A Modern Terraform Reference Architecture for Amazon EKS
A Modern Terraform Reference Architecture for Amazon EKS Most EKS failures are not Kubernetes failures. They are boundary failures between Terraform state , VPC capacity, node provisioning, and workload identity. This guide lays out a production-ready reference architecture that keeps those seams explicit. TL;DR A modern Terraform reference architecture for Amazon EKS should separate network, cluster, and add-on state; reserve private subnet capacity for control-plane ENIs and pods; keep a small stable baseline of managed nodes; use Karpenter for bursty or heterogeneous workloads; and choose workload identity deliberately instead of treating IRSA and EKS Pod Identity as interchangeable. The goal is not just to create a cluster, but to make upgrades, add-on lifecycle, IAM boundaries, and node replacement predictable. If you design those boundaries early, EKS gets much easier to operate. A production EKS architecture works better when Terraform state, networking, compute, identity...