Complete AWS EKS MasterClass (best practices)

Explore the Kubernetes master and worker architecture, detailing the master node, worker nodes, and how container workloads are managed, with metrics reported back.

Explore the Kubernetes master node (control plane) components—api server, etcd, scheduler, and controllers—and how the api server authenticates requests, stores state, and schedules pods to nodes to run in containers.

Examine the Kubernetes worker node data plane, detailing the container runtime and per-node agents that spin up containers and respond to commands via a command-line interface.

Recap Kubernetes objects—pods, deployments, services, ingress, and configmaps—and explain zero-downtime rolling updates with replicasets and static IP load balancing.

Create an AWS account and an IAM user with programmatic and console access, generate access keys, and attach an administrator policy, while noting secure handling and IaC use for EKS.

Install the AWS, aws-iam-authenticator, kubectl, and eksctl CLIs via brew or chocolatey, configure access keys and a default region, and verify setup to create an EKS cluster.

Create an AWS EKS cluster with eksctl by configuring region, instance type, and node count, then enable eks managed nodes and review cluster details in the console.

Explore how a multi-AZ VPC is configured for EKS, with three public and three private subnets across availability zones, including master nodes, worker groups, security groups, and routing.

Navigate the eks console to manage clusters, select regions, and view api server endpoints; review iam roles as service accounts, certificate authority, vpc subnets, and default logging and tags.

Discover how Helm charts bundle Kubernetes resources into a single deployable artifact. Learn chart anatomy, externalizing values, and templated deployment of components like deployments, services, ingresses, and more.

Explore helm basics by adding repos, searching charts, and deploying nginx with helm install; then upgrade, view history, roll back, and inspect generated manifests for safe Kubernetes management.

Deploy the Kubernetes dashboard to visualize namespaces, pods, deployments, and services, making it easier to understand and monitor a cluster before deploying your application.

Install the metrics server to enable the dashboard to pull CPU and memory metrics. Deploy core components from a public GitHub YAML with kubectl apply in the kube-system namespace.

Install Kubernetes dashboard v2, configure the namespace and secrets, and access the dashboard via kubectl proxy with a token for authentication.

Create and bind rbac roles to enable admin access for the dashboard and login in an eks cluster, using service accounts, cluster role bindings, and admin permissions.

Discover how the Kubernetes dashboard exposes namespace-based metrics, including CPU and memory, and use logs and exec into shell to inspect pods and containers within an AWS EKS environment.

Deploy a master and slave replicas and a frontend guestbook on an AWS EKS cluster. Expose the services via a public AWS ELB and resolve to a public DNS.

Explain guestbook app architecture on aws eks, showing three replica pods behind a service and load balancer, in a vpc with public subnets and redis in private subnets.

Explore why ingress controllers enable layer seven load balancing with a single load balancer for multiple services. Production practices suggest reliable options like EIO, Gateway, or traffic over Engine X.

Install the Engine X ingress controller using a Helm chart, create the Ingenix English controller namespace, and verify deployments and a LoadBalancer service to enable host-based load balancing.

Create an ingress resource YAML to enable L7 http path and host routing through the ingress controller to the guestbook backend. Validate access via the ingress DNS.

Demonstrates enabling ssl termination at an AWS ELB by provisioning a self-signed certificate, configuring ingress controller annotations, and upgrading the Helm deployment to terminate at the load balancer.

Fix 400 bad request by routing http to the https port: set service target ports to 80, enable ssl termination at load balancer, and update the helm configuration and certificate.

Enable AWS ELB access logs for Kubernetes workloads by creating an s3 bucket with a bucket policy and updating service annotations via Helm overrides to monitor traffic and errors.

Highlights production limitations of nginx ingress controllers across multiple environments, including slow configuration reloads and maintenance overhead, and promotes Istio service mesh with envoy for secure, observable traffic.

Recap the ingress controller, ssl, and istio service mesh. Learn to enable end-to-end https from edge to internal services via an ingress gateway.

Explore security for deploying apps by authenticating users to a Kubernetes cluster, using an IAM authenticator and the aws-auth ConfigMap to map external users to cluster roles.

Demonstrate how an aws-iam-authenticator powers kubernetes authentication by passing a token to an in-cluster authenticator, mapping IAM users to Kubernetes identities, then validating access with RBAC.

Explore kubeconfig and the aws-auth ConfigMap to configure authorization in kubernetes, mapping users and roles, using authenticator tokens, and managing production and demo environments.

Create a new AWS IAM user with programmatic access, generate an access key and secret key, and add a new credentials profile to verify identity against the EKS cluster.

This lecture demonstrates why promoting an IAM user to a Kubernetes cluster admin is an anti-pattern, showing how mapUser bindings and system masters grant access, and highlighting safer RBAC practices.

Demonstrates restricting Kubernetes user access with RBAC by creating a ClusterRoleBinding, assigning roles like edit or view to a user, and applying through a YAML manifest.

Bind users to cluster roles via the aws-auth ConfigMap to control access, granting viewer or editor permissions and enforcing namespace and cluster scope restrictions.

Explore how AWS IAM authentication and authorization work in a K8s cluster on EKS, using the IAM authenticator to verify users and map them to roles with short-lived credentials.

Install Prometheus with a Helm chart, create a dedicated namespace, and deploy the Prometheus server and Grafana to monitor the cluster and visualize metrics via dashboards.

Install Grafana with Helm on Kubernetes, create a dedicated namespace, expose it via port-forward, retrieve the admin password from a secret, configure Prometheus as a data source, and import dashboards.

Enable master components logging for the kubernetes control plane, including the api server, authenticator, and controller-manager, using the X console and CloudWatch logs for observability on AWS EKS.