Introduction to Amazon EKS

1. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Running Kubernetes withAmazon EKS
Luiz Yanai
Solutions Architect
Amazon Web Services

2. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Kubernetes 101
Amazon EKS Overview
Amazon EKS Control Plane
Amazon EKS Worker Nodes
Amazon EKS Networking
Storage, Scaling, and CI/CD

3. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Open source container
management platform
Helps you run
containers at scale
Gives you primitives
for building
modern applications
Whatis Kubernetes?

4. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud-Native Applications
M I C R O S E R V I C E
T O O L I N G
C L O U D - N AT I V E
A P P L I C AT I O N S

5. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ButWhereYou Run Kubernetes Matters
Quality of the
cloud platform
Quality of the
applications
Your users

6. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
51% of Kubernetes
workloads run on AWS
today
— Cloud Native Computing Foundation

7. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
0
20
40
60
80
100
120
140
160
1 2 3 4 5 6 7 8 9 10 11
AWS Contributions to Kubernetes in 2018
AWS Contributions to Kubernetes

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Elastic Container Service for Kubernetes
Managed K8s control plane — highly available master and etcd
aws eks create-cluster
--cluster-name <>
--desired-master-version <>
--role-arn <>
Bring your own worker nodes, like ECS
Core tenets
• Platform for enterprises to run production-grade workloads
• Provides a native and upstream Kubernetes experience – Kubernetes certified
• Not forced to use additional AWS services, but offer seamless integration
• Actively contributes to the Kubernetes project
APIs

10. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Service Level Agreement
99.9%
Amazon EKS
Last Updated: March 19, 2019

11. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ReadyforSensitiveand RegulatedWorkloads
HIPAA
ISO 9001, 27001, 27017, 27018
PCI DSS
SOC 1,2,3

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC
Auto Scaling Group
Auto Scaling Group
Amazon EKS
mycluster.eks.amazonaws.com
Availability Zone 1 Availability Zone 2 Availability Zone 3
kubectl
Amazon EKS
EKS Workers

14. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC
KubernetesControl Plane
Highly available and single
tenant infrastructure
All “native AWS” components
Fronted by an NLB
NLB
Amazon
EKS
Availability Zone 1 Availability Zone 2 Availability Zone 3
ELB
etcd ASG
API Servers ASG

15. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CreatingaCluster:AmazonVPC Planning
Proper VPC Sizing, EKS VPC templates use /16 As VPC CIDR
Range
Plan ahead with subnet sizes! Each pod consumes an Amazon
VPC IP address
Subnets can be public, private, or both
Provide all subnets that will host Kubernetes resources: Load
balancers and worker nodes

16. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
KubernetesVersion
Currently 1.12 , 1.13, and 1.14 supported
Amazon EKS will support up to three versions of Kubernetes at
once
“Deprecation” will prevent new cluster creation on old versions

17. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon EKSPlatformVersion
Platform version revisions represent API server configuration
changes or Kubernetes patches
Platform versions increment within a Kubernetes version only
K8s 1.10 K8s 1.11 K8s 1.12
eks.1
eks.2
eks.3
eks.1
eks.2
eks.1
eks.2

18. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
APIServerConfiguration
K8s API Server Flags
Controller
Admission Enabled

19. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
EKS KubernetesVersionUpdates
New UpdateClusterVersion API – supports in-place updates of
Kubernetes version
Introduces an update EKS API object
ListUpdates and DescribeUpdate APIs to provide visibility into the
status of a given update

20. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IdentityandAccessManagement (IAM)
Authentication
Kubectl
3) Authorizes AWS Identity with RBAC
K8s API
1) Passes AWS Identity
2) Verifies AWS Identity
4) K8s Action
Allowed/Denied
AWS Identity and Access
Management (IAM)

21. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ResourceSharing
How many clusters?
How to share environments between teams?
Isolation: account, cluster, namespace

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
P2 and P3 instances for GPUs?
i3.metal instances?
Spot instances?
A mix of all of the above?
BringYourOwn Instances
InstanceFlexibility

24. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
BringYourOwnOS
EKSAMIBuildScripts
https://github.com/awslabs/amazon-eks-ami
Source of truth for Amazon EKS Optimized AMI
Easily build your own Amazon EKS AMI
Build assets for Amazon EKS AMI for each supported
Kubernetes version

25. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Easily run Tensorflow on Amazon EKS
Includes NVIDIA packages to support Amazon
P2 and P3 instances
Available on AWS Marketplace
Artificial Intelligence/Machine Learning (AI/ML)
withAmazon EKS
AmazonEKS-optimizedAMIwithGPUsupport

26. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Worker NodeSetup -Authentication
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- rolearn: <ARN of instance role>
username: system:node:{{EC2PrivateDNSName}}
groups:
- system:bootstrappers
- system:nodes

27. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
UpdatingWorker Nodes
Two options:
1) Create new node group with latest Amazon EKS AMI;
drain old nodes; terminate old CFN template
2) Simply update AMI in CFN template; “rolling” replacement
policy terminates nodes
(Downsides: un-graceful termination of applications)

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
EKS VPC
EndpointAccess
Customer VPC
Worker Nodes
EKS ENI
Kubernetes
API calls
Exec, Logs,
Proxy
Internet
Amazon EKS
Network Load Balancing
(NLB)
Endpoint

30. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWSVPCCNIPlugin
ENI
Secondary IPs:
10.0.0.1
10.0.0.2
10.0.0.1
10.0.0.2
ENI
10.0.0.20
10.0.0.22
Secondary IPs:
10.0.0.20
10.0.0.22
ec2.associateaddress()
VPC Subnet – 10.0.0.0/24
Instance 1 Instance 2
VPC
https://github.com/aws/amazon-vpc-cni-k8s

31. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
EKSSupportsAdvanced NetworkingArchitectures
VPC - Multiple IP ranges
Subnet 1 – 10.0.0.0/16 Subnet 2 – 100.64.0.0/10
Customer
gateway
Corporate
data center
On-Premise – 10.1.0.0/16
VPN or DX Pod
Outbound
Traffic SNAT
EKS Worker Node
Primary ENI Pod
Secondary
ENI
Pod –
100.64.0.200

32. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes Network Policies
enforce network security rules
Calico is the leading
implementation of the network
policy API
Open source, active
development (>100 contributors)
Commercial support available
from Tigera
STAGE S E P A R A T I O N “ T E N A N T ”
S E P A R A T I O N
F I N E - G R A I N E D
F I R E W A L L S
C O M P L I A N C E
E.g., network policy to
isolate namespaces
Reduce attack surface within
microservice-based applications
Isolate dev, test, and prod
E.g., PCI, HIPAA

33. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Load Balancing
All three AWS Elastic Load Balancing products are supported
NLB and CLB supported by Kubernetes service
type=LoadBalancer
Internal and external load balancer support

34. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Load Balancing
Want to use an Internal Load Balancer? Use annotation:
service.beta.kubernetes.io/aws-load-balancer-
internal: 0.0.0.0/0
Want to use an NLB? Use annotation:
service.beta.kubernetes.io/aws-load-balancer-
type: nlb

35. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Exposes HTTP/HTTPS routes
to services within the cluster
• Many implementations: ALB,
Nginx, F5, HAProxy, etc.
• Default Service Type:
ClusterIP
Kubernetes IngressObject

36. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ALB IngressController
Production-ready 1.0 release
Supported by Amazon EKS team
Open source development:
https://github.com/kubernetes-sigs/aws-alb-ingress-controller
Customers are using it in production today!

37. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ALB IngressController
AWS resources
Kubernetes cluster
Node Node
Kubernetes
API server ALB Ingress
controller
Node
HTTP listenerHTTPS listener
Rule: /cheesesRule: /charcuterie
TargetGroup:
Green (IP Mode)
TargetGroup:
Blue (Instance
Mode)
NodePort NodePort
Ingress resource
creation via
kubectl or API
Application Load
Balancer

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

39. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Persistent volume
• Persistent volume claims
• StatefulSets
• Storage classes
K8s Storage

40. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Support EBS Volume Types
StorageClass
gp2 io1 sc1 encrypted
io1
st1
1) Admin pre-provisions
StorageClass based
on workload needs
2) End user requests for
specific volume types
(For ex, encrypted io1
volume)
3) Control loop watches
PVC request and
allocates volume if PV
exists
MySQL Pods
4) End user creates
stateful workload

41. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
EKS Auto Scaling
Two dimensions to scaling
• EC2 instance through K8s cluster AutoScaler
• Scale out Amazon EC2 instances
• PODs trough HPA
• Scale out PODs

42. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CI/CDofApps on Kubernetes -Choices
Jenkins, Spinnaker
AWS partners
• GitLab
• Shippable
• CircleCI
• Codeship
AWS CodePipeline, AWS CodeCommit, AWS CodeBuild

43. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes Continuous Deployment
AWS CodePipeline
AWS CodeCommit AWS CodeBuild AWS Lambda
Amazon ECR
1 2 4
3 5
6
1
Developers continuously integrate
changes into a release branch
hosted within a repo
2
Triggers an execution of the pipeline
when a new version is found, builds
a new image with build id
3
Pushes the newly built image
tagged with build id to ECR repo
4
Invokes a Lambda function to
trigger application deployment
5
Leverages Kubernetes Python SDK
to update a deployment
6
Fetches new container image
and performs a rolling update
of deployment
Developer
https://github.com/aws-samples/aws-kube-codesuite

44. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
HowDo IGetStarted?
https://eksctl.io
 eksctl create cluster
 CloudFormation, Terraform, AWS CDK
 Amazon EKS Workshop
https://eksworkshop.com/

45. Thank you!
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Luiz Yanai
lyanai@amazon.com