Hardened Amazon AMI with kubectl for EKS

We use Amazon EKS  for hosting our applications. It is also a version of compute service with its own perks. Amazon EKS  is built on Kubernetes . Kubernetes  is complex and is not something used for basic or simple applications due to its complex nature. It is really meant for complex apps such as banking applications or AI-enabled applications that have many services.

When dealing with microservices, if an application has around 20 microservices, then Kubernetes generally begins to make sense. Then it becomes a question of whether to host it on Amazon EKS, Azure  Kubernetes Services, or Google Kubernetes Engine . That is basically what we use Amazon EKS for.

Amazon EKS is fairly reliable. The latest feature that was added last year, Amazon EKS auto mode, helps manage compute instances and EC2  instances. Amazon EKS auto mode is a very good addition as it helps reduce stress since users do not have to worry about upgrading Kubernetes versions. For example, when Kubernetes 1.34 is released, Amazon EKS handles the upgrade automatically.

Another beneficial feature of Amazon EKS is the Fargate offering. It helps run some compute instances on AWS Fargate , which means they only run when needed. Unlike typical EC2  instances that keep running once turned on, with Fargate, charges only apply when someone visits that service. For instance, in a banking app with multiple services, including a reviews service, Fargate can be utilized to ensure charges only occur when someone actually uses the review feature.

Amazon EKS is fairly stable and highly available. Once configured properly, it requires minimal maintenance. It integrates effectively with other services such as API Gateway, security groups, and load balancers.

The integration capabilities could be improved compared to Azure . While AWS  services are integrated with Amazon EKS, there is room for enhancement.

For example, Azure DevOps  provides better pipeline integration. When writing pipelines in Azure DevOps , users can easily import various built-in tasks into pipeline YAML files, such as kubectl tasks or native Kubernetes plugins, once a service connection to Azure is created.

We encountered challenges with WebSocket integration when implementing chat functionality on Amazon EKS. The chat service, which was part of our microservices running on Amazon EKS, needed to be exposed on application load balancer. Despite both application load balancer and network load balancer having native WebSocket integration on AWS , the connections were unstable. This required extensive tweaking of network load balancer configurations to manage API calls through the API Gateway. AWS could improve WebSocket integration across API Gateway, network load balancer, and Amazon EKS.

We have not used it recently because we prefer to make patches ourselves.

When auto mode is enabled, self-healing functionality becomes active. If a node encounters issues or someone makes incorrect configurations, Amazon EKS automatically resets it to maintain standard configurations. This is particularly useful when someone SSH's into Amazon EKS instances and modifies Linux kernel configurations, as the self-healing node resets it to normal, helping reduce administrative burden.

We only escalated questions regarding increasing CPU and memory allocations for Fargate. We contacted AWS through their service quota system. The process required submitting a request with justification for increasing the quota for CPU and memory on Fargate. The resolution was quick after providing a brief justification for the quota increase.

Positive

The setup process is very straightforward.

When considering Amazon EKS, it is important to use Infrastructure as Code  (IAC), not just Terraform . Having a repeatable configuration of infrastructure as code is essential for creating clusters, as manual cluster creation is not common in professional production environments.

It is crucial to consider Fargate carefully, as it can help save costs. Fargate is particularly useful when parts of an application or the entire application are not used constantly, as it can reduce costs compared to running on EC2 instances.

On a scale of 1-10, this solution rates as an 8.

Public Cloud

Amazon Web Services (AWS)

The main use cases for Amazon EKS  are that we use it normally in some new projects to optimize our costs. Instead of having many ECS services running, we prefer to set up a Kubernetes  cluster and set everything there. For me, it is primarily for optimizing our resources.

What I find valuable about Amazon EKS  is that it helps us manage all the Kubernetes . It isn't the workload, it is the main part of the Kubernetes, the head of all the cluster. Automatic updates are available, and we can set everything we created in AWS  in Kubernetes, including IAM  configuration. We can create policies such as creating a private endpoint for S3 . The integration of Kubernetes with the AWS  ecosystem is the best feature that Amazon EKS provides.

