Amazon EKS: Managed Kubernetes on AWS

# eks-cluster.tf
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0"

  cluster_name    = "dodatech-prod"
  cluster_version = "1.28"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access = false  # Private cluster only

  eks_managed_node_groups = {
    general = {
      desired_size = 3
      min_size     = 2
      max_size     = 10

      instance_types = ["m5.large", "m5a.large"]
      capacity_type  = "ON_DEMAND"
    }

    spot = {
      desired_size = 2
      min_size     = 0
      max_size     = 20

      instance_types = ["c5.2xlarge", "c5a.2xlarge"]
      capacity_type  = "SPOT"
    }
  }

  tags = {
    Environment = "production"
  }
}

data "aws_eks_cluster_auth" "this" {
  name = module.eks.cluster_name
}

# Configure kubectl
aws eks update-kubeconfig --region us-east-1 --name dodatech-prod

# Verify cluster
kubectl get nodes

# Output:
# NAME                          STATUS   ROLES    AGE   VERSION
# ip-10-0-1-101.ec2.internal    Ready    <none>   2h    v1.28.3
# ip-10-0-2-102.ec2.internal    Ready    <none>   2h    v1.28.3
# ip-10-0-3-103.ec2.internal    Ready    <none>   2h    v1.28.3

# irsa.tf
module "irsa" {
  source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"

  role_name  = "app-s3-access"
  attach_s3_policy = true
  s3_bucket_arns   = ["arn:aws:s3:::dodatech-app-data/*"]

  oidc_providers = {
    main = {
      provider_arn = module.eks.oidc_provider_arn
      namespace_service_accounts = ["default:app-sa"]
    }
  }
}

# app-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/app-s3-access
---
apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  serviceAccountName: app-sa
  containers:
  - name: app
    image: dodatech/app:latest
    # This pod can now read/write to the S3 bucket

# alb-ingress.tf
resource "helm_release" "aws_lb_controller" {
  name       = "aws-load-balancer-controller"
  repository = "https://aws.github.io/eks-charts"
  chart      = "aws-load-balancer-controller"
  namespace  = "kube-system"

  set {
    name  = "clusterName"
    value = module.eks.cluster_name
  }
}

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dodatech-api
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/abc123
spec:
  rules:
  - host: api.dodatech.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

# cluster-autoscaler-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-autoscaler-status
  namespace: kube-system
data:
  # Autoscaler will scale between min and max set in node group
  # Works with ASGs — limited to instance types in the ASG
---
# Requires IAM permissions to modify ASG desired counts

# karpenter-provisioner.yaml
apiVersion: karpenter.sh/v1alpha5
kind: Provisioner
metadata:
  name: default
spec:
  requirements:
    - key: karpenter.sh/capacity-type
      operator: In
      values: ["on-demand", "spot"]
    - key: kubernetes.io/arch
      operator: In
      values: ["amd64", "arm64"]
    - key: node.kubernetes.io/instance-type
      operator: In
      values:
        - m5.large
        - m5.xlarge
        - c5.2xlarge
  limits:
    resources:
      cpu: 1000
  provider:
    subnetSelector:
      kubernetes.io/cluster/dodatech-prod: owned
    securityGroupSelector:
      kubernetes.io/cluster/dodatech-prod: owned
  ttlSecondsAfterEmpty: 30

# ebs-storage.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ebs-claim
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: gp3
  resources:
    requests:
      storage: 100Gi
---
# After installing aws-ebs-csi-driver via Helm
# Pods can mount EBS volumes for persistent storage

# efs-storage.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: efs-claim
spec:
  accessModes:
    - ReadWriteMany  # Multiple pods can read/write simultaneously
  storageClassName: efs-sc
  resources:
    requests:
      storage: 100Gi  # EFS is elastic — this is a placeholder

#!/bin/bash
# eks-status.sh
CLUSTER="dodatech-prod"
REGION="us-east-1"

echo "=== EKS Cluster Status ==="
aws eks describe-cluster --name $CLUSTER --region $REGION \
  --query '{Status: cluster.status, Version: cluster.version, Endpoint: cluster.endpoint, Created: cluster.createdAt}'

echo -e "\n=== Node Groups ==="
aws eks list-nodegroups --cluster-name $CLUSTER --region $REGION \
  --query 'nodegroups' --output yaml

echo -e "\n=== Nodes ==="
kubectl get nodes -o wide

echo -e "\n=== System Pods ==="
kubectl get pods -n kube-system

echo -e "\n=== Resource Usage ==="
kubectl top nodes