Amazon EKS — Practice Projects — Exercises

3 minute read

Chapter 15 — Additional Challenges

Exercise 1: Design a Multi-Tenant Cluster

Question: Your company has 5 teams sharing one EKS cluster. Design the isolation strategy covering: namespaces, RBAC, quotas, network policies, and cost allocation.

Show Solution 
# 1. Namespace per team
apiVersion: v1
kind: Namespace
metadata:
  name: team-alpha
  labels:
    team: alpha
    cost-center: "CC-001"

---
# 2. Resource quota per namespace
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
  namespace: team-alpha
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"

---
# 3. RBAC — team can only access their namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: team-alpha-access
  namespace: team-alpha
subjects:
  - kind: Group
    name: team-alpha
roleRef:
  kind: ClusterRole
  name: edit

---
# 4. Network policy — deny cross-namespace by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-cross-namespace
  namespace: team-alpha
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector: {}    # Only same namespace

Cost allocation: Use Kubecost or AWS split-cost allocation tags on namespaces.

Exercise 2: Disaster Recovery

Question: Design a DR strategy for an EKS application with: RPO < 1 hour, RTO < 15 minutes, data in RDS and EBS.

Show Solution 
DR Architecture:
┌─────────────┐        ┌─────────────┐
│ us-east-1   │        │ us-west-2   │
│ (Primary)   │        │ (DR)        │
│             │        │             │
│ EKS Cluster │  ───▶  │ EKS Cluster │ (standby)
│ RDS Primary │  ───▶  │ RDS Replica │ (auto-replicated)
│ EBS Snapshots│ ───▶  │ EBS Copies  │ (scheduled)
│ ECR Images  │  ───▶  │ ECR Replica │ (cross-region)
└─────────────┘        └─────────────┘
Component Strategy RPO RTO
RDS Cross-region read replica ~1 min ~5 min (promote replica)
EBS Hourly snapshots + cross-region copy 1 hour ~10 min
EKS ArgoCD pointing to same Git repo 0 (Git is source of truth) ~5 min
ECR Cross-region replication ~1 min 0 (already replicated)

Failover steps:

  1. Promote RDS read replica to primary
  2. Update DNS (Route53 failover record)
  3. ArgoCD syncs manifests to DR cluster
  4. Total RTO: ~10-15 minutes

Exercise 3: Security Hardening

Question: List 10 security hardening steps for a production EKS cluster, in priority order.

Show Solution
Priority Action Why
1 Enable private endpoint API server not exposed to internet
2 Use IRSA for all pods No shared node IAM role permissions
3 Enable Pod Security Standards Prevent privileged containers
4 Encrypt secrets at rest (KMS) Protect sensitive data
5 Network policies Micro-segmentation between services
6 Enable audit logging Track all API calls
7 Scan images for CVEs No vulnerable images in production
8 Restrict aws-auth ConfigMap Only necessary IAM principals
9 Enable GuardDuty for EKS Detect suspicious activity
10 Regular cluster upgrades Security patches

Exercise 4: Migration to EKS

Question: You’re migrating a monolith running on EC2 to EKS microservices. What’s your phased approach?

Show Solution

Phase 1 (Week 1-2): Containerize the monolith

  • Create Dockerfile for existing app
  • Deploy as single pod on EKS (lift and shift)
  • Set up CI/CD pipeline

Phase 2 (Week 3-4): Add observability

  • Prometheus + Grafana for metrics
  • Fluent Bit for logging
  • Identify performance bottlenecks

Phase 3 (Month 2-3): Extract services

  • Start with the easiest, most independent component
  • Extract into separate microservice
  • Use Service for internal communication

Phase 4 (Month 4-6): Complete extraction

  • Extract remaining components one by one
  • Add API Gateway for routing
  • Implement proper health checks and circuit breakers

Phase 5 (Ongoing): Optimize

  • Right-size resources (VPA)
  • Add auto-scaling (HPA + Karpenter)
  • Implement canary deployments

Exercise 5: Full Architecture Design

Question: Design a complete EKS architecture for an e-commerce platform handling 10,000 requests/second with: 99.9% availability, PCI DSS compliance, and < $5,000/month budget.

Show Solution 
Architecture:
- EKS cluster: 3 AZs, private endpoint
- Nodes: Karpenter with Spot (stateless) + On-Demand (stateful)
- Ingress: ALB with WAF + Shield
- Services: 8 microservices (cart, catalog, payment, etc.)
- Database: RDS Aurora Multi-AZ (encrypted)
- Cache: ElastiCache Redis cluster mode
- Queue: SQS for order processing
- Storage: S3 for static assets + CloudFront CDN

Cost estimate: | Component | Monthly Cost | |———–|————-| | EKS control plane | $72 | | EC2 (12 × m5.large, 60% Spot) | $1,200 | | RDS Aurora (db.r5.large Multi-AZ) | $700 | | ElastiCache (cache.r5.large) | $300 | | ALB + data transfer | $400 | | EBS + S3 | $200 | | CloudFront | $150 | | Monitoring | $100 | | Total | ~$3,100/month |

Under budget with room for scaling.

What’s Next?

Keep learning: Chapter 16 — Next Steps.

You may also enjoy