# Exercise 1: Design an EKS Platform for Five Teams

`MediaHub` is moving 60 microservices (5 teams) from self-managed Kubernetes on EC2 to EKS in `eu-central-1`.

Requirements:
- Three environments (dev, staging, prod); prod spans three AZs.
- ~1,200 pods in prod at peak, nightly batch jobs that can run on Spot, a few GPU inference services.
- Each team deploys only into its own namespaces; the platform team administers clusters.
- Services call S3, SQS and DynamoDB; no long-lived AWS keys allowed anywhere.
- Public HTTPS endpoints for 15 services; internal-only gRPC between services.
- Upgrades at least twice a year with no downtime.

## Deliverables

1. **Cluster topology**: one cluster per environment or shared? Justify. Show the VPC/subnet sizing for prod given 1,200 pods with the VPC CNI (state your IP math, and whether you use prefix delegation or a secondary CIDR).
2. **Compute**: managed node groups vs Karpenter (NodePools for general, Spot batch and GPU) — show the NodePool/requirements you'd define in prose or YAML.
3. **Access**: how IAM roles map to cluster permissions per team (access entries + Kubernetes RBAC), and how CI deploys.
4. **Workload identity**: Pod Identity associations for two example services with least-privilege policies; how you prevent pods from using the node role.
5. **Ingress**: AWS Load Balancer Controller configuration for public HTTPS (ALB, ACM, external-dns) and internal gRPC (NLB or service mesh).
6. **Add-ons & observability**: the list of add-ons and how they're managed (EKS managed add-ons vs Helm via GitOps).
7. **Upgrade runbook**: steps from 1.30 → 1.31 with zero downtime, including PodDisruptionBudgets and deprecated API checks.

## Requirements Checklist

- [ ] Separate clusters (at least prod vs non-prod) with justification about blast radius and upgrades.
- [ ] IP math accounts for pods + nodes + headroom with explicit subnet sizes, and mentions prefix delegation or secondary CIDRs.
- [ ] Karpenter NodePools for on-demand general, Spot batch (with taints/tolerations) and GPU instances, plus consolidation.
- [ ] Access entries map team roles to namespace-scoped RBAC; CI uses an OIDC-federated role.
- [ ] Pod Identity (or IRSA) per service account with resource-scoped policies; IMDS hop limit 1 / minimal node role.
- [ ] ALB via LB Controller with ACM certs and external-dns; internal traffic via ClusterIP/NLB/mesh.
- [ ] Upgrade runbook: check deprecated APIs (e.g. `kubectl convert`, `pluto`), upgrade control plane, then add-ons, then nodes (Karpenter drift / node group rolling update), PDBs respected, one minor at a time.