Managed Kubernetes: EKS, AKS and GKE

Why Kubernetes?

ECS works only on AWS. Kubernetes (often written K8s) is an open-source orchestrator that runs the same way on every cloud and in your own data centre. The same manifests (YAML files that describe your app) work on EKS, AKS and GKE with small changes. It has a huge ecosystem of tools, but it is also complex. The DevOps course goes deep; this lesson gives you the one picture you need for the cloud.

Kubernetes in one picture

• Control plane: the brain. The API server receives every request, etcd stores the cluster state, the scheduler picks a node for each new pod, and controllers keep fixing the difference between what you asked for and what is running.
• Worker nodes: the machines (usually VMs) that run your containers. Each runs a kubelet agent and a container runtime.
• Pod: the smallest unit Kubernetes runs, one or more containers that share a network address.
• Deployment: says "keep 3 copies of this pod running, with this image" and handles rolling updates.
• Service: a stable name and IP address in front of a changing set of pods, so other apps can find them.

The key idea is desired state. You do not say "start a container on node 2". You declare what you want, and the control plane keeps making reality match it, all day.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: orders-api
  template:
    metadata:
      labels:
        app: orders-api
    spec:
      containers:
        - name: api
          image: asia-south1-docker.pkg.dev/shop-prod/apps/orders-api:1.0.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: orders-api
spec:
  selector:
    app: orders-api
  ports:
    - port: 80
      targetPort: 8080

kubectl apply -f orders-api.yaml           # create or update everything in the file
kubectl get pods -l app=orders-api         # list the pods
kubectl rollout status deployment/orders-api
kubectl logs deployment/orders-api         # logs from one of its pods

What "managed control plane" means

Running the control plane yourself means keeping etcd backed up, the API server highly available, and every part patched and upgraded. With managed Kubernetes, the cloud provider runs the control plane, keeps it available, patches it and helps you upgrade it. You still own your workloads, and in most modes you still own the worker nodes.

Kubernetes releases a new minor version roughly three times a year, and each version is supported for a limited time. Plan upgrades: usually the control plane first, then the nodes. Read the release notes for removed APIs. Staying on an old version can cost extra or force an upgrade at a bad time.

The three managed services

EKS managed node groups create and update the EC2 instances for you. A Fargate profile says which pods (by namespace and labels) run on Fargate instead of nodes, so there is no server to manage for them. AWS also offers EKS Auto Mode, which manages nodes for you. In GKE, a regional cluster spreads the control plane and nodes across three zones, so the loss of one zone does not stop the cluster. Pricing details change, so check each provider's current pricing page.

gcloud container clusters create-auto shop --region asia-south1
gcloud container clusters get-credentials shop --region asia-south1
aws eks update-kubeconfig --name shop --region ap-south-1
az aks get-credentials --resource-group shop-rg --name shop-aks

Common mistakes and how to fix them

• Pods without resource requests. The scheduler cannot place them well and Autopilot cannot bill them sensibly. Fix: set CPU and memory requests on every container.
• Using the latest image tag. Fix: use version tags or digests so rollouts and rollbacks are predictable.
• A single-zone cluster for production. Fix: use a regional cluster or spread nodes across zones.
• Skipping upgrades until the version leaves support. Fix: upgrade on a schedule, test in staging first.
• Giving every Service type LoadBalancer. Each one creates a cloud load balancer that costs money. Fix: use one Ingress or Gateway for many services.
• Many tiny clusters, each paying a control plane fee. Fix: use namespaces to share a cluster where it is safe.