Prasanta Kumar Behera
Amazon EKS in Production with Terraform
Learning Hub / Cloud — OpenStack, AWS & EKS

Amazon EKS in Production with Terraform

Advanced → Architect18 lessonsAvailable

An architect-level EKS track built with Terraform: networking with the VPC CNI and secondary CIDRs, identity with Pod Identity/IRSA and access entries, Karpenter for capacity, and a CI/CD flow from laptop to cluster.

You'll meetAmazon EKSTerraformVPC CNIprefix delegationaccess entriesPod IdentityIRSAKarpenteradd-onsupgrades
Start lesson 01 →

What you'll be able to do

  • Build a production EKS stack from Terraform with remote state
  • Solve IP exhaustion with prefix delegation and secondary CIDRs
  • Upgrade EKS clusters and add-ons safely
  • Recover from Terraform state and cluster disasters

Before you start

AWS for Platform Engineers, Terraform & IaC.

How it works

Each lesson: plain-language idea → how it really works → hands-on. Each section ends with a cheat sheet & self-check.

Curriculum

Lessons marked “Read” are ready; the rest are on the way.

Build

  1. 01EKS architecture & mental modelWhat AWS runs, what you runRead →
  2. 02Remote state: S3, locking, env-per-tfvarsDrift and safe collaborationRead →
  3. 03The multi-provider chicken-and-eggBootstrapping providers that depend on the clusterRead →
  4. 04VPC CNI & IP planningPrefix delegation, secondary 100.64/16 pod CIDRRead →
  5. 📋Cheat sheet & self-checkEvery command from this section on one page, then 12 questions to check yourself.Open →

Operate

  1. 05IdentityAccess entries, Pod Identity, IRSARead →
  2. 06Capacity with KarpenterNodePools, consolidation, SpotRead →
  3. 07Storage tiersEBS and EFS CSI, hot/warm/coldRead →
  4. 08IngressAWS Load Balancer Controller, Gateway APIRead →
  5. 09Upgrades & add-onsVersion skew, managed add-ons, blue/green clustersRead →
  6. 📋Cheat sheet & self-checkEvery command from this section on one page, then 15 questions to check yourself.Open →

Automate & Recover

  1. 10CI/CD for the stackPlan/apply pipelines with OIDC to AWSRead →
  2. 11Disaster recoveryTerraform state and cluster recoveryRead →
  3. 12Capstone: own, harden & operateHand-over-ready platformRead →
  4. 📋Cheat sheet & self-checkEvery command from this section on one page, then 7 questions to check yourself.Open →

Playbooks, challenges & practice

  1. 13Playbook: creating the clusterPre-flight, run order by layer, verification gates, rollbackRead →
  2. 14Playbook: day-2 operationsNode pools, access, add-ons, upgrades, cost checks, safe teardownRead →
  3. 15The flow: laptop → cluster → kubeconfig → appHow humans and pipelines reach the cluster, the CI/CD wayRead →
  4. 16Challenges on this stackReal-world problems with symptoms, checks and fixesRead →
  5. 17Recovery playbookStep-by-step runbooks for state, access and cluster recoveryRead →
  6. 18Simulator: practise for $0terraform test mocks, LocalStack and kind before touching AWSRead →
  7. 📋Cheat sheet & self-checkEvery command from this section on one page, then 18 questions to check yourself.Open →

Real-world scenarios

Work through each one: symptom → misleading signal → evidence → root cause → prevention.

Pods can't get IPs in a half-empty cluster

Subnet exhaustion, and why prefix delegation helps.

terraform destroy on the wrong workspace

Recovery from state disasters.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.