A production Amazon EKS platform provisioned entirely in Terraform, built so it can be recreated from an empty AWS account. Delivered within an in house team.

The problem

Most clusters I review were built from a tutorial then modified by hand, and nobody can say what would happen if they had to be rebuilt. This one had to be reproducible from nothing, cost less when idle, and deny traffic between namespaces by default.

What I built

Cluster, networking, nodes and add ons as Terraform modules with locked remote state. Karpenter provisioning and consolidating nodes instead of static groups. Calico default deny with explicit allow rules. IRSA for pod level permissions, ingress with self renewing TLS, versioned Helm releases.

How I verified it

I terminated nodes under load, drove traffic spikes, and confirmed network policy blocked traffic. Untested resilience is a guess.