tag: Eks · 12 items
- Platform/SRE — Plan: Enable EKS Dashboard trusted access via AWS Organizations to get consolidated CA rotation status across all clusters and regions — clusters created since 2018 carry 10-year CAs that are now entering the window where rotation planning should begin. No hard expiration deadline is cited, but this is a free GA capability worth enabling this quarter to surface clusters approaching rotation.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: EKS Auto Mode now natively manages Gateway API resources (Gateway, HTTPRoute) including weighted routing, header-based routing, and ACM TLS — eliminating the need for a separate ingress controller. Evaluate adopting Gateway/HTTPRoute as the standard traffic-management pattern for EKS Auto Mode clusters this quarter.
- CI/CD — Skip
- Leader — Learn: EKS Auto Mode’s native Gateway API support signals Kubernetes standardizing on a single next-gen ingress model; worth tracking as a data point when reviewing golden-path networking standards for EKS-based platforms.
- Platform/SRE — Learn: Practical case study on running a stateful, multi-component workload (workers, webhook processors, PostgreSQL, Redis) on EKS; useful pattern reference for teams operating similar architectures, but no action required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you run AWS Batch compute environments on EKS, you can now migrate from the aws-auth ConfigMap to the newer access entry API for IAM-principal authentication; schedule an UpdateComputeEnvironment pass to set accessEntry.desiredState=ENABLED, simplifying auth lifecycle management on those clusters.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Kubernetes 1.37 is now GA on EKS with notable promotions (Metrics API to GA as metrics.k8s.io/v1, DRA device taints to GA). Plan an upgrade evaluation this quarter; no forced-upgrade deadline exists yet, but staying current reduces future skew risk.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: Three new GA capabilities directly relevant to EKS workload resilience: scoped resource discovery via existing K8s labels, AI-powered dependency pattern analysis, and cross-account policy sharing via AWS Organizations. Evaluate integrating Resilience Hub into the platform runbook this quarter.
- CI/CD — Skip
- Leader — Learn: Organization-wide resilience policy sharing through AWS Organizations is a governance capability worth tracking as a potential standard for cross-team resilience posture, but no immediate strategic decision is required.
- Platform/SRE — Plan: This GA feature removes the need for an identity broker when authenticating multiple user populations (employees, contractors, CI/CD systems) to EKS clusters. Evaluate whether your clusters could simplify their auth architecture by replacing any intermediary OIDC broker with direct per-provider associations.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: EKS clusters created in 2018 have 10-year CAs now approaching expiry (~2028); audit cluster creation dates and schedule CA rotation this quarter — worker nodes must be replaced and external API clients updated to trust the successor CA before activation, which AWS will not do automatically.
- CI/CD — Learn: Pipelines that connect directly to EKS API servers (kubectl, Helm deploys, kubeconfig-based auth) qualify as external clients under the shared-responsibility model and would need CA trust updates during any rotation; no immediate action required but worth noting when rotation is scheduled by Platform.
- Leader — Skip
- Platform/SRE — Plan: New GA capability lets EKS cluster admins tune scheduler, controller manager, and API server parameters — e.g. switching to MostAllocated bin-packing to reduce node count. Review the full parameter list and evaluate whether tuning fits your cluster’s resource-utilization or scaling goals this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: EKS Provisioned Control Plane clusters now get significantly faster HPA-driven scaling with no configuration changes required — worth knowing if you run large clusters with many HPA objects, but no action needed.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: For EKS clusters in air-gapped or strict-egress VPCs, this GA capability enables IRSA token validation without internet access — evaluate adding the com.amazonaws.
.oidc-eks VPC interface endpoint to your network baseline this quarter. - CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability that changes how you’d architect EKS node pools for GPU/HPC workloads — evaluate EFA-only interfaces (no IP consumption) and placement group strategies for distributed training or high-availability production services this quarter.
- CI/CD — Skip
- Leader — Skip