AWS EKS

AWS Elastic Kubernetes Service platform managed with Terraform (infrastructure) and Helm (workloads). Provisions an EKS cluster with RDS, ECR, S3, and an ALB ingress controller in eu-west-1 (Ireland).

Architecture Overview

Layer	Tool	Purpose
Provider	—	AWS eu-west-1 (Ireland)
Network	Terraform	VPC with private/public subnets across 2 AZs
Resources	Terraform	EKS, RDS PostgreSQL, ECR, S3
Namespace	Helm	AWS Load Balancer Controller
Deployment	—	Production instance

---

Configuration

apiVersion: strata.huybrechts.xyz/v1
kind: configuration
meta:
  name: aws_eks_config
  annotations:
    description: AWS EKS platform — Terraform + Helm on Elastic Kubernetes Service
  labels:
    version: "1.0.0"
  tags: [aws, eks, configuration]
spec:
  layering:
    - name: environment
      description: "Deployment environment (dev, staging, prd)"
      required: true

  deployment:
    additional_properties: false
    properties:
      environment:
        pattern: "^(dev|staging|prd)$"
        required: true
        description: "Target environment"

  zones:
    - name: us_east
      description: "US East (N. Virginia, Ohio)"
      regions:
        - us-east-1
        - us-east-2
    - name: eu_west
      description: "Europe (Ireland, Frankfurt)"
      regions:
        - eu-west-1
        - eu-central-1

  remotes:
    - name: aws_eks
      type: gitops
      repository: git@github.com:your-org/aws-eks-config.git
      reference: main
      source_path: .
      deploy_path: .

  integrations:
    - name: git
      type: git
      capabilities: [repository]
      required: true
      validation:
        command: git --version
        min_version: "2.30.0"
      authentication:
        method: cli

    - name: terraform
      type: terraform
      capabilities: [infrastructure]
      required: true
      validation:
        command: terraform --version
        min_version: "1.6.0"
      authentication:
        method: cli

    - name: aws_cli
      type: aws_cli
      capabilities: [infrastructure]
      required: true
      validation:
        command: aws --version
      authentication:
        method: cli

    - name: kubectl
      type: kubectl
      capabilities: [container]
      required: true
      validation:
        command: kubectl version --client
      authentication:
        method: cli

    - name: infracost
      type: infracost
      capabilities: [cost]
      required: false
      validation:
        command: infracost --version
        min_version: "0.10.0"
      authentication:
        method: cli

    - name: helm
      type: helm
      capabilities: [container]
      required: true
      validation:
        command: helm version
        min_version: "3.12.0"
      authentication:
        method: cli

---

Workspace

apiVersion: strata.huybrechts.xyz/v1
kind: workspace
meta:
  name: aws_eks_platform
  annotations:
    description: AWS EKS workspace — Terraform provisions, Helm deploys
  labels:
    version: "1.0.0"
  tags: [aws, eks, workspace]
spec:
  providers:
    - name: aws_eu_west_1
      file: "@aws_eks/stack/aws-provider-eu-west-1.yaml"

  provisioners:
    - name: terraform
      provisioner: terraform
      source:
        repository: aws_eks
        source_path: terraform

    - name: helm
      provisioner: helm
      source:
        repository: aws_eks
        source_path: charts

  topology:
    - name: eks_cluster
      provider: aws_eu_west_1
      provisioner: terraform
      type: kubernetes
      components:
        - resource: eks_cluster
        - resource: rds_postgres
        - resource: ecr
        - resource: s3_artifacts
      namespaces:
        - namespace: platform

  resources:
    - name: eks_cluster
      file: "@aws_eks/stack/aws-res-eks.yaml"
      description: AWS EKS managed Kubernetes cluster
    - name: rds_postgres
      file: "@aws_eks/stack/aws-res-rds.yaml"
      description: AWS RDS PostgreSQL (Multi-AZ)
    - name: ecr
      file: "@aws_eks/stack/aws-res-ecr.yaml"
      description: AWS Elastic Container Registry
    - name: s3_artifacts
      file: "@aws_eks/stack/aws-res-s3.yaml"
      description: S3 bucket for artifacts and state

  namespaces:
    - name: platform
      file: "@aws_eks/stack/aws-ns-platform.yaml"

---

Provider

apiVersion: strata.huybrechts.xyz/v1
kind: provider
meta:
  name: aws_eu_west_1
  annotations:
    description: AWS Europe (Ireland) region
  labels:
    version: "1.0.0"
  tags: [aws, provider, ireland]
spec:
  properties:
    type: aws
    region: eu-west-1

---

Network

VPC with public and private subnets across two availability zones.

apiVersion: strata.huybrechts.xyz/v1
kind: network
meta:
  name: aws_net_vpc
  annotations:
    description: AWS VPC for EKS platform and supporting services
  labels:
    version: "1.0.0"
  tags: [aws, network, vpc]
spec:
  networks:
    - name: vpc_platform
      description: Platform VPC with multi-AZ subnets
      address_space:
        - value: "10.0.0.0/16"
      subnets:
        - name: subnet_eks_private_a
          cidr:
            value: "10.0.0.0/19"
          description: EKS private subnet (AZ-a)
        - name: subnet_eks_private_b
          cidr:
            value: "10.0.32.0/19"
          description: EKS private subnet (AZ-b)
        - name: subnet_rds_a
          cidr:
            value: "10.0.64.0/24"
          description: RDS subnet (AZ-a)
        - name: subnet_rds_b
          cidr:
            value: "10.0.65.0/24"
          description: RDS subnet (AZ-b)
        - name: subnet_public_a
          cidr:
            value: "10.0.128.0/24"
          description: Public subnet for ALB (AZ-a)
        - name: subnet_public_b
          cidr:
            value: "10.0.129.0/24"
          description: Public subnet for ALB (AZ-b)

