Kubernetes on AWS (EKS)

# cluster.yaml -- eksctl cluster definition
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: production
  region: us-east-1
  version: "1.30"

# VPC configuration -- eksctl can create a new VPC or use existing subnets
vpc:
  cidr: 10.0.0.0/16
  clusterEndpoints:
    publicAccess: true        # kubectl access from the internet (restrict to your IP in prod)
    privateAccess: true       # Nodes communicate with API server over private network

# CloudWatch logging for the control plane
cloudWatch:
  clusterLogging:
    enableTypes:
      - api          # API server audit logs
      - audit        # Audit log (who did what)
      - authenticator
      - controllerManager
      - scheduler

# Managed node groups
managedNodeGroups:
  - name: app-nodes
    instanceTypes:
      - m5.xlarge
      - m5a.xlarge   # Multiple types: Karpenter-style flexibility for spot
    minSize: 3
    maxSize: 20
    desiredCapacity: 3
    availabilityZones:
      - us-east-1a
      - us-east-1b
      - us-east-1c   # Spread across all three AZs
    volumeSize: 100
    volumeType: gp3
    volumeEncrypted: true
    amiFamily: AmazonLinux2
    iam:
      attachPolicyARNs:
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
        # ECR read-only: nodes can pull images without explicit pull secrets
    labels:
      role: application
    tags:
      environment: production
      team: platform

addons:
  - name: vpc-cni
    version: latest
    attachPolicyARNs:
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
  - name: coredns
    version: latest
  - name: kube-proxy
    version: latest
  - name: aws-ebs-csi-driver    # Required for EBS PersistentVolumes
    version: latest
    wellKnownPolicies:
      ebsCSIController: true

# Create the cluster (takes 15-20 minutes)
eksctl create cluster -f cluster.yaml

# Update kubeconfig to connect kubectl to the new cluster
aws eks update-kubeconfig --name production --region us-east-1

# Verify connection
kubectl get nodes -o wide
# NAME                              STATUS   VERSION    INSTANCE-TYPE   ZONE
# ip-10-0-1-12.compute.internal     Ready    v1.30.2    m5.xlarge       us-east-1a
# ip-10-0-2-44.compute.internal     Ready    v1.30.2    m5.xlarge       us-east-1b
# ip-10-0-3-78.compute.internal     Ready    v1.30.2    m5.xlarge       us-east-1c

# Step 1: Create an IAM OIDC provider for the cluster (one-time per cluster)
eksctl utils associate-iam-oidc-provider \
  --cluster production \
  --approve

# Step 2: Create an IAM role with a trust policy for the ServiceAccount
eksctl create iamserviceaccount \
  --cluster production \
  --namespace payments \
  --name payment-api-sa \
  --attach-policy-arn arn:aws:iam::123456789012:policy/PaymentAPIPolicy \
  --approve
# Creates: IAM role with trust policy for the OIDC provider
# Creates: Kubernetes ServiceAccount annotated with the role ARN
# The trust policy allows the ServiceAccount to assume the role via OIDC

# Verify the annotation was added
kubectl describe sa payment-api-sa -n payments
# Annotations: eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/...

# The ServiceAccount eksctl created:
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payment-api-sa
  namespace: payments
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/payment-api-role
    # This annotation is what tells the EKS Pod Identity webhook to inject
    # temporary AWS credentials into Pods using this SA

---
# Pod spec -- just reference the ServiceAccount:
spec:
  serviceAccountName: payment-api-sa   # Credentials auto-injected -- no AWS keys needed
  containers:
    - name: payment-api
      image: registry.company.com/payment-api:3.1.0
      # The AWS SDK automatically finds credentials in the projected token volume
      # os.environ['AWS_ROLE_ARN'] and AWS_WEB_IDENTITY_TOKEN_FILE are set automatically

# Install AWS Load Balancer Controller via Helm
helm repo add eks https://aws.github.io/eks-charts
helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  --namespace kube-system \
  --set clusterName=production \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller \
  # serviceAccount already created via eksctl with IRSA annotation

# NLB via Service (Layer 4 -- TCP/UDP, preserves client IPs)
apiVersion: v1
kind: Service
metadata:
  name: payment-api
  namespace: payments
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
spec:
  type: LoadBalancer
  selector:
    app: payment-api
  ports:
    - port: 443
      targetPort: 8443

---

# ALB via Ingress (Layer 7 -- HTTP/HTTPS, path-based routing, WAF integration)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payment-api
  namespace: payments
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip         # Route directly to Pod IPs
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/abc-def
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-2021-06
    alb.ingress.kubernetes.io/wafv2-acl-arn: arn:aws:wafv2:us-east-1:123456789012:regional/webacl/...
    alb.ingress.kubernetes.io/group.name: production   # Share one ALB across multiple Ingress objects
spec:
  rules:
    - host: api.company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: payment-api
                port:
                  number: 80

# StorageClass: EBS gp3 with encryption (use as default)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: gp3-encrypted
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: ebs.csi.aws.com
volumeBindingMode: WaitForFirstConsumer   # Provision in the same AZ as the Pod
reclaimPolicy: Retain                     # Protect data on PVC deletion
allowVolumeExpansion: true
parameters:
  type: gp3
  encrypted: "true"
  iops: "3000"
  throughput: "125"

---

# StorageClass: EFS for ReadWriteMany (shared across multiple Pods)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: efs-shared
provisioner: efs.csi.aws.com
parameters:
  provisioningMode: efs-ap              # Access point per PVC (isolation)
  fileSystemId: fs-0abc123def456789     # Your EFS filesystem ID
  directoryPerms: "700"
  uid: "1000"
  gid: "1000"
# Use case: shared media uploads, ML model weights, shared config files
# accessMode: ReadWriteMany -- multiple Pods can mount simultaneously

# Switch between multiple clusters / environments
aws eks update-kubeconfig --name staging --region us-east-1 --alias staging
aws eks update-kubeconfig --name production --region us-east-1 --alias production
kubectl config use-context production
kubectl config get-contexts    # List all configured clusters

# Check which IAM identity kubectl is using
aws sts get-caller-identity    # Shows which IAM user/role is making API calls
kubectl auth whoami            # Shows the Kubernetes user derived from the IAM identity

# Restrict API server access to your company IP range (in cluster.yaml)
# vpc.clusterEndpoints.publicAccessCIDRs: ["203.0.113.0/24"]

# View EKS add-on status
aws eks describe-addon --cluster-name production --addon-name vpc-cni \
  --query addon.status

# Force node group to use latest AMI (security patches)
aws eks update-nodegroup-version \
  --cluster-name production \
  --nodegroup-name app-nodes \
  --force   # Drain and replace nodes even with PDB violations (use carefully)

# Get all resources in a namespace with their resource consumption
kubectl get pods -n payments -o custom-columns=\
"NAME:.metadata.name,CPU_REQ:.spec.containers[*].resources.requests.cpu,MEM_REQ:.spec.containers[*].resources.requests.memory"