The Managed Control Plane

AWS runs the Kubernetes API server, etcd, scheduler, and controllers for you across multiple Availability Zones.

A Kubernetes cluster is split into the control plane (the brains) and worker nodes (where your pods run). With EKS, AWS owns and operates the control plane in an AWS-managed account you never see.

What the control plane includes

  • kube-apiserver — the front door every kubectl command talks to.
  • etcd — the key-value store holding all cluster state, encrypted and backed up by AWS.
  • Scheduler & controllers — decide where pods run and reconcile desired state.

High availability by default

EKS runs at least two API server instances and three etcd instances spread across three Availability Zones. AWS automatically replaces unhealthy instances and patches the version for you.

You reach the control plane through a single cluster endpoint (a DNS name). It can be public, private, or both.

Example

Example · bash
# See the managed API endpoint and its access configuration
aws eks describe-cluster --name demo \
  --query 'cluster.{endpoint:endpoint,version:version,access:resourcesVpcConfig}'

When to use it

  • A platform engineering team offloads etcd backup and recovery to AWS, eliminating a weekend on-call rotation for control plane incidents.
  • A healthcare SaaS provider relies on the multi-AZ control plane to meet strict uptime requirements without running their own Kubernetes masters.
  • A startup reduces DevOps headcount by letting EKS auto-patch the API server, scheduler, and controllers during maintenance windows.

More examples

Check control plane version

Retrieves the Kubernetes version running on the AWS-managed control plane without SSH access to master nodes.

Example · bash
aws eks describe-cluster \
  --name my-cluster \
  --query 'cluster.version' \
  --output text

Enable control plane logging

Enables streaming of API server, scheduler, and controller manager logs to CloudWatch Logs for observability.

Example · bash
aws eks update-cluster-config \
  --name my-cluster \
  --logging '{"clusterLogging":[{"types":["api","scheduler","controllerManager"],"enabled":true}]}'

Describe API server endpoint access

Shows whether the managed control plane endpoint allows public or only private VPC access.

Example · bash
aws eks describe-cluster \
  --name my-cluster \
  --query 'cluster.resourcesVpcConfig.{PublicAccess:endpointPublicAccess,PrivateAccess:endpointPrivateAccess}'

Related

eks architectureeks intro

Discussion

  • Be the first to comment on this lesson.