Amazon EKS: Elastic Kubernetes Service
You already know Kubernetes. EKS is where identity, IP addressing and upgrades stop behaving the way you expect. {cards} flashcards on the managed control plane and what stays yours, access entries and Pod Identity replacing aws-auth and IRSA, VPC-native Pod addressing and the exhaustion it causes, node groups against Karpenter, Fargate and Auto Mode, and the version lifecycle that eventually upgrades you whether you planned it or not.
- flashcards
- 97
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate → Advanced
- level
- modules
- 6
- modules
What EKS changes about Kubernetes
EKS runs the same Kubernetes you already know — and then moves four things out from under you. The control plane lives in an AWS-owned account, reaching your workloads through network interfaces it places in your subnets, so there is no node to patch and no etcd snapshot to restore from. Pods get real VPC addresses rather than overlay ones, which makes them routable and makes your subnet the thing that runs out. Who may call the API server is decided by IAM first and Kubernetes second. And a minor version is usable for twenty-six months, after which the cluster is upgraded for you.
Two of those surfaces are mid-replacement right now, which is why most EKS material ages badly. Access entries have taken over from the aws-auth ConfigMap, and EKS Pod Identity from IRSA — and in both cases the old mechanism still runs on clusters built before the new one existed. These {modules} modules teach the pair rather than today’s default: what each mechanism actually checks, which one a given cluster is using, and what the migration between them does and does not carry across.
Every card cites the page in the AWS documentation that states its fact, because this surface moves faster than any prep site keeps up with. If Kubernetes itself is the gap, start with Kubernetes Fundamentals; if the AWS side is, AWS IAM covers the policy evaluation that every EKS permission error eventually comes down to.
EKS itself is not an exam topic in its own right, but the networking, IAM and reliability it exercises run through every AWS blueprint — Which AWS certification should you choose? shows where they land.
6 modules, seed to bloom
Each module is a set of flashcards — 97 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
Cluster Architecture
Managed control plane, endpoint access and what AWS owns
16 cardsIdentity & Access
Access entries, IRSA and EKS Pod Identity
16 cardsNetworking
VPC CNI addressing, load balancing and network policy
17 cardsCompute
Node groups, Karpenter, Fargate and EKS Auto Mode
18 cardsAdd-ons & Upgrades
EKS add-ons, version lifecycle and upgrade order
15 cardsOperations & Observability
Control plane logs, metrics and the failures you will actually meet
15 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What must the trust policy of a role used with EKS Pod Identity allow?
- Asts:AssumeRole and sts:TagSession for the pods.eks.amazonaws.com service principal
- Bsts:AssumeRoleWithWebIdentity for the cluster's OIDC provider, scoped by sub claim
- Csts:AssumeRole for the node IAM role, which passes the credentials to the Pod
- Dsts:GetFederationToken for the eks.amazonaws.com service principal in the Region
What changes when the VPC CNI assigns IP prefixes instead of individual secondary addresses?
- AEach interface carries a block of addresses, so fewer EC2 calls serve more Pods
- BEach Pod receives a routable block it can sub-allocate to its own containers
- CEach node reserves a subnet of its own, which the CNI carves out on first boot
- DEach interface keeps its address count but gains a second address family
How long does a node launched by EKS Auto Mode live?
- AAt most 21 days, after which it is replaced automatically
- BUntil its workloads drain, since Auto Mode replaces nodes only on demand
- CUntil the next Kubernetes version upgrade of the cluster it belongs to
- DAs long as its instance is healthy, with patches applied to it in place
How long is a Kubernetes minor version usable on EKS before it is forced to move?
- A26 months — 14 of standard support and 12 of extended support
- B14 months — extended support adds cost but not additional time
- C12 months — after which the version leaves the API entirely
- D36 months — 14 of standard support and 22 of extended support
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
What this deck is actually for
Old and new mechanism, side by side
aws-auth against access entries, IRSA against Pod Identity — including the transitions that are one-way, and the aws-auth entries that a migration silently leaves behind.
Where the IP addresses go
Why maxPods is an address limit rather than a resource one, what prefix delegation buys, and what custom networking costs you on every node.
Four ways to get a node
Managed node groups, Karpenter, Fargate and Auto Mode — what each one takes over, and the constraints that decide the choice before preference does.
Upgrades before they are urgent
The skew you may run, the gate EKS puts on top of it, the five free addresses an upgrade needs, and what happens at the end of extended support.
Common questions
Do I need to know Kubernetes before this deck? +
Yes. This covers what EKS does differently, not what a Pod or a Deployment is — if those are new, start with the Kubernetes Fundamentals deck and come back. The scenario module in particular assumes you can read a Pending Pod and a NotReady node.
Should I learn IRSA or EKS Pod Identity? +
Both, and the difference between them. Pod Identity is the newer mechanism and is simpler to operate — no OIDC provider, roles reusable across clusters — but it does not work on Fargate or Windows nodes, and every cluster built before it exists is still on IRSA. The deck teaches what each one checks, so you can tell which is in play when a Pod gets the wrong credentials.
Is this tied to a specific AWS or Kubernetes certification? +
No. It follows the EKS surface engineers actually operate rather than an exam blueprint, though it overlaps with the compute and security sections of SAA-C03 and gives CKA holders the managed-platform context the exam leaves out. Gnoseed is a study companion — it does not sell, proctor or guarantee any certification.
How current are the defaults and limits? +
Every card links the AWS documentation page that states its fact, and the cards deliberately teach mechanisms rather than whichever option is default this quarter — that is the part of EKS that changes. Check the linked page before you design around a specific number.
Is it free? +
Yes, completely free with no registration. Progress is stored locally in your browser, and syncs across devices only if you choose to sign in.
Start with the module that already bit you
For most people that is identity or IP addressing — the two things EKS changes that Kubernetes never warned them about. Plant your first seed there, ten minutes a day.