The IAM  integration in Amazon EKS helps enhance the authentication processes because we can do this in a more granular way. Using IAM , you can set exactly what the service needs. If a service or application needs to upload objects or data to S3 , connect to RDS , or perform other tasks, using IAM  is the easiest way. The benefit is that it works in a granular way and it's easy to set up and validate. When you examine the permissions and rules to ensure everything has the correct permission at the correct moment, using IAM is perfect because you can validate and set up everything effectively.

Amazon EKS's support for different AWS tools integrations has accelerated our application development because we can think about all aspects comprehensively. We can architect using AWS services and objects, and Amazon EKS accepts this seamlessly. We don't need to translate the idea for AWS. We can write this idea using AWS objects and services, and Amazon EKS corresponds to that. It accelerates projects and is easy to manage because we can use Terraform  to implement it.

I am using the self-healing nodes in the Amazon EKS solution. We have a client with a production workload running on spot instances. When a spot or node crashes, Amazon EKS starts a new node and moves everything before the node stopped. This self-healing is excellent because we don't experience disruptions. We don't face situations where a node stops and we need five minutes to start a new one. We use it in specific environments and can observe the difference when enabling or disabling Amazon EKS self-healing.

We are utilizing the automated patching in Amazon EKS. The valuable benefits I have experienced using the automated patching feature for the Kubernetes clusters directly increase security. Kubernetes typically releases patches focused on security rather than new features. It's beneficial because we can focus on our work without constantly thinking about new patch releases or upgrade deployments. Amazon EKS handles this automatically for us.

We face some issues with Amazon EKS when using the node group to control which nodes can start. We have a limitation where we need to set just one kind of instance - only large instances, only small instances, or only extra-large instances. This is a problem. It would be beneficial if we could specify that certain containers or services start on small instances rather than large ones.

I am uncertain whether Amazon EKS supports all LTS versions, and I think this would be something beneficial. Additionally, AWS has great AI features, so when we need to make updates to Amazon EKS, it would be helpful if AI could assist with planning, identifying migration requirements, and considering costs.

I have been working with Amazon EKS for about two years in production. Including study time and other experiences, I have been involved with it for approximately four years.

I faced challenges in the initial stages with Amazon EKS. The main challenge is that when we set up the cluster, it appears as a huge infrastructure just for a small application. When you set up Amazon EKS, it is configured at a large scale by default. You can't start small and gradually expand. This makes sense because for smaller applications, ECS works effectively. If you want a more integrated ecosystem, you can use Amazon EKS. The challenge lies in migrating everything, as you can't start using Amazon EKS on a small scale. It typically requires a big cluster with one, two, or three nodes. We also faced challenges with developers needing to adapt their mindset to the new way of doing things.

I have escalated questions to the technical support of Amazon EKS two or three times, and they always provided good solutions. When we don't understand the questions, we schedule a call to demonstrate the issue, and we always receive the correct answer.

I reached out for technical support with Amazon EKS because we faced issues starting a service. The way we declared the services was incorrect, but we weren't aware of this. We called AWS support for assistance. Another issue involved a security problem that we identified and reported to AWS.

I would rate the technical support of Amazon EKS a 10. The documentation is good, and when human interaction is needed, it's readily available.

Positive

From my perspective, I don't see any disadvantages of Amazon EKS compared to competitors in the market. Amazon EKS represents the state of the art. While Google has a powerful engine that offers more granular control, the additional configuration can be overwhelming. Amazon EKS balances the power of custom configuration with ease of setup.

I find the pricing of Amazon EKS complicated because I live in Brazil, where we use reals. With the exchange rate and taxes, the price appears six times higher. However, when viewed in dollars, it offers great features at reasonable pricing. Lower prices are always beneficial, and a reduction in hourly cost or promotional discounts would be appreciated, but the current price-to-benefit ratio is worthwhile.

My advice to other organizations considering Amazon EKS for their environment is to plan carefully. I strongly recommend planning and reading the documentation because Amazon EKS is resourceful and typically offers multiple ways to accomplish the same task. Careful planning, reviewing case studies for comparison, and thoughtful migration to Amazon EKS are worthwhile investments. Overall, I rate Amazon EKS a 9 out of 10.

