Evaluating theTop 3 Kubernetes Providers
EKS vs GKE vs AKS
Karen Bruner,Tech Evangelist, StackRox
March 24, 2020
2©2020 StackRox. All rights reserved.
What We’ll Cover
● Supported Kubernetes versions
● Maintenance
● Features
● Networking
● Security
● And more
Karen Bruner
StackRoxTech Evangelist
longtime DevOps engineer
3©2020 StackRox. All rights reserved.
Google Kubernetes
Engine
Amazon Elastic
Kubernetes Service
Azure Kubernetes
Service
vs vs
4©2020 StackRox. All rights reserved.
Version EKS AKS GKE Kubernetes
1.18 ✔
1.17 preview preview* ✔
1.16 ✔ beta ✔
1.15 ✔ default ✔
1.14 default ✔ default
1.13 ✔
1.12 deprecated
Version Support Matrix
* GKE preview requires requesting access
5©2020 StackRox. All rights reserved.
EKS AKS GKE
Control plane
upgrades
User initiates +
must upgrade
add-ons
User initiates Automatic
Node upgrades User initiates;
manual for some
node groups
User initiates Automatic
Node health
monitoring
None None Automatic node
repair
Upgrades and Maintenance
6©2020 StackRox. All rights reserved.
* Default
^ Preview/Beta
Feature EKS AKS GKE Kubernetes
Node OS ●Amazon Linux*
●Ubuntu
●Custom AMI
●Windows Server
●Ubuntu*
●Windows
Server^
●COS*
●Ubuntu
●Windows
Server^
●Any Compatible
Linux
●Windows
Server^
Container
Runtime
Docker Docker (Moby) ● Docker*
● containerd
● Docker
● CRI
GPU support NVIDIA NVIDIA NVIDIA With device
plugins
Node pool
autoscaling
Yes; user must
install add-on
Yes Yes Supported
Node Features
7©2020 StackRox. All rights reserved.
Option EKS AKS GKE
Highly Available Yes Not stated
Zonal: no
Regional: yes
Service Level
Agreement
99.9% 99.5%
Zonal: 99.5%
Regional: 99.95%
Financially-backed
SLA
Yes No Starting June 2020
Control Plane Cost US$0.10/hr None
US$0.10/hr Starting
June 2020
Control Plane Options
8©2020 StackRox. All rights reserved.
* Must be selected at cluster creation time
Version EKS AKS GKE Kubernetes
Network plugin/CNI AWSVPC CNI Option between
kubenet or Azure
CNI
kubenet kubenet (default;
CNIs can added)
Pod network CIDR VPC network Private (kubenet) or
VPC (Azure CNI)
Private (default) or
VPC
Network Policy
Support
User can install
Calico as add-on
Calico or Azure
Policy*
Can be enabled at
any time (Calico)
Available as CNI
Networking
9©2020 StackRox. All rights reserved.
* Must be enabled at cluster creation time
Option EKS AKS GKE Kubernetes
Kubernetes RBAC Always enabled Optional* Optional Optional
Pod Security
Policies
Always enabled Optional Optional Optional
Private Kubernetes
API Endpoint
Optional Optional* Optional
Public API Endpoint
Whitelist
Yes Yes Yes
Read-only Root
Filesystem (Nodes)
No No Yes for COS Supported
Security Options
10©2020 StackRox. All rights reserved.
Limit EKS AKS GKE Kubernetes
Max clusters 100/region 100 50/zone & 50
regional clusters
Max nodes per
cluster
Managed node
groups: 1000
100-1000;Varies by
network andVM set
type
●5000
●1000 w/ GKE
ingress controller
5000
Max nodes per
node pool
Managed node
groups: 100
100 1000
Max node pools per
cluster
Managed node
groups: 10
10 Not documented
Max pods per node Varies by instance
type and OS
30-250, depending
on network type
and configuration
110 100 (recommended
value, configurable)
Service Limits
11©2020 StackRox. All rights reserved.
Takeaways
• Not all managed Kubernetes services are created equally
• Most mature: GKE
• Most unmanaged: EKS
• AKS and EKS require more hands-on or automation work
• Read the blog post at www.stackrox.com!
12
Q&A
13
Let’s chat
Think of a question later?
Karen@stackrox.com
Twitter @fuzzyKB
www.linkedin.com/in/kmbruner/
Want to learn more?
https://www.stackrox.com/
We’re hiring!

