:authenticated" Group, which results in the fact that any authenticated identity can use it.

Autoscaling

Cluster Autoscaler

Kubernetes Cluster Autoscaler

Horizontal Pod Autoscaler

Kubernetes Horizontal Pod Autoscaling

Vertical Pod Autoscaler

Vertical Pod Autoscaling

Load Balancing and Ingress

https://docs.aws.amazon.com/eks/latest/userguide/load-balancing-and-ingress.html

Using an Ingress

Kubernetes Ingress Concepts

Using a NLB

TODO: https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support

TODO: https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws

      annotations:
        service.beta.kubernetes.io/aws-load-balancer-type: 'nlb'
        service.beta.kubernetes.io/aws-load-balancer-security-groups: 'sg-00000000000000000'
        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: 'arn:aws:acm:xx-xxxx-x:xxxxxxxxx:xxxxxxx/xxxxx-xxxx-xxxx-xxxx-xxxxxxxxx'

Also see:

Kubernetes Service Concepts

Storage

Amazon EFS CSI

Amazon EFS CSI

eksctl

eksctl