Public Cloud

Amazon Web Services (AWS)

I have a total of around four years of experience in multiple clouds, especially in AWS , and many times I used Amazon EKS  for our multiple products and projects.

In our environment, we already have all the other infrastructure and services running on AWS , so we benefit from using Amazon EKS  because the other services can easily communicate with it. For example, some of our services need to access S3 , and our application objects reside there, so we can easily integrate them with Amazon EKS. We also use IAM  rules for integration to provide granular access to resources. As per your question, in our environment, most of our clients and resources reside in AWS, which is why we prefer to deploy other services there, as most of our development environment uses Lightsail. This gives us an edge, allowing us to easily move from development to staging or production environments within the same cloud.

When we compare other clouds, AWS has an edge among all the crowded options right now. My observations and reviews with AWS also affirm this because it provides a user-friendly experience and offers many options that other clouds do not provide. When my team and I work with AWS, we always feel comfortable. I do not know the exact reason behind it; maybe we have a lot of previous experience, and we are familiar with AWS. That is why other reviews from my colleagues at previous companies indicate that AWS has some edge compared to other clouds.

I would recommend Amazon EKS to other organizations because it provides simple configuration, easy management, safety, granular access, and vast monitoring capabilities where we can easily monitor our clusters using CloudWatch. However, I would think about a clearer dashboard for Amazon EKS, but overall, I think it is sufficient.

When we need to deploy the application, we require a large number of instances. Therefore, I hope and believe I will not face out-of-capacity issues in AWS, especially since I have not yet experienced traffic around 50,000 plus, and I believe I will not face such issues in Amazon EKS the next time we deploy with a large number of nodes and worker nodes.

Additionally, the upgradation process of Kubernetes  rapidly rolls out new releases, so it should be easier for our production environment to upgrade Amazon EKS clusters. Sometimes when we are going to upgrade the Amazon EKS cluster, we need to check the backups, and we should have options to export our configurations, such as exporting the configuration to S3  or somewhere else to find backups. Other tools, such as Velero , provide this functionality to back up configurations, so I hope this backup process will help us fulfill our backup policies and other requirements.

For the pricing aspect of Amazon EKS, one specific issue arises when we deploy applications, especially as we provide SaaS services to our clients. We would like to know the cost for each customer, but we face issues because AWS charges $70 USD for the Amazon EKS engine. We struggle to divide the worker nodes' fees and the engine cost among clients, as some users have low traffic and visibility while others have large amounts of visibility and traffic. Thus, we face cost-related issues when running multiple customers on the same Amazon EKS cluster.

I have been using the solution for approximately four years.

The initial setup and deployment of Amazon EKS was straightforward; I easily provisioned the correct cluster. Sometimes, due to the depreciation of the AMIs, AWS provides warnings to use the latest version of the EKS AMIs because some of our scripts or Terraform  scripts are old. I think it is good practice for AWS to provide messages to the console to upgrade your cluster, but overall, my experience with provisioning the Amazon EKS cluster is good, and I highly appreciate it.

I have not faced any issues that require escalation to customer support, and until today, I do not feel any need to escalate anything to the support team. I am happy with the service.

To meet our requirements, our services need a large amount of CPU and memory, so we need high-spec machines. When we deploy applications, we require a large number of instances.

I have not faced any issues that require escalation to customer support, and until today, I do not feel any need to escalate anything to the support team. I am happy with the service.

Positive

I also work with other clouds, such as Oracle Cloud , but I feel comfortable with AWS because I faced some issues, such as out of capacity when we designed the infrastructure for our large traffic.

The initial setup and deployment of Amazon EKS was straightforward; I easily provisioned the correct cluster. Sometimes, due to the depreciation of the AMIs, AWS provides warnings to use the latest version of the EKS AMIs because some of our scripts or Terraform  scripts are old. I think it is good practice for AWS to provide messages to the console to upgrade your cluster, but overall, my experience with provisioning the Amazon EKS cluster is good, and I highly appreciate it.

