How do I install the AWS Eks Enterprise Patterns skill?

Run npx skillmds@latest add mchittineni/aws-eks-enterprise-patterns in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AWS Eks Enterprise Patterns safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AWS Eks Enterprise Patterns?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AWS Eks Enterprise Patterns free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AWS Eks Enterprise Patterns?

mchittineni (@mchittineni) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AWS Eks Enterprise Patterns by mchittineni

Name: AWS Eks Enterprise Patterns
Author: mchittineni

AWS Eks Enterprise Patterns

Enterprise AWS EKS architecture: VPC CNI prefix delegation and IP planning, Karpenter NodePool/EC2NodeClass autoscaling, IRSA and EKS Pod Identity, add-on lifecycle, and upgrade strategy. Use when designing, scaling, hardening, or upgrading an EKS cluster, or fixing pod IP exhaustion and node-scaling problems.

mchittineni 9a75b42 2 files · 4.6 KB Updated Sep 17, 2026

File contents

Enterprise AWS EKS Architecture & Karpenter Node Autoscaling

When to Use This Skill

Triggers — load this skill when:

An EKS cluster needs node autoscaling, IP planning, or add-on decisions
Pods need AWS API access via IRSA or Pod Identity instead of node roles
Cluster or node-group upgrades must be planned safely

Route elsewhere when:

Account-level guardrails and SCPs -> aws-iam-zero-trust-policies
Workload packaging -> helm-kubernetes-deployment
Node cost optimization -> finops-framework-inform-optimize-operate

1. Karpenter NodePool & EC2NodeClass Specification

apiVersion: karpenter.sh/v1beta1
kind: NodePool
metadata:
  name: general-compute
spec:
  template:
    spec:
      requirements:
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["spot", "on-demand"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["c", "m", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["5"]
      nodeClassRef:
        name: default-ec2-class
  limits:
    cpu: "500"
    memory: 1000Gi
  disruption:
    consolidationPolicy: WhenUnderutilized
    expireAfter: 720h # 30 days node recycling
---
apiVersion: karpenter.k8s.aws/v1beta1
kind: EC2NodeClass
metadata:
  name: default-ec2-class
spec:
  amiFamily: AL2023
  role: "KarpenterNodeRole-Production"
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: "production-eks-cluster"
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: "production-eks-cluster"

2. EKS Production Hardening Guidelines

EKS Pod Identity / IRSA: Never attach IAM policies directly to EC2 Worker Node IAM roles; use IAM Roles for Service Accounts (IRSA) or AWS EKS Pod Identity.
VPC CNI Prefix Delegation: Enable ENABLE_PREFIX_DELEGATION=true to allow large pod densities per node without exhausting VPC subnets.
Control Plane Logging: Send API, Audit, and Authenticator logs to Amazon CloudWatch with 30-day retention policies.

---name: aws-eks-enterprise-patternsdescription: Enterprise AWS EKS architecture: VPC CNI prefix delegation and IP planning, Karpenter NodePool/EC2NodeClass autoscaling, IRSA and EKS Pod Identity, add-on lifecycle, and upgrade strategy. Use when designing, scaling, hardening, or upgrading an EKS cluster, or fixing pod IP exhaustion and node-scaling problems.---# Enterprise AWS EKS Architecture & Karpenter Node Autoscaling## When to Use This Skill**Triggers — load this skill when:**- An EKS cluster needs node autoscaling, IP planning, or add-on decisions- Pods need AWS API access via IRSA or Pod Identity instead of node roles- Cluster or node-group upgrades must be planned safely**Route elsewhere when:**- Account-level guardrails and SCPs -> `aws-iam-zero-trust-policies`- Workload packaging -> `helm-kubernetes-deployment`- Node cost optimization -> `finops-framework-inform-optimize-operate`## 1. Karpenter NodePool & EC2NodeClass Specification```yamlapiVersion: karpenter.sh/v1beta1kind: NodePoolmetadata: name: general-computespec: template: spec: requirements: - key: karpenter.sh/capacity-type operator: In values: ["spot", "on-demand"] - key: karpenter.k8s.aws/instance-category operator: In values: ["c", "m", "r"] - key: karpenter.k8s.aws/instance-generation operator: Gt values: ["5"] nodeClassRef: name: default-ec2-class limits: cpu: "500" memory: 1000Gi disruption: consolidationPolicy: WhenUnderutilized expireAfter: 720h # 30 days node recycling---apiVersion: karpenter.k8s.aws/v1beta1kind: EC2NodeClassmetadata: name: default-ec2-classspec: amiFamily: AL2023 role: "KarpenterNodeRole-Production" subnetSelectorTerms: - tags: karpenter.sh/discovery: "production-eks-cluster" securityGroupSelectorTerms: - tags: karpenter.sh/discovery: "production-eks-cluster"```---## 2. EKS Production Hardening Guidelines- **EKS Pod Identity / IRSA**: Never attach IAM policies directly to EC2 Worker Node IAM roles; use IAM Roles for Service Accounts (IRSA) or AWS EKS Pod Identity.- **VPC CNI Prefix Delegation**: Enable `ENABLE_PREFIX_DELEGATION=true` to allow large pod densities per node without exhausting VPC subnets.- **Control Plane Logging**: Send API, Audit, and Authenticator logs to Amazon CloudWatch with 30-day retention policies.

Frequently asked questions