Private EKS + RDS: what production-ready means
Network boundaries, egress paths, and the checks that turn a cluster into a system you can sleep on
“We have EKS and RDS” is not a production story. Production-ready means the data plane is private, ingress is intentional, egress is accounted for, and the failure modes are boring enough to page on. Our open aws-eks-foundation work captures that shape—not a client case study with invented uptime claims.
Private by default is a network design
Worker nodes and the RDS instance should live in private subnets without public IPs. The API surface that must be public—usually a load balancer—sits in public subnets behind an Internet Gateway. Databases never do.
Treat the VPC as lanes: ingress through the ALB, private compute talking to RDS on security-group rules, and egress for pulls or webhooks through NAT—not by giving every pod a public address.
Security group: RDS only from node SG
Loading code…Egress is a product decision
Private clusters still need outbound paths: container registries, OS updates, third-party APIs. Route that through NAT (or VPC endpoints where you can) and write down what is allowed. Unbounded egress is how secrets leave quietly.
Prefer VPC endpoints for S3 and ECR when traffic volume or lock-down requirements justify them. Measure first; do not cargo-cult every endpoint into every account.
Control plane hygiene
Pin Kubernetes and addon versions deliberately. Restrict who can talk to the API server. Separate deploy credentials from human admin roles. Encrypt secrets at rest and keep IRSA (or equivalent) as the default for pod AWS access—static keys in ConfigMaps are a regression.
IRSA-annotated service account sketch
Loading code…Prove it before you call it ready
Production-ready includes restore drills for RDS, node drain rehearsals, and a documented path to rotate credentials. If those are “we will do them later,” the cluster is still a prototype—useful, but not finished.
Final thoughts
Production-ready private EKS + RDS is boundaries plus discipline: private data paths, intentional ingress, accounted egress, identity without static keys, and drills that prove recovery. Architecture diagrams without those checks are just aspirational art.
Related Articles
Ready to build something this considered?