Production EKS Platform: Terraform, Karpenter, Calico

A production Amazon EKS platform provisioned entirely in Terraform, built so it can be recreated from an empty AWS account. Delivered within an in house team.

Most clusters I review were built from a tutorial then modified by hand, and nobody can say what would happen if they had to be rebuilt. This one had to be reproducible from nothing, cost less when idle, and deny traffic between namespaces by default.

Cluster, networking, nodes and add ons as Terraform modules with locked remote state. Karpenter provisioning and consolidating nodes instead of static groups. Calico default deny with explicit allow rules. IRSA for pod level permissions, ingress with self renewing TLS, versioned Helm releases.

I terminated nodes under load, drove traffic spikes, and confirmed network policy blocked traffic. Untested resilience is a guess.

The cluster rebuilds from code, scales down when idle, and the team upgrades it from a runbook.