I used Amazon EKS through its console rather than through the AWS Marketplace .

I have not checked the pricing yet, but I will look into it to see if EKS brings ROI or a return on investment for us.

Regarding self-healing nodes in Amazon EKS, I have not worked on that self-healing feature.

For automated patching in Amazon EKS, I have not used that feature.

Regarding disadvantages of Amazon EKS compared to competitors in the market, I think every cloud provider has the same Kubernetes  engine and worker nodes. However, I believe AWS provides a more user-friendly environment, which is why many of our customers are trying to deploy their infrastructure or applications on AWS. I do not think there is any specific reason not to prefer Amazon EKS.

I have not integrated IAM  tools with Amazon EKS yet, but my other teams have. I think they used Okta, but I'm not certain about it. I have some demos from a long time ago, but I think Okta is for SSO .

On a scale of one to ten, I rate Amazon EKS a nine out of ten.

Private Cloud

Amazon Web Services (AWS)

For Amazon EKS , the usual use cases I have been working with include many microservices where we cannot orchestrate in a better way in the ECS, which is an AWS  native component. The major reason for moving to Amazon EKS  is that if we have a microservice that takes more time to do the job, we need to return it while also running some other small microservices in parallel with that application, which we cannot do in ECS.

We moved to Amazon EKS where we have the feasibility to do parallel jobs with different microservices within the same pod, since we can run multiple containers in one pod. This helps us mitigate challenges in the company, and it works smoothly and fast, providing good performance and strong security. That has been our journey towards Amazon EKS across all customer platforms.

The most valuable feature of Amazon EKS is the add-ons service, which includes the Ingress feature that allows us to connect to both public and internal-facing load balancers. The best thing I have found is the management; using Rancher management, we can connect to Amazon EKS and manage the deployment from the UI without always needing to use the AWS  console. We can create our own Rancher portal and directly manage the deployments and all other tasks from there.

Amazon EKS is a major tool for our application functionality and job purposes; it helps us at the orchestration level, allowing us to not worry about the entire deployment and service migration. We manage everything from Amazon EKS, and it's also very convenient to set up CI/CD deployment through GitHub . Additionally, we can utilize AWS native services such as CloudDeploy, so in both ways Amazon EKS has been convenient for running our applications.

I believe there is room for improvement in Amazon EKS, particularly regarding security; if Amazon EKS would provide more options for cluster-based security, it would be beneficial. Currently, it's completely managed by AWS, but I suggest that if Amazon EKS could allow monitoring of the backend of the nodes or workflows, it would greatly help users. Sometimes, AWS's shared responsibility model means that if any issues arise, the misconception lies with the users.

For instance, failures from containers running on nodes in AWS data centers can halt our workflows, especially when running in single availability zones. If AWS could enhance user interaction for improving security, it would be very helpful.

I have been working with Amazon EKS since 2017, which amounts to approximately eight years.

I have utilized Amazon EKS's integration with IAM  through the service account, which is a great feature because we don't need to depend on storing secrets in Amazon EKS. We can directly use service accounts and rotate our tokens every 24 hours, which helps us achieve fine-grained access for both the user and the cluster-wise.

Compared to different cloud providers, AWS EKS pricing and licensing is absolutely reasonable and one of the best options available.

In terms of stability and reliability, I can say that among all options in the market, Amazon EKS is very reliable. I haven't experienced much downtime in the Amazon EKS cluster, so I can confidently say it is stable.

Amazon EKS has been quite scalable; people nowadays are moving to multi-AZ setups. When we choose Fargate, the beauty of Amazon EKS is that we can run multiple containers from different availability zones within the same pod. This is beneficial for availability and scalability because, using ReplicaSet, we can ensure that our containers remain at the desired count, automatically pulling new containers whenever one goes down.

I often communicate with Amazon EKS technical support, and my impression is positive. When I was initially setting up, I needed to understand a few things from AWS, and they provided substantial support, being very professional and helpful.