EKS vs GKE vs AKS - Evaluating Kubernetes in the Cloud

  • 1.
    Evaluating theTop 3Kubernetes Providers EKS vs GKE vs AKS Karen Bruner,Tech Evangelist, StackRox March 24, 2020
  • 2.
    2©2020 StackRox. Allrights reserved. What We’ll Cover ● Supported Kubernetes versions ● Maintenance ● Features ● Networking ● Security ● And more Karen Bruner StackRoxTech Evangelist longtime DevOps engineer
  • 3.
    3©2020 StackRox. Allrights reserved. Google Kubernetes Engine Amazon Elastic Kubernetes Service Azure Kubernetes Service vs vs
  • 4.
    4©2020 StackRox. Allrights reserved. Version EKS AKS GKE Kubernetes 1.18 ✔ 1.17 preview preview* ✔ 1.16 ✔ beta ✔ 1.15 ✔ default ✔ 1.14 default ✔ default 1.13 ✔ 1.12 deprecated Version Support Matrix * GKE preview requires requesting access
  • 5.
    5©2020 StackRox. Allrights reserved. EKS AKS GKE Control plane upgrades User initiates + must upgrade add-ons User initiates Automatic Node upgrades User initiates; manual for some node groups User initiates Automatic Node health monitoring None None Automatic node repair Upgrades and Maintenance
  • 6.
    6©2020 StackRox. Allrights reserved. * Default ^ Preview/Beta Feature EKS AKS GKE Kubernetes Node OS ●Amazon Linux* ●Ubuntu ●Custom AMI ●Windows Server ●Ubuntu* ●Windows Server^ ●COS* ●Ubuntu ●Windows Server^ ●Any Compatible Linux ●Windows Server^ Container Runtime Docker Docker (Moby) ● Docker* ● containerd ● Docker ● CRI GPU support NVIDIA NVIDIA NVIDIA With device plugins Node pool autoscaling Yes; user must install add-on Yes Yes Supported Node Features
  • 7.
    7©2020 StackRox. Allrights reserved. Option EKS AKS GKE Highly Available Yes Not stated Zonal: no Regional: yes Service Level Agreement 99.9% 99.5% Zonal: 99.5% Regional: 99.95% Financially-backed SLA Yes No Starting June 2020 Control Plane Cost US$0.10/hr None US$0.10/hr Starting June 2020 Control Plane Options
  • 8.
    8©2020 StackRox. Allrights reserved. * Must be selected at cluster creation time Version EKS AKS GKE Kubernetes Network plugin/CNI AWSVPC CNI Option between kubenet or Azure CNI kubenet kubenet (default; CNIs can added) Pod network CIDR VPC network Private (kubenet) or VPC (Azure CNI) Private (default) or VPC Network Policy Support User can install Calico as add-on Calico or Azure Policy* Can be enabled at any time (Calico) Available as CNI Networking
  • 9.
    9©2020 StackRox. Allrights reserved. * Must be enabled at cluster creation time Option EKS AKS GKE Kubernetes Kubernetes RBAC Always enabled Optional* Optional Optional Pod Security Policies Always enabled Optional Optional Optional Private Kubernetes API Endpoint Optional Optional* Optional Public API Endpoint Whitelist Yes Yes Yes Read-only Root Filesystem (Nodes) No No Yes for COS Supported Security Options
  • 10.
    10©2020 StackRox. Allrights reserved. Limit EKS AKS GKE Kubernetes Max clusters 100/region 100 50/zone & 50 regional clusters Max nodes per cluster Managed node groups: 1000 100-1000;Varies by network andVM set type ●5000 ●1000 w/ GKE ingress controller 5000 Max nodes per node pool Managed node groups: 100 100 1000 Max node pools per cluster Managed node groups: 10 10 Not documented Max pods per node Varies by instance type and OS 30-250, depending on network type and configuration 110 100 (recommended value, configurable) Service Limits
  • 11.
    11©2020 StackRox. Allrights reserved. Takeaways • Not all managed Kubernetes services are created equally • Most mature: GKE • Most unmanaged: EKS • AKS and EKS require more hands-on or automation work • Read the blog post at www.stackrox.com!
  • 12.
  • 13.
    13 Let’s chat Think ofa question later? Karen@stackrox.com Twitter @fuzzyKB www.linkedin.com/in/kmbruner/ Want to learn more? https://www.stackrox.com/ We’re hiring!