Modernizing Apps with Amazon EKS

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Modernizing legacy applications with
Amazon EKS
Jeremy Cowan
Sr. Specialist Solution Architect, Containers
Amazon Web Services
M A D 3 0 1

Agenda
Customer use cases
Kubernetes and why it matters
Introducing Amazon EKS
Amazon EKS Control Plane
Amazon EKS Worker Nodes
Amazon EKS networking and load balancing
Machine learning
Windows containers

How are customers using Amazon EKS?
Enterprise app migration
Microservices
Machine learning

Who is using Amazon EKS?
“We built the next generation of our PaaS using Amazon EKS for large
enterprise workloads. We manage thousands of applications and have
hundreds of DevOps teams.”

“Kubernetes is fast becoming the preferred solution for container
orchestration. Its biggest downside is that it is not simple to set up and
operate. Amazon EKS gives us all the benefits of Kubernetes, but takes care of
managing the hard stuff. We can dedicate less resources to deployment and
operations as a result.”

Which customers are using Amazon EKS?
“The performance from Amazon EKS makes it feasible to effectively manage
large-scale databases delivering over a million queries per second. Amazon EKS
also helps with our cluster management and scalability challenges.”

Recap: What’s a container
Runtime
Code
Dependencies
Single, immutable object

Open source container
management platform
Helps you run
containers at scale
Gives you primitives
for building
modern applications
What is Kubernetes?

What it takes to enable rapid innovation
Quality Agility Velocity
Rapid
innovation

Kubernetes promotes innovation
Quality
• Basic primitives for deploying and running any application
Agility
• Extensible
• Run anywhere
Velocity
• Automation for workload deployment and scaling

Modernization with Kubernetes
1 Migrate in place
Move apps to containers without code changes.
2
3 Run anywhere
Move entire organizations to the cloud using the same
containers, tooling, and remove the need to manage any
infrastructure.
Implement tooling
Use Kubernetes to implement standard deployment and
operational tooling across all your apps.

Amazon EKS, a year in review
April – June 2018:
EKS achieves K8s conformance, HIPAA-eligibility, Generally available
July – September 2018:
Amazon EKS AMI build scripts and AWS CloudFormation templates available in GitHub.
Support for GPU-enabled EC2 instances, support for HPA with custom or external metrics.
EKS launches in Dublin, Ireland
EKS simplifies cluster setup with update-kubeconfig CLI command
October – December 2018:
EKS adds support for Dynamic Admission Controllers (Istio), ALB Support with AWS ALB Ingress Controller
Amazon EKS launches in Ohio, Frankfurt, Singapore, Sydney, and Tokyo
EKS adds Managed Cluster Updates and Support for Kubernetes Version 1.11

Amazon EKS, a year in review
January – May 2019:
EKS Adds support for Kubernetes 1.12
EKS launches in Seoul, Mumbai, London, and Paris
EKS achieves ISO and PCI compliance, announces 99.9% SLA, cluster creation limit raised to 50
API Server Endpoint Access Control, AWS App Mesh controller, Windows support (preview)
Amazon CloudWatch Container Insights for EKS and Kubernetes Public Preview
EKS Simplifies Cluster Authentication
EKS Adds Support for Public IP Addresses Within Cluster VPCs
EKS Now Delivers Kubernetes Control Plan Logs to Amazon CloudWatch

Open source and Amazon EKS
Amazon EKS runs 100% upstream Kubernetes
Key components of Amazon EKS are open source
• Amazon VPC CNI Plugin
• AWS Identity and Access Management (IAM) Authenticator
• Amazon EKS AMI

Open source and Amazon EKS
Team contributes to or manages 20+ OSS projects
• /kubernetes
• /kubernetes/autoscaler
• /atlassian/escalator
• /awslabs/aws-service-operator
• /awslabs/aws-servicebroker
• /weaveworks/eksctl
• /aws/amazon-vpc-cni-k8s
• EBS, EFS, Amazon FSx CSI drivers
• kops

Amazon EKS architecture
prod-cluster-123.eks.amazonaws.com
Amazon EKS workers
kubectl
AZ 1 AZ 2 AZ 3
Your AWS account
VPC
Amazon EKS

VPC
Kubernetes control plane
Highly available and single tenant
infrastructure
All “native AWS” components
Fronted by an NLB
Network Load Balancer
Amazon EKS
Etcd
API Servers

VPC
Kubernetes control plane
Highly available and single tenant
infrastructure
All “native AWS” components
Fronted by an NLB
Network Load Balancer
Amazon EKS
Availability Zone 1 Availability Zone 2 Availability Zone 3
Etcd
API Servers

Creating a cluster: Planning

Provide Amazon EKS a role with the correct
policies attached
Creating a cluster: Amazon EKS role

