Containers

This post features the new Cluster Mode deployment model in AWS Elastic Beanstalk that extends the operational promise of the service to containerized application portfolios. You bring your applications as source code, Dockerfiles, or container images, and Elastic Beanstalk takes ongoing operational responsibility for the production environment underneath.

Learn how to scope Amazon ECR image pull permissions to individual Kubernetes pods on a multi-tenant Amazon EKS cluster using KEP 4412 credential providers and ECR repository deny policies, so teams sharing the same nodes can pull only their own container images.

Ramp runs GPU-powered AI inference continuously on Amazon ECS. This post walks through how Ramp’s infrastructure team moved those GPU workloads onto Amazon ECS Managed Instances: the architecture pattern, Terraform implementation, and the lessons learned migrating 50 to 60 EC2 instances.

Learn how to use a Kyverno mutating admission policy to automatically inject corporate proxy environment variables into Amazon EKS on AWS Fargate pods at admission time, delivering consistent egress compliance without modifying application deployment manifests.

When you scale AI inference on Amazon EKS, every new pod must load model weights into GPU memory before serving traffic. We investigated where cold-start time goes and found two configuration-only changes to Run:ai Model Streamer that cut model startup time by 80-93% on subsequent launches, with no code changes.

Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure.

Amazon EKS now provides a managed, non-disruptive lifecycle for rotating your cluster’s certificate authority (CA), with automated safeguards and rollback. This deep dive explains how CA rotation works, what AWS handles versus what you must update, and how to walk through the rotation lifecycle on your own timeline.

Learn how to encrypt traffic between Amazon ECS workloads using two native approaches: VPC encryption controls for network-layer encryption through the AWS Nitro System, and Service Connect TLS for application-layer encryption. A hands-on walkthrough shows how to activate encryption on AWS Fargate and verify it in VPC Flow Logs.

Amazon EKS 1.34 makes the Kubelet Checkpoint API functional, so you can capture a running container’s full state (memory, processes, and network connections) without stopping the workload. This post shows how to deploy an unprivileged checkpoint agent that stores forensic checkpoints in Amazon ECR as OCI images for later analysis.

With Amazon EKS, you can now configure Kubernetes control plane components (the API server, scheduler, and controller manager) directly through EKS APIs. This post explains what’s configurable and includes two hands-on walkthroughs: enabling MostAllocated bin-packing to optimize pod placement, and tuning event retention duration.