# AWS Eks Enterprise Patterns

> Enterprise AWS EKS architecture: VPC CNI prefix delegation and IP planning, Karpenter NodePool/EC2NodeClass autoscaling, IRSA and EKS Pod Identity, add-on lifecycle, and upgrade strategy. Use when designing, scaling, hardening, or upgrading an EKS cluster, or fixing pod IP exhaustion and node-scaling problems.

- Skill: `mchittineni/aws-eks-enterprise-patterns` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mchittineni/aws-eks-enterprise-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mchittineni/aws-eks-enterprise-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: mchittineni (https://skillmd.com/u/mchittineni)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mchittineni/aws-eks-enterprise-patterns

---


# Enterprise AWS EKS Architecture & Karpenter Node Autoscaling

## When to Use This Skill

**Triggers — load this skill when:**

- An EKS cluster needs node autoscaling, IP planning, or add-on decisions
- Pods need AWS API access via IRSA or Pod Identity instead of node roles
- Cluster or node-group upgrades must be planned safely

**Route elsewhere when:**

- Account-level guardrails and SCPs -> `aws-iam-zero-trust-policies`
- Workload packaging -> `helm-kubernetes-deployment`
- Node cost optimization -> `finops-framework-inform-optimize-operate`

## 1. Karpenter NodePool & EC2NodeClass Specification

```yaml
apiVersion: karpenter.sh/v1beta1
kind: NodePool
metadata:
  name: general-compute
spec:
  template:
    spec:
      requirements:
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["spot", "on-demand"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["c", "m", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["5"]
      nodeClassRef:
        name: default-ec2-class
  limits:
    cpu: "500"
    memory: 1000Gi
  disruption:
    consolidationPolicy: WhenUnderutilized
    expireAfter: 720h # 30 days node recycling
---
apiVersion: karpenter.k8s.aws/v1beta1
kind: EC2NodeClass
metadata:
  name: default-ec2-class
spec:
  amiFamily: AL2023
  role: "KarpenterNodeRole-Production"
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: "production-eks-cluster"
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: "production-eks-cluster"
```

---

## 2. EKS Production Hardening Guidelines

- **EKS Pod Identity / IRSA**: Never attach IAM policies directly to EC2 Worker Node IAM roles; use IAM Roles for Service Accounts (IRSA) or AWS EKS Pod Identity.
- **VPC CNI Prefix Delegation**: Enable `ENABLE_PREFIX_DELEGATION=true` to allow large pod densities per node without exhausting VPC subnets.
- **Control Plane Logging**: Send API, Audit, and Authenticator logs to Amazon CloudWatch with 30-day retention policies.