What Are You Actually Paying For?
When you create an EKS cluster, you pay a flat fee of $0.10/hour (~$72/month). This buys you a dedicated, single-tenant Control Plane — your cluster's API server is not shared with other AWS customers. This is different from some other managed Kubernetes offerings that run multi-tenant control planes.
The Hidden Architecture
You never SSH into the master nodes, but they exist and are carefully architected for resilience.
- High Availability: AWS runs at least 2 API Server instances and 3 etcd nodes, spread across 3 different Availability Zones (AZs).
- AZ Resilience: If an entire AZ goes down, the control plane continues operating. The etcd quorum (requiring 2 of 3 nodes) is maintained.
- Automatic Scaling: If you flood the API server with
kubectlcommands (e.g., a CI/CD pipeline running thousands of concurrentkubectl applycalls), EKS automatically scales up the control plane instances to absorb the load. You do not configure this — it happens transparently. - Automatic Patching: AWS applies security patches to the control plane OS and Kubernetes components. You are responsible for initiating Kubernetes version upgrades, but AWS handles the mechanics of the upgrade safely.
Accessing the Control Plane
Your worker nodes and your local kubectl talk to the control plane via the Cluster Endpoint — a DNS name that resolves to the managed API server load balancer.
| Endpoint Mode | Accessible From | Use Case |
|---|---|---|
| Public | Anywhere on the internet | Development, CI/CD from outside VPC |
| Private | Only within your VPC | Production, high-security environments |
| Both | Internet + VPC (VPC traffic stays internal) | Common production pattern |
Security Note: Even with a public endpoint, access is controlled by IAM authentication and Kubernetes RBAC. An unauthenticated request to the public endpoint is rejected. However, for defense-in-depth, production clusters should use the private-only or both-enabled mode with IP allowlisting.