Creating a cluster: Amazon VPC
Provide all subnets that will host Kubernetes resources:
Load balancers and worker nodes
Subnets can be public, private, or both
Amazon EKS will tag the subnets with
kubernetes.io/cluster/<cluster-name> =
shared
Subnets that will host internal load balancers need the tag
kubernetes.io/role/internal-elb = 1

Creating a cluster: Amazon VPC
Plan ahead with subnet sizes! Pods each consume an
Amazon VPC IP address.
/24 subnet = 254 IPs total. Subtract one for each node in
your cluster, and the remainder is what you have for pods
(probably not enough!)
Amazon EKS–provided sample VPC template uses a /18

Creating a cluster: Control plane security group
This security group defines connectivity between the
Kubernetes control plane and worker nodes
At minimum, Kubernetes needs 443 inbound and 10250
outbound
This security group needs permissions that align with the
worker node security group

Kubernetes version
Latest: 1.12.6
Coming soon: 1.13
Amazon EKS will support up to three versions of Kubernetes at once
Deprecation in line with the community stopping support for older
versions

Amazon EKS version lifecycle
Strong emphasis on running production grade workloads, supportability, and
security
Amazon EKS lifecycle process
• Announcement 60 days prior to deprecating a Kubernetes version
• After 60 days, your cluster will automatically be upgraded to the next version
• Coincides with when the project stops supporting the deprecated version
• Prevented from creating a cluster using a deprecated version
• Customer upgrades worker nodes (n-2)

Amazon EKS platform version
Platform version revisions represent API server configuration
changes or Kubernetes patches
Platform versions increment within a Kubernetes version only
Kubernetes Kubernetes Kubernetes

API server configuration
Kubernetes version Kubernetes patch version Amazon EKS platform version Enabled admission controllers Release notes
1.10 1.10.3 eks.2 Initializers, NamespaceLifecycle, Limi
tRanger, ServiceAccount,
DefaultStorageClass,
ResourceQuota,
DefaultTolerationSeconds,
NodeRestriction,
MutatingAdmissionWebhook,
ValidatingAdmissionWebhook
•Added support for
Kubernetes aggregation layer.
•Added support for
Kubernetes Horizontal Pod
Autoscaler (HPA).
•Kubernetes Metrics Server 0.3.0 or
greater is compatible with Amazon
EKS platform version eks.2.

Amazon EKS Kubernetes version update

Lifecycle management of worker nodes with eksctl
Create node groups
• Uses version of control plane by default
• Override using --version flag
Scale node groups
Delete node groups
• Will cordon and drain pods before instances are terminated
Drain node groups

IAM authentication
Kubectl
3) Authorizes AWS identity with RBAC
Kubernetes
API
1) Passes AWS identity
2) Verifies AWS identity
4) Kubernetes action
allowed/denied

Simplified authentication with the AWS CLI
Previously required IAM Authenticator
Added eks get-token subcommand to generate the base 64 encoded token to
authenticate to the Amazon EKS cluster
https://sts.amazonaws.com/?Action=GetCallerIdentity&Version=201
1-06-15&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-
Credential=AKIAJHGRILKNSRC2W5QA%2F20190524%2Fus-east-
1%2Fsts%2Faws4_request&X-Amz-Date=20190524T040522Z&X-Amz-
Expires=0&X-Amz-SignedHeaders=host%3Bx-k8s-aws-id&X-Amz-
Signature=fe007f38e753a609523ec5931f6bf41e5fade79689354a63818a6
ace65fefb

PKI configuration
Kubelet
Generates
public/private keys
Kubelet installs
server cert
Kubelet issues CSR
Certificate rotation
Amazon EKS API serverAmazon EKS worker
Amazon

Amazon EKS is ready for sensitive and regulated
workloads
(16-May)

aws eks update-kubeconfig --name my-cluster
CLI Helper command to create kubeconfig file
Creates a new context for each cluster in the config
Wrapping it all up
Easily export control plane config

✅
✅
✅
✅
Bring your own instances
Instance flexibility

Bring your own OS
Amazon EKS AMI build scripts
https://github.com/awslabs/amazon-eks-ami
Amazon
Amazon
Amazon

Provisioning worker nodes
AWS CloudFormation
CDK
eksctl Partners …
… more
Terraform
Pulumi
Rancher

Updating worker nodes
Amazon
EKS node drainer

Storage—CSI drivers
CSI == Container Storage Interface
Flexible standard for orchestration and storage provider connections
Amazon Elastic Block Store: AWS EBS CSI Driver
Now supported for production workloads as a Kubernetes beta
Part of Kubernetes SIGs on GitHub
Amazon Elastic File System: AWS EFS CSI Driver
Amazon FSx for Lustre: AWS FSx CSI Driver
Both now available as a Kubernetes alpha
Part of Kubernetes SIGs on GitHub

Cross account ENI
Worker VPC (your account)
Kubectl
Master VPC (AWS account)
etcd
AZ 1
API Server
etcd
API Server
Amazon EKS-
owned ENI
Kubelet
AZ 1
Worker
node
Amazon EKS-
owned ENI
Kubelet
AZ 2
Worker
node
AZ 2
Kube-proxy Kube-proxy

