Help improve this page
Want to contribute to this user guide? Scroll to the bottom of this page and select Edit this page on GitHub. Your contributions will help make our user guide better for everyone.
Deploy Amazon EKS on-premises with AWS Outposts
You can use Amazon EKS to run on-premises Kubernetes applications on AWS Outposts. You can deploy Amazon EKS on Outposts in the following ways:
-
Extended clusters – Run the Kubernetes control plane in an AWS Region and nodes on your Outpost.
-
Local clusters – Run the Kubernetes control plane and nodes on your Outpost.
For both deployment options, the Kubernetes control plane is fully managed by AWS. You can use the same Amazon EKS APIs, tools, and console that you use in the cloud to create and run Amazon EKS on Outposts.
The following diagram shows these deployment options.
When to use each deployment option
Both local and extended clusters are general-purpose deployment options and can be used for a range of applications.
With local clusters, you can run the entire Amazon EKS cluster locally on Outposts. This option can mitigate the risk of application downtime that might result from temporary network disconnects to the cloud. These network disconnects can be caused by fiber cuts or weather events. Because the entire Amazon EKS cluster runs locally on Outposts, applications remain available. You can perform cluster operations during network disconnects to the cloud. For more information, see Prepare local Amazon EKS clusters on AWS Outposts for network disconnects. If you’re concerned about the quality of the network connection from your Outposts to the parent AWS Region and require high availability through network disconnects, use the local cluster deployment option.
With extended clusters, you can conserve capacity on your Outpost because the Kubernetes control plane runs in the parent AWS Region. This option is suitable if you can invest in reliable, redundant network connectivity from your Outpost to the AWS Region. The quality of the network connection is critical for this option. The way that Kubernetes handles network disconnects between the Kubernetes control plane and nodes might lead to application downtime. For more information on the behavior of Kubernetes, see Scheduling, Preemption, and Eviction
Comparing the deployment options
The following table compares the differences between the two options.
| Feature | Extended cluster | Local cluster |
|---|---|---|
|
Kubernetes control plane location |
AWS Region |
Outpost |
|
Kubernetes control plane account |
AWS account |
Your account |
|
Regional availability |
US East (Ohio), US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Middle East (Bahrain), and South America (São Paulo) |
|
|
Kubernetes minor versions |
||
|
Platform versions |
See View Amazon EKS platform versions for each Kubernetes version |
See Learn Kubernetes and Amazon EKS platform versions for AWS Outposts |
|
Outpost form factors |
Outpost racks |
Outpost racks |
|
User interfaces |
AWS Management Console, AWS CLI, Amazon EKS API, |
AWS Management Console, AWS CLI, Amazon EKS API, |
|
Managed policies |
AmazonEKSClusterPolicy and AWS managed policy: AmazonEKSServiceRolePolicy |
AmazonEKSLocalOutpostClusterPolicy and AWS managed policy: AmazonEKSLocalOutpostServiceRolePolicy |
|
Cluster VPC and subnets |
See View Amazon EKS networking requirements for VPC and subnets |
See Create a VPC and subnets for Amazon EKS clusters on AWS Outposts |
|
Cluster endpoint access |
Public or private or both |
Private only |
|
Kubernetes API server authentication |
AWS Identity and Access Management (IAM) and OIDC |
IAM and |
|
Node types |
Self-managed only |
Self-managed only |
|
Node compute types |
Amazon EC2 on-demand |
Amazon EC2 on-demand |
|
Node storage types |
Amazon EBS |
Amazon EBS |
|
Amazon EKS optimized AMIs |
Amazon Linux, Windows, and Bottlerocket |
Amazon Linux only |
|
IP versions |
|
|
|
Add-ons |
Amazon EKS add-ons or self-managed add-ons |
Self-managed add-ons only |
|
Default Container Network Interface |
Amazon VPC CNI plugin for Kubernetes |
Amazon VPC CNI plugin for Kubernetes |
|
Kubernetes control plane logs |
Amazon CloudWatch Logs |
Amazon CloudWatch Logs |
|
Load balancing |
Use the AWS Load Balancer Controller to provision Application Load Balancers only (no Network Load Balancers) |
Use the AWS Load Balancer Controller to provision Application Load Balancers only (no Network Load Balancers) |
|
Secrets envelope encryption |
See Encrypt Kubernetes secrets with AWS KMS on existing clusters |
Not supported |
|
IAM roles for service accounts |
Not supported |
|
|
Troubleshooting |
See Troubleshoot problems with Amazon EKS clusters and nodes |
Topics
