Amazon EKS — Control Plane

2 minute read

EKS Control Plane

The control plane is the “brain” of your Kubernetes cluster. AWS runs it for you — but understanding how it works helps you make better architectural decisions.

Control Plane Architecture

EKS Control Plane (AWS-Managed)
┌─────────────────────────────────────────────────────────────┐
│                    AWS-Managed VPC                            │
│                                                              │
│  ┌─────────────────────────────────────────────────────┐    │
│  │                  NLB (Network Load Balancer)          │    │
│  │                  (API Server endpoint)                │    │
│  └────────────┬────────────────┬────────────────┬───────┘    │
│               │                │                │            │
│  ┌────────────▼──┐ ┌──────────▼──┐ ┌──────────▼──┐         │
│  │  AZ-a         │ │  AZ-b       │ │  AZ-c       │         │
│  │  ┌─────────┐  │ │  ┌────────┐ │ │  ┌────────┐ │         │
│  │  │API Srvr │  │ │  │API Srvr│ │ │  │API Srvr│ │         │
│  │  └─────────┘  │ │  └────────┘ │ │  └────────┘ │         │
│  │  ┌─────────┐  │ │  ┌────────┐ │ │  ┌────────┐ │         │
│  │  │  etcd   │  │ │  │  etcd  │ │ │  │  etcd  │ │         │
│  │  └─────────┘  │ │  └────────┘ │ │  └────────┘ │         │
│  └───────────────┘ └─────────────┘ └─────────────┘         │
│                                                              │
│  + Scheduler (leader-elected)                                │
│  + Controller Manager (leader-elected)                       │
│  + Cloud Controller Manager                                  │
└─────────────────────────────────────────────────────────────┘

Key Control Plane Facts

Component Details
API Server Runs across 3 AZs behind an NLB; auto-scales based on load
etcd 3 replicas across 3 AZs; encrypted at rest with AWS KMS; automatic backups
Scheduler Leader-elected; one active, others on standby
Controller Manager Leader-elected; manages ReplicaSets, Deployments, etc.
Cloud Controller Manages AWS-specific resources (ELBs, EBS volumes)

What You Can’t Do

Since the control plane is fully managed:

  • ❌ SSH into control plane nodes
  • ❌ Modify etcd directly
  • ❌ Change API server flags (like --enable-admission-plugins)
  • ❌ View control plane node metrics in CloudWatch
  • ❌ Change the number of API server replicas

What You CAN Do

  • ✅ View control plane logs in CloudWatch (if enabled)
  • ✅ Choose API server endpoint access (public/private)
  • ✅ Enable envelope encryption for etcd (KMS key)
  • ✅ Configure admission webhooks that run in your cluster
  • ✅ View API server metrics via the Kubernetes metrics API

Control Plane Logging

Enable control plane logs to troubleshoot issues:

$ aws eks update-cluster-config \
    --name demo \
    --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

Or in eksctl config:

cloudWatch:
  clusterLogging:
    enableTypes:
      - api              # API server requests
      - audit            # Who did what
      - authenticator    # IAM authentication events
      - controllerManager # Controller reconciliation
      - scheduler        # Pod scheduling decisions

Cost warning: Control plane logs can be expensive. A busy cluster might generate 10+ GB/day. At $0.50/GB ingestion + $0.03/GB storage, that’s $5-16/day. Enable only what you need.

Envelope Encryption

By default, Kubernetes Secrets are stored in etcd with base64 encoding (not encrypted). Enable envelope encryption with KMS:

$ aws eks create-cluster \
    --name secure-cluster \
    --encryption-config '[{"resources":["secrets"],"provider":{"keyArn":"arn:aws:kms:us-east-1:123456789012:key/abc-123"}}]'

Control Plane SLA

SLA Level Uptime Monthly Downtime Allowed
99.95% Standard EKS SLA ~22 minutes/month

AWS achieves this by:

  • Running across 3 AZs
  • Auto-healing unhealthy replicas
  • Automatic scaling during load spikes

Common Mistakes

Mistake Impact
Not enabling control plane logging Can’t troubleshoot authentication or scheduling issues
Enabling ALL log types on a busy cluster High CloudWatch costs
Not enabling KMS encryption for Secrets Secrets stored as base64 (readable by anyone with etcd access)
Expecting SSH access to control plane Not possible — use API and logs instead

Quick Reference

Item Value
API Server replicas 3+ (across AZs, auto-scaled)
etcd replicas 3 (across AZs)
SLA 99.95%
Max clusters per region 100 (soft limit)
Log types api, audit, authenticator, controllerManager, scheduler

What’s Next?

Now let’s explore the other half: Data Plane.

You may also enjoy