The EKS deployment should use ServiceAccount for pods Create the CR to eks cluster Control the access to Istio ingress gateway through bind the securitygroup to pod network interface. 1apiVersion: vpcresources.k8s.aws/v1beta1 2kind: SecurityGroupPolicy 3metadata: 4 name: istio-internal-ingressgateway-sg 5 namespace: …

read more

For greater isolation and convenience, we can use farget as the run time environment for eks. Create eks farget execute role named: AmazonEKSFargatePodExecutionRole the TrustPolicy statements like following 1# trust policy 2{ 3 "Version": "2012-10-17", 4 "Statement": [ 5 { 6 "Effect": …

read more

Create eks node group label and taint 1labels = { 2 "node-group" : "spotInstances" 3} 4taints = [ 5 { 6 effect = "NO_SCHEDULE" 7 key = "devops" 8 value = "forceSchedule" 9 } 10] Create priorityClass one to placeholder other one to nornal schedule 1apiVersion: scheduling.k8s.io/v1 …

read more