EKS Control Plane Surgery: Advanced Tuning & Security - AWS Community Day Turkiye 2025

EKS Control Plane Surgery: Advanced Tuning & Security This talk would be a step-by-step guide to taking control of your EKS clusters. We'll focus on three main bulletpoints: PS: This description is a quick explanation of how talk will be concluded, in presentation there might be other details that could be added/removed from here. 1. Customizing the EKS API Server Storage File Serialization How to safely override AWS's default settings (like enabling protobuf serialization to shrink data size and speed up etcd). Tuning API server flags (--watch-cache-sizes, --max-requests-inflight) for medium-large scale clusters, which can decrease the cost of unseen stuff. 2. Optimizing etcd Performance & Cost Why AWS's default encryption doesn't protect(partially) Kubernetes Secrets and how to fix it with KMS. Real-world benchmarks: Enabling encryption doubled our API latency – here's how we reduced the impact. Avoiding hidden costs: How choosing the wrong disk type (gp3 vs. io2) spiked our monthly bill. 3. (Optional) Enforcing Pod Security Without Breaking Workloads Implementing Pod Security Admission (PSA) without blocking CI/CD pipelines. A real incident: How a single misconfigured securityContext let attackers access nodes – and how PSA stopped it. Practical Demos: - There would be some little demos about reducing etcd I/O by 40% using protobuf and restoring EKS cluster from an etcd snapshot stored in S3. Bio: Batuhan 22 Development Team Lead @Malwation Sabanci University Organized by Cloud Turkiye X https://x.com/CloudTurkiye Kommunity https://kommunity.com/cloud-turkiye LinkedIn   / cloud-turkiye   Medium   / cloud