---

Resources

EKS Cluster

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: aws_eks_cluster
  annotations:
    description: AWS EKS cluster with managed node group
  labels:
    version: "1.0.0"
  tags: [aws, eks, resource, kubernetes]
spec:
  properties:
    provider_type: aws
    resource_type: eks_cluster
    category: compute
    subcategory: kubernetes
  configuration:
    kubernetes_version: "1.30"
    node_group_instance_types: ["m5.xlarge"]
    node_group_desired: 3
    node_group_min: 2
    node_group_max: 6
    endpoint_private_access: true
    endpoint_public_access: false

RDS PostgreSQL

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: aws_rds_postgres
  annotations:
    description: AWS RDS PostgreSQL instance with Multi-AZ
  labels:
    version: "1.0.0"
  tags: [aws, resource, rds, postgresql, database]
spec:
  properties:
    provider_type: aws
    resource_type: rds_instance
    category: database
    subcategory: relational
  configuration:
    engine: postgres
    engine_version: "16.3"
    instance_class: db.r6g.large
    allocated_storage: 100
    max_allocated_storage: 500
    multi_az: true
    storage_encrypted: true
    deletion_protection: true
    backup_retention_period: 14

Elastic Container Registry

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: aws_ecr
  annotations:
    description: AWS Elastic Container Registry for container images
  labels:
    version: "1.0.0"
  tags: [aws, resource, ecr, registry]
spec:
  properties:
    provider_type: aws
    resource_type: ecr_repository
    category: container
    subcategory: registry
  configuration:
    image_tag_mutability: IMMUTABLE
    scan_on_push: true
    encryption_type: KMS
    lifecycle_policy:
      max_image_count: 50

S3 Artifacts Bucket

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: aws_s3_artifacts
  annotations:
    description: AWS S3 bucket for build artifacts and deployment state
  labels:
    version: "1.0.0"
  tags: [aws, resource, s3, storage]
spec:
  properties:
    provider_type: aws
    resource_type: s3_bucket
    category: storage
    subcategory: object
  configuration:
    versioning: true
    encryption: aws:kms
    block_public_access: true
    lifecycle_rules:
      - transition_days: 90
        storage_class: GLACIER
      - expiration_days: 365

---

Namespace

apiVersion: strata.huybrechts.xyz/v1
kind: namespace
meta:
  name: aws_eks_ns_platform
  annotations:
    description: Platform namespace — ingress controller and monitoring
  labels:
    version: "1.0.0"
  tags: [aws, eks, namespace, platform]
spec:
  modules:
    - name: alb_controller
      file: "@aws_eks/stack/aws-mod-alb-controller.yaml"

---

Module

AWS Load Balancer Controller

apiVersion: strata.huybrechts.xyz/v1
kind: module
meta:
  name: aws_eks_mod_alb_controller
  annotations:
    description: AWS Load Balancer Controller for EKS ingress
  labels:
    version: "1.0.0"
  tags: [aws, eks, module, alb, ingress]
spec:
  type: helm
  source:
    chart_repository: https://aws.github.io/eks-charts
    chart_name: aws-load-balancer-controller
    chart_version: "1.7.0"
  kubernetes_namespace: kube-system
  services:
    - name: aws-load-balancer-controller
      configuration:
        clusterName: "${EKS_CLUSTER_NAME}"
        serviceAccount:
          create: true
          name: aws-load-balancer-controller

---

Environment

apiVersion: strata.huybrechts.xyz/v1
kind: environment
meta:
  name: aws_eks_env_prd
  annotations:
    description: Production environment for AWS EKS platform
  labels:
    version: "1.0.0"
  tags: [aws, eks, production, environment]
spec:
  variables:
    - key: WORKSPACE
      store: constant
      value: aws_eks
    - key: ENVIRONMENT
      store: constant
      value: prd
    - key: AWS_REGION
      store: constant
      value: eu-west-1
    - key: AWS_ACCOUNT_ID
      store: environment
      value: AWS_ACCOUNT_ID
    - key: EKS_CLUSTER_NAME
      store: constant
      value: eks-platform-prd
    - key: VPC_CIDR
      store: constant
      value: "10.0.0.0/16"
    - key: RDS_INSTANCE_NAME
      store: constant
      value: rds-platform-prd
    - key: ECR_REGISTRY
      store: constant
      value: "${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-1.amazonaws.com"
    - key: S3_ARTIFACTS_BUCKET
      store: constant
      value: platform-artifacts-prd-eu-west-1

  secrets:
    - key: AWS_ACCESS_KEY_ID
      store: environment
      value: AWS_ACCESS_KEY_ID
    - key: AWS_SECRET_ACCESS_KEY
      store: environment
      value: AWS_SECRET_ACCESS_KEY

---

Deployment

apiVersion: strata.huybrechts.xyz/v1
kind: deployment
meta:
  name: aws_eks_deploy_prd
  annotations:
    description: Production deployment for AWS EKS platform
  labels:
    version: "1.0.0"
  tags: [aws, eks, production, deployment]
spec:
  layers:
    environment: prd

  properties:
    environment: prd

  workspace:
    name: aws_eks_platform
    description: AWS EKS Platform
    file: "@aws_eks/stack/aws-ws-platform.yaml"

  environments:
    - "@aws_eks/environments/aws-eks-env-prd.yaml"

  stages:
    - name: infrastructure
      provisioner: terraform
      scope: all
      on_failure: stop

    - name: platform
      provisioner: helm
      scope: all
      depends_on: [infrastructure]
      on_failure: stop