Each incident traces to one module of this deck.

Networking

Pods Pending at 60% CPU

Symptom: scale-up failed; FailedCreatePodSandBox and no IP errors.

Cause: nodes and Pods shared /24 subnets and the cluster ran out of VPC IPs.

Fix: secondary CIDR for Pods plus prefix delegation, bigger node subnets.

Lesson: plan IP capacity before growth.

Add-ons

Pods lose IPs after a routine update

Symptom: new Pods stuck ContainerCreating right after patching.

Cause: the VPC CNI add-on was updated with OVERWRITE, reverting prefix delegation.

Fix: restore config, move it to configuration values, always use PRESERVE.

Lesson: diff add-on config before and after.

Access

CI suddenly cannot deploy

Symptom: Unauthorized from every pipeline.

Cause: a hand-edited aws-auth ConfigMap dropped the CI role during a change.

Fix: restore the mapping, move to access entries managed by Terraform.

Lesson: access as reviewed code, not a YAML edit.

When EKS misbehaves, name the layer first: network capacity, add-on configuration, identity, compute, or the workload. Modules 1 to 6 are the checklist.

Three EKS incidents and the mechanism behind each

These are composites of common incidents. In the first, a cluster that was fine at 100 nodes began failing to start Pods at 60 percent CPU utilisation. Pod sandbox creation failed with IP allocation errors because nodes and Pods shared small subnets and the VPC address space was exhausted. The fix combined a secondary CIDR for Pods and prefix delegation, plus larger node subnets; the lesson is that IP capacity is a first-class design input on EKS.

In the second, a routine update of the VPC CNI add-on with OVERWRITE silently reverted a customisation (prefix delegation), so newly created Pods could not obtain IPs. The fix was to restore the configuration, move it into the add-on's configuration values under version control, and make PRESERVE the standard. The lesson: compare applied configuration before and after any add-on change.

In the third, a hand-edited aws-auth ConfigMap dropped the CI role, and every pipeline began failing with Unauthorized. The recovery needed someone with another path in. The remedy is to manage access with access entries through Terraform, so that changes are reviewed and recoverable. Reveal the three cases with the right arrow.

Make a habit of the postmortem question used throughout this course: which mechanism owns this? The module map is a good first-aid index.