EKS

Kubernetes is the portable standard for container orchestration, but running the control plane yourself — a highly available, upgraded, patched, etcd-backed API server — is a full-time job. Amazon EKS (Elastic Kubernetes Service) runs a conformant upstream Kubernetes control plane for you, spread across three AZs, and gives you a normal cluster endpoint. You use standard kubectl, Helm, and ecosystem operators; AWS handles control-plane availability and version upgrades. Pick EKS over ECS when you need Kubernetes portability, the CNCF ecosystem, or an existing k8s investment.

• The control plane is Regional and multi-AZ by design — AWS runs API servers and etcd across 3 AZs and replaces unhealthy components automatically.
• The data plane (worker nodes) is yours to spread: Managed Node Groups (EC2 Auto Scaling groups AWS lifecycle-manages), self-managed nodes, or Fargate (one micro-VM per pod, no nodes). Put node groups in multiple AZs for HA.
• EKS Anywhere and EKS on Outposts run the same distribution on your own hardware (covered separately).

graph TD
subgraph CP["EKS Control Plane (AWS-managed, 3 AZs)"]
  API["Kubernetes API server"]
  ETCD["etcd"]
end
KUBECTL(("kubectl / Helm / CI")) --> API
API --> DP
subgraph DP["Data plane (your VPC)"]
  subgraph MNG["Managed Node Group"]
    N1["EC2 node (AZ-a)"]
    N2["EC2 node (AZ-b)"]
  end
  FG["Fargate profile (1 microVM per pod)"]
end
classDef cp fill:#f3ecfb,stroke:#8b3de0,stroke-width:2px,color:#3a1a5c
classDef node fill:#e8f0fe,stroke:#3b82f6,stroke-width:2px,color:#173a70
class API,ETCD cp
class N1,N2 node

EKS charges a flat hourly fee per cluster for the managed control plane (about $0.10/hr, more for extended-support Kubernetes versions), on top of the data-plane cost: EC2 + EBS for node groups, or per-pod vCPU/GB-seconds for Fargate, plus the ALB/NLB, data transfer, and any add-ons. Because the control-plane fee is per-cluster, many small clusters cost more than fewer larger ones with namespace isolation.

• EKS vs ECS: choose EKS for “must use Kubernetes,” “portability across clouds/on-prem,” “existing Helm charts / k8s operators,” or a platform team that already knows k8s. Choose ECS for a simpler AWS-native model with less operational surface.
• Fargate on EKS removes node management but doesn’t support DaemonSets, privileged pods, GPUs, or stateful workloads needing certain volume types — know the limits.
• Networking uses the VPC CNI: every pod gets a real VPC IP, so subnet sizing matters. IRSA (IAM Roles for Service Accounts) / EKS Pod Identity give pods scoped AWS permissions.
• Managed Node Groups handle graceful node drain on upgrade; Cluster Autoscaler or Karpenter scales node count to pending pods.
• Ingress via the AWS Load Balancer Controller (provisions ALB/NLB from Ingress/Service objects); storage via the EBS and EFS CSI drivers.
• Control-plane HA across 3 AZs is automatic — you don’t design it, but you do design node groups across AZs.