What a production EKS setup looks like in 2026, layer by layer: edge, entry, cluster, platform add-ons, data, security and observability. A lean version for a small team on Auto Mode, and a regulated version with separate node pools, network policies and audit logging, with the choices behind each box.
Most EKS diagrams show every service AWS sells. A useful one shows the few decisions that matter and where each piece sits. These two cover most of what we build: a small team that wants Kubernetes without a platform team, and a company handling regulated data that needs to show auditors where the boundaries are.
Edge
Every public route behind CloudFront; WAF rate limits on sign-up, login and APIs.
Entry
One ALB shared by services, not one per service.
Cluster
Auto Mode runs node provisioning, scaling and the core add-ons; one cluster each for staging and production.
Workloads
Each service account maps to its own IAM role.
Delivery
Git is the source of truth; CI builds images, Argo CD deploys them.
Data
State lives outside the cluster; the cluster can be rebuilt.
Watch
Small team: one cluster per environment, Auto Mode, managed add-ons
Auto Mode over self-managed node groups: AWS patches and replaces nodes, at a management fee per instance (between about $0.02 and $0.07 an hour on the instance types in AWS's examples). Worth it when nobody's job is node upgrades.
State outside the cluster: no databases in StatefulSets. A cluster you can recreate in an afternoon makes upgrades and disasters routine.
Managed Argo CD: about $22 a month plus about $1.10 per application, so nobody runs Argo CD's own upgrades.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Edge
TLS 1.2 or later end to end.
Entry
The Kubernetes API is not reachable from the internet.
Cluster
Taints and tolerations keep regulated pods on their own nodes.
Isolation
Default deny between namespaces; cluster-wide rules no team can override.
Identity
People and pods each get their own role; every grant is in CloudTrail.
Data
Audit
Regulated data: isolation, encryption and an audit trail at every layer
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Karpenter in 2026: Static Capacity, Node Overlays, Balanced Consolidation and When to Use Auto Mode Instead
Karpenter went from v1.0 to v1.15 in two years: static capacity, NodeOverlay for pricing and capacity overrides, NodePool node limits, a grace period for do-not-disrupt, a Balanced consolidation policy, CapacityBuffer and DRA for GPUs. What each is for, a production NodePool, and the case for letting EKS Auto Mode run it.
Read
The EKS Upgrade Playbook: One Minor Version at a Time, Without an Outage
Kubernetes ships a minor version about every four months and EKS supports each for 14 months, then 12 more at six times the price. A repeatable upgrade: insights first, control plane, add-ons, nodes, then Fargate pods, with a seven-day rollback window for in-place upgrades and the checks between each step.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.