I had to address technical support when one of our nodes was suddenly terminated while utilizing a single availability zone, which caused application downtime and business disruption. However, AWS management tackled this situation very well by providing us with a solution that enabled us to shift to multi-AZs, as AWS guarantees 99.9% availability but acknowledges the need for users to avoid relying entirely on a single AZ.

Positive

I usually participate in the initial setup and deployment of Amazon EKS; I've done this in four projects, giving me good hands-on experience with Amazon EKS.

My usual deployment and initial setup process for Amazon EKS is straightforward. First, we need to spin up the cluster, which involves providing the cluster name, VPC details, subnet details, security details, and network mode—either AWS VPC or a customized network mode. There are several options, including attaching an IAM  role and adding on features such as proxy connection and network protection. After spinning the cluster, we start the Kubelet client installation from where we can manage the cluster and begin deployments using YAML scripts and manifest workflows.

Recently, Amazon EKS launched an automated patching feature that allows us to schedule a time frame for cluster scaling up, down, and patching, which has been very helpful across all aspects.

I usually measure the impact of Amazon EKS on managing complex workflows by evaluating performance, specifically how the containers are available and performing. Based on application latency, we can determine that Amazon EKS performs well. We measure in this way because latency is the differentiator between every service; with ECS, latency can be slightly higher, which causes user difficulties when accessing applications.

Overall, based on everything I've described about Amazon EKS, I would rate this solution eight out of ten.

Public Cloud

Amazon Web Services (AWS)

My usual use cases for Amazon EKS  are for my company's projects, as they instructed us to set up Amazon EKS  and then deploy the applications.

I use Amazon EKS mainly for my company's projects, where we deploy applications according to company requirements.

The features and capabilities of Amazon EKS have proven to be valuable, as we use EKS in most of our projects. Our company has selected AWS  as one of our three cloud preferences, which are AWS , GCP, and Azure .

The specific features I find most useful in Amazon EKS include the ability to deploy our applications directly using the pipeline file in YAML, the capacity to create multiple instances, and the capability to scale as per the requirement.

Amazon EKS's self-healing nodes help minimize administrative burdens in my organization by automatically creating a new node if any node crashes, allowing us to manage only the minimum and maximum nodes as needed.

To use Amazon EKS, we create the cluster first, and then we deploy the applications using the YAML file.

I have not used the automated patching feature for my Kubernetes  clusters in Amazon EKS yet.

I think if new features, especially AI capabilities, are developed for Amazon EKS, it will enhance the product as it allows us to continually improve our applications.

I have been working with Amazon EKS for the past three years.

I participated in the initial setup and deployment of Amazon EKS.

My impression is that Amazon EKS is very stable and reliable as a product.

I have not noticed any outages, delays, or downtime with Amazon EKS; everything operates smoothly.

Amazon EKS is easy to evaluate in terms of scalability; we can auto-scale easily as needed.

I would rate the scalability of Amazon EKS as a nine out of ten.

I do not often communicate with the technical support of Amazon EKS as I have not needed their assistance.

For our work with Amazon EKS, we utilize the available documentation and guides, which are useful for understanding and starting with any AI tool or prompt.

I am satisfied with the documentation that Amazon offers.

Neutral

Amazon EKS was my first Kubernetes  platform. Prior to that, I had only used Minikube locally, and after that, I have worked exclusively with Amazon EKS.

During the setup process for Amazon EKS, I set it up locally by configuring AWS config, and then I focused on the necessary setups like kubectl.

To start working with Amazon EKS, I first configure it with AWS, install kubectl, and then begin working after creating the cluster.

I chose Amazon EKS to work with because I have not yet started using GCP's or Azure 's Kubernetes services. I have experience only with Amazon EKS so far.

I have only worked on one application in Amazon EKS, so I haven't fully developed it. I have only deployed the front end, and I think I need to gather more knowledge about EKS.

The interface of Amazon EKS is very good, but I prefer to use the CLI for creating clusters. I initially used the UI just once to understand everything before starting to create using the CLI only.

On a scale of one to ten, I rate Amazon EKS a nine.

Public Cloud

Amazon Web Services (AWS)