API-server Endpoint Access Control
Kubectl
etcd
AZ 1
API Server
etcd
API Server
Amazon EKS-
owned ENI
Kubelet
AZ 1
Worker
node
Amazon EKS-
owned ENI
Kubelet
AZ 2
Worker
node
Public == true
AZ 2
Kube-proxy Kube-proxy

Kubectl
etcd
AZ 1
AZ 2
API Server
etcd
API Server
Amazon EKS-
owned ENIs
Public == true
Private == true
Private hosted zone
Kubelet
AZ 1
Worker
node
Kube-proxy
Kubelet
AZ 2
Worker
node
Kube-proxy

Kubectl
etcd
AZ 1 AZ 2
API Server
etcd
API Server
Amazon EKS-
owned ENIs
Public == false
Private == true
Private hosted zone
Kubelet
AZ 1
Worker
node
Kube-proxy
Kubelet
AZ 2
Worker
node
Kube-proxy

Amazon VPC CNI plugin
ENI
Secondary IPs:
10.0.0.1
10.0.0.2
10.0.0.1
10.0.0.2
ENI
10.0.0.20
10.0.0.22
Secondary IPs:
10.0.0.20
10.0.0.22
ec2.associateaddress()
VPC Subnet – 10.0.0.0/24
Instance 1 Instance 2
VPC

Amazon EKS supports advanced networking architectures
VPC - Multiple IP ranges
Subnet 1 – 10.0.0.0/16 Subnet 2 – 100.64.0.0/10
Customer
gateway
Corporate data
center
On Premises – 10.1.0.0/16
VPN or DX Pod Outbound
Traffic SNAT
Amazon EKS Worker Node
Primary ENI Pod Secondary
ENI
Pod –
100.64.0.200

Load balancing
All three AWS Elastic Load Balancing products are supported
Network Load Balancer and Classic Load Balancer supported by
Kubernetes Service type=LoadBalancer
Internal and external load balancer support

Load balancing
Want to use an internal load balancer? Use annotation:
service.beta.kubernetes.io/aws-load-balancer-
internal: 0.0.0.0/0
Want to use a Network Load Balancer? Use annotation:
service.beta.kubernetes.io/aws-load-balancer-
type: nlb

Application Load Balancer Ingress Controller
Production-ready 1.0 release
Supported by Amazon EKS team
Open source development: https://github.com/kubernetes-sigs/aws-
alb-ingress-controller
Customers are using it in production today!

ALB ingress: Recently added features
Autoselect certificates based on ingress hostname
Register out of VPC targets
• Pod IP targets outside of the ALB’s VPC
Support for multiple SSL certificates
Support for authentication via Amazon Cognito and OIDC
Support for existing targetGroup as a backend

ALB Ingress Controller
AWS resources
Kubernetes cluster
Node Node
Kubernetes
API server ALB Ingress
Controller
Node
HTTP listenerHTTPS listener
Rule: /cheesesRule: /charcuterie
TargetGroup:
Green (IP Mode)
TargetGroup:
Blue (Instance
Mode)
NodePort NodePort

1
2
3

Deep learning model lifecycle
Training
• Gather data for training and testing
• Hyper-parameter tuning
• Distributed training using GPUs
• Cost-to-train and time-to-train
Inference
• Hundreds of machines
• Throughput and latency important
• Cost per inference and inference/sec.
• Run at scale for long

AWS Deep Learning
Containers
Quickly set up deep learning environments with optimized,
pre-packaged Docker container images
Get best performance automatically; no tuning required
Support TensorFlow and Apache MXNet
Deploy on Amazon ECS, Amazon EKS, or Amazon EC2
Customizable container images
Available at no cost from Amazon ECR
and AWS Marketplace Amazon ECR AWS
Marketplace

Now supporting P3dn.24xlarge instances
CUDA 10 with NVIDIA v410 coming soon!
Amazon EKS-optimized GPU AMI

Windows containers
Developer preview for all customers today
Run Windows containers and Windows server nodes with Amazon EKS
Supports heterogeneous (mixed) clusters
Kubernetes version 1.11+
Available in all Amazon EKS regions
Get started and give feedback on GitHub
https://github.com/aws/containers-roadmap

Recap!
Amazon 🎉

Global availability
Americas
Virginia, Ohio, Oregon
EMEA
Ireland, Frankfurt, London, Paris, Stockholm
Asia Pacific
Singapore, Tokyo, Sydney, Seoul, Mumbai

AWS containers roadmap
Stay up to date with what we’re working on
Give us feedback and propose ideas
Get notified when new features ship
https://github.com/aws/containers-roadmap

Modernizing Apps with Amazon EKS

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Modernizing Apps with Amazon EKS

Similar to Modernizing Apps with Amazon EKS (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Modernizing Apps with Amazon EKS