Amazon EKS as a Platform Boundary Map
See how a shared Amazon EKS architecture separates workloads, platform services, and network connectivity so teams can scale delivery without multiplying operational ownership.
Loading…
Topic
Amazon EKS
2 posts about Amazon EKS. Every summary links to the original.
- 2 posts
- 1 company
- 1 explainer
See the idea
Amazon EKS explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
ReadyOn’s Four Walls of tenant isolation on Amazon EKS
ReadyOn describes a four-layer tenant-isolation architecture for Harmony, its multi-tenant workforce-intelligence platform on Amazon EKS, which handles payroll data, organizational hierarchies, and operational analytics. The design combines dedicated Kubernetes namespaces, Karpenter-managed tenant node pools, per-tenant Amazon VPC security groups, and dedicated Amazon Aurora databases, with RBAC, admission control, default-deny network policies, IAM Roles for Service Accounts, and tenant-scoped secrets. GitOps through Argo CD ApplicationSets provisions identical controls and continuously reverts drift, while dual taints and admission validation prevent cross-tenant scheduling. ReadyOn says adversarial exercises have blocked all six tested cross-tenant paths to date, and reports defenses across 10 threat-model stages, though shared control-plane dependencies make the layers defense in depth rather than fully independent probabilities.
How Equinix cut operational overhead with a shared services architecture on Amazon EKS
Equinix replaced its self-managed Kubernetes environment on Amazon EKS to address operational sprawl caused by independently managed clusters and inconsistent infrastructure practices. The new shared services architecture assigns platform ownership to a cloud operations team while application teams focus on business services. It uses separate Workloads, Platform, and Network accounts: workloads run across two Availability Zones with ALB, Gateway API, Cilium, and Hubble, while shared data services, GitHub Runners, and platform services reside in the Platform account. The Network account provides cross-account and multi-Region connectivity through AWS Transit Gateway, Route 53 Resolver, and Direct Connect. Equinix reports 40% lower operational overhead, 4x higher deployment frequency, and adoption of a unified architecture across multiple business organizations.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.