• EKS control plane (“masters”): fully AWS-managed (you don’t build AMIs for it).
• Node groups: EC2 worker nodes joined to the EKS cluster; managed as an Auto Scaling Group.
  • Managed node group: AWS manages lifecycle; you provide instance type, scaling, and (optionally) a launch template pointing to your custom AMI.
  • Self-managed: you run an ASG yourself (less common now).
  • Fargate: serverless nodes (no AMI at all).
• Typically we would use Terraform to
  • aws_eks_cluster → creates the control plane.
  • aws_eks_node_group (or ASG + launch template) → creates the worker nodes.
  • Launch template → references the AMI ID, user data (bootstrap to cluster), disk size, security groups, etc.

Below is not production ready and is using eksctl

Create a new cluster using eksctl

1. Create a AWS CMK first for the EKS cluster to use when encrypting your Kubernetes secrets:

we first have to create AWS KMS Custom Managed key (CMK)

aws kms create-alias --alias-name alias/eksworkshop --target-key-id $(aws kms create-key --query KeyMetadata.Arn --output text)

then describe to get the KEY's ARN.

export MASTER_ARN=$(aws kms describe-key --key-id alias/eksworkshop --query KeyMetadata.Arn --output text)

Also add to bash profile

echo "export MASTER_ARN=${MASTER_ARN}" | tee -a ~/.bash_profile

export AWS_REGION=ap-southeast-1

Now using MASTER_ARN and AWS_REGION, we create our cluser as follows

cat << EOF > eksworkshop.yaml
---
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: eksworkshop-eksctl
  region: ${AWS_REGION}

managedNodeGroups:
- name: nodegroup
  instanceType: t2.micro
  desiredCapacity: 3
  iam:
    withAddonPolicies:
      albIngress: true

secretsEncryption:
  keyARN: ${MASTER_ARN}
EOF

Now create the cluster using the config above

eksctl create cluster -f eksworkshop.yaml