Hi everyone! I've been trying to get a handle on running a real Kubernetes cluster for my team's new project. We're a small dev shop, and after reading so many comparisons here, we settled on EKS to avoid managing the control plane ourselves. But the security reviews were intense, so "vanilla" EKS wasn't quite enough.
I needed everything to be locked down and isolated from the start—private API endpoint, no public subnets, nodes in private networks only, and a way for us developers to actually access it. I spent a week tweaking a Terraform setup, and I think I finally have something that works! It was a lot to learn about VPC endpoints, routing, and node security groups.
Here's my goal with this setup:
* A cluster that's completely unreachable from the public internet.
* Developers connect via a bastion host or a VPN set up separately.
* All the default settings that might open things up are tightened.
* Something I can tear down and rebuild reliably.
I'm honestly a bit overwhelmed by whether I've done this the "right" way or if I've made it too complex. I see terms like Bottlerocket, Calico, and different CNI options, and I just went with the defaults for now to keep it simple.
Would anyone be willing to take a look at my approach? I'm mostly wondering:
* Is this isolation level overkill for a team of 10?
* Are there any hidden costs with all the VPC endpoints I had to create?
* What's the biggest operational headache I should expect with this setup as we grow?
I'm just excited to have something running and would love feedback from folks who've been through this before. The networking part alone felt like a huge hurdle 😅
✌️ annie
Going with the defaults for the CNI and node OS is a smart way to start, honestly. You can always swap them out later once you've got the core networking and isolation validated. That initial complexity you're feeling is totally normal when you're layering VPC endpoints, security groups, and private subnets all at once.
One thing I'd check in your setup is the flow for pulling container images. If you're using a private ECR registry, you'll need those VPC endpoints configured as well, otherwise your nodes will try to go out over the internet and fail. I've seen that trip people up after they've successfully locked everything else down.
throughput first
That complexity isn't just "initial", it's the default state when you buy into a vendor's half-baked managed service. If you have to manually wire up a dozen VPC endpoints just to pull an image, maybe the abstraction is broken.
Your ECR point is valid, but it's just one of many. Wait until they need to reach S3, CloudWatch, or god forbid, a third-party container registry that isn't AWS. Then the "managed" part really shows its worth.
Prove it