Extending Kubernetes → EKS — CRDs, webhooks, the scheduler, and ACK
Extending Kubernetes → EKS — CRDs, webhooks, the scheduler, and ACK
1. CRDs and operators → identity is the EKS question
The kubebuilder and operator-sdk readings teach the operator pattern: a CRD plus a reconcile loop that drives real state toward a spec. On EKS the new question is how that controller authenticates to AWS.
| From the reading | EKS reality | Who owns it |
|---|---|---|
| CRD + controller you scaffold | kubebuilder/operator-sdk, deployed on EKS | You build and run it |
| Reconcile loop over your Custom Resource | Unchanged — idempotent, level-triggered | You |
| Controller needs AWS credentials | IRSA or EKS Pod Identity on the controller's ServiceAccount | You wire the identity |
| Reconciling real AWS resources | ACK (AWS Controllers for Kubernetes) ships this pattern first-party | AWS ships controllers; you apply CRs |
| Owner references + garbage collection | Unchanged on EKS | You |
The portable part: the reconcile-loop discipline the readings teach runs identically on EKS. The part that changes: instead of a kubeconfig, the controller's ServiceAccount maps to an IAM role through IRSA or Pod Identity — that mapping is the whole story for how your operator touches AWS. If the goal is to manage AWS resources as Kubernetes objects, read ACK before writing your own.
2. Admission control → the webhook still runs on your nodes
The admission and validating-webhook readings cover the request path: after authentication and authorization, admission webhooks mutate or reject objects before they persist. EKS changes almost nothing here — which is the point worth stating.
| From the reading | EKS reality | Owner |
|---|---|---|
| Mutating admission webhook | Runs as a pod on your nodes; EKS calls it | You run and secure it |
| Validating admission webhook | Same; a ValidatingWebhookConfiguration wires it in | You |
| Policy as admission control | Self-managed OPA/Gatekeeper or Kyverno on EKS | You |
| Webhook availability matters | A down webhook can block all API writes — set failurePolicy with care | You own the blast radius |
| TLS to the webhook | Certificate you provision (cert-manager or manual) | You |
Staleness callout — the webhook is a hard dependency. On EKS the control plane is AWS-managed, but your admission webhook is not — it runs on your nodes, and if it is unreachable with
failurePolicy: Fail, API writes stall. There is no managed admission service that removes this; EKS gives you the API server, not your policy layer. Confirm current guidance on webhook availability and failurePolicy against AWS and upstream docs before you gate production writes on one.3. Custom scheduling and informers → what EKS replaces
The scheduler-framework/extender and client-go readings go to the lowest layer: how scheduling plugs in, and how controllers watch state efficiently through informers. On EKS, one of these has a strong managed answer and one does not.
| From the reading | EKS reality | Owner |
|---|---|---|
| Scheduler framework plugins / extenders | Still available, but node provisioning is often the real lever | You |
| Scheduling that also picks capacity | Karpenter chooses instance types to fit pending pods — scheduling and provisioning together | Shared |
| Informers / shared cache (client-go) | Unchanged; the engine under every controller | You |
| Watch load on the API server | Same client-go patterns; EKS runs the API server | AWS runs it, you write efficient watches |
The through-line: the informer machinery and the reconcile loop are pure upstream Kubernetes and carry over untouched — EKS runs the API server they talk to. Custom scheduling is where AWS diverges most: rather than write a scheduler extender to steer pods onto existing nodes, Karpenter reshapes the node pool to fit the pods, which solves on EKS the problem a custom scheduler often set out to solve on fixed capacity.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article