Amazon EKS

Read this page before step 1. It covers what's specific to Amazon EKS. Everything else follows the standard installation steps.

Before you start

Plan the cluster with these recommendations:

Item	Recommendation
Kubernetes	A supported EKS version (1.29 or newer)
Nodes	Managed node groups or EKS Auto Mode. For the standard set: 3 × m6i.2xlarge (8 vCPU / 32 GiB), in private subnets. Larger sites: see Sizing.
Networking	VPC with private subnets for nodes and data services, public subnets for the load balancer, a NAT gateway for outbound traffic
Add-ons	Amazon VPC CNI, CoreDNS, kube-proxy, Amazon EBS CSI driver (for managed node groups. Auto Mode has its own)

Pods per node

OpenLM Platform runs about 85 pods, so check how many pods your nodes can hold. With the Amazon VPC CNI, each pod takes an IP address from the node's network interfaces, so the number of pods per node depends on the instance type: 58 on an m6i.xlarge, for example. Use enough nodes, or turn on prefix delegation in the VPC CNI (ENABLE_PREFIX_DELEGATION=true) to raise the limit. Pods stuck in Pending with Too many pods mean the nodes have reached this limit.

Ingress

Install Traefik or ingress-nginx, exposed through an AWS Network Load Balancer. The controller then serves the certificate from the openlm-lb-cert secret, as OpenLM Platform expects.

The following example installs Traefik with the traefik/traefik Helm chart:

# traefik-values.yaml
service:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external          # needs the AWS Load Balancer Controller
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing   # or internal
ports:
  web:
    http:
      redirections:
        entryPoint: { to: websecure, scheme: https, permanent: true }

helm repo add traefik https://traefik.github.io/charts
helm install traefik traefik/traefik -n ingress --create-namespace -f traefik-values.yaml
kubectl -n ingress get service traefik    # EXTERNAL-IP is the NLB host name for your DNS CNAME

On EKS Auto Mode, the built-in load balancing creates the NLB, so keep only the aws-load-balancer-scheme annotation.

Then set INGRESS_CLASS=traefik in your worksheet.

Not the ALB

An Application Load Balancer created from an Ingress (ingressClassName: alb) terminates TLS with a certificate from AWS Certificate Manager, not with the cluster's secret, and needs its own annotations on the Ingress. The OpenLM Platform Ingress isn't built for it. Use the NLB with Traefik or ingress-nginx instead.

If you restrict the NLB's allowed source ranges, include the NAT gateway's public IP, because pods in private subnets reach an internet-facing NLB through the NAT gateway. An internal NLB avoids this entirely.

Storage

Set STORAGE_CLASS to the class that matches your node type:

Cluster	STORAGE_CLASS	Notes
Managed node groups	gp3	Create it if it doesn't exist. EBS CSI provisioner ebs.csi.aws.com, type: gp3.
EKS Auto Mode	For example auto-ebs-gp3	Provisioner ebs.csi.eks.amazonaws.com. Auto Mode ships no default class: create one.

The following manifest creates the gp3 class:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata: { name: gp3 }
provisioner: ebs.csi.aws.com             # Auto Mode: ebs.csi.eks.amazonaws.com
parameters: { type: gp3, encrypted: "true" }
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

Node settings

Set the file-watch limits in the node group's launch template (user data), or with the DaemonSet. On Auto Mode, check the value on a node first, because you can't change node settings there.

Node groups

To use node placement, which is optional, give the node groups the label and, for exclusive nodes, the taint:

# Terraform (aws_eks_node_group)
labels = { "openlm.com/role" = "main" }
taint {
  key    = "openlm.com/role"
  value  = "main"
  effect = "NO_SCHEDULE"
}

Add a second group with spark for the data-processing jobs. The values are exactly main and spark.

Values

Amazon EKS needs no values beyond what step 4 gives you. If you use node groups with labels, also set global.affinity.enabled: true and global.taints.enabled: true.

Data services

Use these AWS services, or your own, for the data services:

Service	AWS option	Worksheet settings
SQL Server	Amazon RDS for SQL Server (Standard or Enterprise, Express only for tests), not publicly accessible	SQL_HOST = the RDS endpoint, SQL_ENCRYPT=True
Redis	Amazon ElastiCache for Redis or Valkey 7.x, with in-transit encryption and an auth token	REDIS_TLS=true, REDIS_PASSWORD = the auth token
Kafka	Amazon MSK or your own Kafka	Use a plaintext listener inside the VPC (port 9092). For MSK with only TLS or SASL/SCRAM listeners, contact OpenLM first.
MongoDB	MongoDB Atlas (VPC peering or PrivateLink), or MongoDB in the cluster	MONGO_URI from Atlas, with its options. Amazon DocumentDB isn't supported.

To let the cluster reach the data services, allow inbound traffic from the EKS cluster security group on 1433 (SQL), 6379 (Redis), and 9092 (Kafka) in each service's security group.

Create the four databases on RDS as in step 2, connected as the administrator user you set when you created the RDS instance (the AWS console calls it the Master username).

Checks specific to EKS

Confirm the Amazon EKS settings with these commands:

• kubectl get nodes -o wide: all nodes Ready, in private subnets.
• kubectl -n ingress get service: the controller has an EXTERNAL-IP (a …elb.amazonaws.com name).
• kubectl get storageclass: your STORAGE_CLASS exists.