Educational reference
AWS multi-environment Kubernetes platform
Educational layout for isolated accounts, private EKS workloads, and GitOps promotion. Not a client topology.
- Components
- Separate AWS accounts for development, staging, and production, with a shared services account for identity and DNS.
- VPC with public subnets for load balancers only; private subnets for EKS nodes, and data stores with no public IPs.
- EKS with IRSA, AWS Load Balancer Controller, and Flux reconciling from a protected Git repository.
- ECR as the image registry; digest-pinned promotion between environments.
- Design decisions
- Environment isolation at the account boundary so a leaked development credential cannot apply production Terraform.
- GitOps pulls desired state; CI publishes an image digest and never holds cluster-admin keys.
- NAT or VPC endpoints are explicit outbound paths. Default internet from private nodes is treated as a defect.
- Security
- OIDC from the pipeline to a role that can push one repository and tag one digest.
- Secrets from Secrets Manager or External Secrets using the workload identity, not Kubernetes Secrets committed to Git.
- Security groups allow the application port from the load-balancer group only; the cluster API is private.
- Trade-offs
- Multi-AZ nodes and a multi-AZ data store raise cross-AZ cost and reduce zone-loss blast radius. Choose RTO before replica count.
- A shared cluster is cheaper than cluster-per-team and needs stronger tenancy, quotas, and network policy.