EKS (Kubernetes)

# ===== What EKS is =====
# AWS-managed Kubernetes control plane (apiserver, etcd, scheduler, controllers).
# You bring nodes (EC2, Fargate) and workloads. AWS patches + scales the control plane.

# ===== Create a cluster (eksctl) =====
# Install:
brew install eksctl
brew install awscli

# Cluster + managed nodegroup in one shot:
eksctl create cluster \
  --name shop \
  --region ap-southeast-2 \
  --version 1.30 \
  --nodegroup-name workers \
  --node-type t3.medium \
  --nodes 2 --nodes-min 1 --nodes-max 5 \
  --managed

# This generates a CloudFormation stack; wait ~15 minutes.

# ===== kubectl config =====
aws eks update-kubeconfig --region ap-southeast-2 --name shop
kubectl get nodes

# ===== Node types =====
# - Managed Node Groups (default): AWS manages the EC2 instances + upgrades
# - Self-managed nodes: you maintain the AMI + draining
# - Fargate: serverless pods; no nodes to manage; per-pod billing
# - Karpenter: open-source autoscaler that provisions nodes on demand

# ===== Add Fargate profile =====
eksctl create fargateprofile --cluster shop --name worker --namespace dev

# Pods in 'dev' namespace land on Fargate.

# ===== IAM for Service Accounts (IRSA) =====
# Grant pods AWS permissions without storing keys.
# 1. OIDC provider for the cluster (eksctl enables by default).
# 2. Create a role with trust policy referencing the OIDC + service account.
# 3. Annotate the SA with the role ARN.

eksctl create iamserviceaccount \
  --cluster shop \
  --name s3-reader \
  --namespace app \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
  --approve

# Pods using the s3-reader SA get the S3 permissions automatically (via STS).

# ===== Add-ons =====
# Built-in: coredns, kube-proxy, vpc-cni, aws-ebs-csi-driver
# Common to install:
# - aws-load-balancer-controller (ALB / NLB ingress)
# - metrics-server (HPA)
# - cluster-autoscaler or Karpenter
# - external-dns
# - argo-cd (GitOps)

# ===== Ingress =====
# Install the AWS Load Balancer Controller:
helm repo add eks https://aws.github.io/eks-charts
helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system --set clusterName=shop

# Then Ingress resources of class 'alb' provision ALBs.

# ===== Logging + monitoring =====
# - CloudWatch container insights: 'eksctl utils enable-secrets-encryption' style
# - Fluentbit -> CloudWatch Logs
# - Prometheus + Grafana via Helm; or AWS Managed Prometheus + Managed Grafana

# ===== Upgrades =====
# 1. Upgrade the control plane (eks update-cluster-version)
# 2. Upgrade addons (vpc-cni, coredns)
# 3. Upgrade nodes (managed node groups roll automatically)
# Run periodically; EKS supports N-2 versions only.

# ===== Costs =====
# - Control plane: USD 0.10/hour per cluster (~USD 73/month)
# - Nodes: standard EC2 pricing
# - Fargate: per pod vCPU + memory per second
# - Data transfer + load balancer hours add up

# ===== Patterns to internalise =====
# - IRSA over static keys, always
# - Managed node groups for simple; Karpenter for elastic
# - GitOps (Argo CD / Flux) over imperative kubectl
# - Cluster Autoscaler / Karpenter + HPA for cost + perf

# ===== Pitfalls =====
# - Using AmazonEKSClusterRole on humans (use SSO + roles)
# - Default vpc-cni IP exhaustion in small subnets (use prefix delegation)
# - Pinning to a minor version; stay within N-2
# - One huge cluster vs many small (multi-tenant complexity)

# Managed Kubernetes — control plane is AWS's, nodes can be EC2 or Fargate.