View a markdown version of this page

Configure EKS Auto Mode settings - Amazon EKS

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Configure EKS Auto Mode settings

This chapter describes how to configure specific aspects of your Amazon Elastic Kubernetes Service (EKS) Auto Mode clusters. While EKS Auto Mode manages most infrastructure components automatically, you can customize certain features to meet your workload requirements.

Using the configuration options described in this topic, you can modify networking settings, compute resources, and load balancing behaviors while maintaining the benefits of automated infrastructure management. Before making any configuration changes, review the available options in the following sections to determine which approach best suits your needs.

What features do you want to configure? Configuration option

Node networking and storage

  • Configure node placement across public and private subnets

  • Define custom security groups for node access control

  • Customize network address translation (SNAT) policies

  • Enable Kubernetes network policies, detailed network policy logging and monitoring

  • Set ephemeral storage parameters (size, IOPS, throughput)

  • Configure encrypted ephemeral storage with custom KMS keys

  • Isolate pod traffic in separate subnets from the nodes

Create a Node Class for Amazon EKS

Node compute resources

  • Select specific EC2 instance types and families

  • Define CPU architectures (x86_64, ARM64)

  • Configure capacity types (On-Demand, Spot)

  • Specify Availability Zones

  • Configure node taints and labels

  • Set resource limits for CPU and memory usage

Create a Node Pool for EKS Auto Mode

Static-capacity node pools

  • Maintain a fixed number of nodes regardless of pod demand

  • Configure predictable capacity for reserved instances

  • Set specific replica counts for consistent infrastructure footprint

  • Scale static node pools manually

  • Monitor static-capacity node pool status

Static Capacity Node Pools in EKS Auto Mode

Application Load Balancer settings

  • Deploy internal or internet-facing load balancers

  • Configure cross-zone load balancing

  • Set idle timeout periods

  • Enable HTTP/2 and WebSocket support

  • Configure health check parameters

  • Specify TLS certificate settings

  • Define target group attributes

  • Set IP address type (IPv4, dual-stack)

Create an IngressClass to configure an Application Load Balancer

Network Load Balancer settings

  • Configure direct pod IP routing

  • Enable cross-zone load balancing

  • Set connection idle timeout

  • Configure health check parameters

  • Specify subnet placement

  • Set IP address type (IPv4, dual-stack)

  • Configure preserve client source IP

  • Define target group attributes

Use Service Annotations to configure Network Load Balancers

Gateway API settings

  • Configure L7 (HTTP/gRPC) and L4 (TCP/UDP) routing with the Kubernetes Gateway API

  • Provision Application Load Balancers and Network Load Balancers from Gateway resources

  • Use GatewayClass, Gateway, and Route resources for role-oriented traffic management

  • Apply AWS specific configuration with TargetGroupConfiguration, LoadBalancerConfiguration, and ListenerRuleConfiguration

  • Coexist with third-party gateway implementations in the same cluster

Configure the Kubernetes Gateway API in EKS Auto Mode

Multi cluster target groups

  • Understand how the load balancer controller manages target group membership

  • Enable MultiCluster support to share a target group across multiple Kubernetes clusters

  • Support arbitrary targets from other sources in a shared target group

Configure multi-cluster target groups

Extending RBAC for managed controllers

  • Understand how EKS Auto Mode managed controllers authenticate to your cluster

  • Grant additional Kubernetes RBAC to the managed controllers via the eks:managed group

  • Scope the grant with Role / RoleBinding and resourceNames for least privilege

Grant additional Kubernetes RBAC to EKS Auto Mode managed controllers

Storage Class settings

  • Define EBS volume types (gp3, io1, io2, etc.)

  • Configure volume encryption and KMS key usage

  • Set IOPS and throughput parameters

  • Set as default storage class

  • Define custom tags for provisioned volumes

Create a storage class

Control ODCR Usage

  • Configure workload deployment into EC2 On-Demand Capacity Reservations

  • Explicitly select specific ODCRs by ID for targeted capacity usage

  • Use tag-based selection to target groups of ODCRs

  • Filter ODCRs by owning AWS account for cross-account scenarios

  • Control whether workloads automatically use open ODCRs

Control deployment of workloads into Capacity Reservations with EKS Auto Mode

Node advanced security

  • Enable FIPS 140-2 validated cryptographic modules

  • Configure kernel lockdown security mode

Configure advanced security settings for nodes

Cost optimization

  • Understand how consolidation, bin-packing, and right-sizing reduce compute costs

  • Identify configurations that block consolidation (do-not-disrupt, restrictive PDBs)

  • Set NodePool limits as a cost ceiling

  • Restrict instance families and sizes to control all-in cost

  • Apply recommended patterns for bursty CI/CD workloads

Cost optimization in EKS Auto Mode