AWS · EKS
What the socle builds
Section titled “What the socle builds”One tofu apply of opentofu/clusters/aws
builds, in your account, a VPC (public and private subnets per AZ, NAT,
endpoints, flow logs), an EKS Standard cluster with no VPC CNI, kube-proxy or
CoreDNS add-on, two Spot Graviton bootstrap nodes, and on request
Crossplane’s IAM role and the Gateways’ ACM certificate. It then installs
Cilium, CoreDNS, the EKS add-ons and the Flux Operator, and Flux renders the
catalog from the signed artifact.
Start with Prerequisites, then the AWS quickstart. What is decided for you is in Foundations.
One cluster, defaults, two AZs. US dollars, eu-west-3 list prices, September 2026, 730 hours a month.
| Line | Per month |
|---|---|
| EKS control plane, standard support | $73 |
| Two Spot bootstrap nodes and their volumes | about $84 |
| Interface endpoints, five services in two AZs | about $73 |
| KMS keys | about $2 |
| Total, before NAT and traffic | about $232 |
Under the hood
- The node line reaches $123 when both nodes come from
r6g.bootstrap_node_capacity_type = "ON_DEMAND"puts it at $223 (twot4g.xlarge). - Spot, per node:
t4g.xlarge$39.42,m6g.xlarge$40.37,m7g.xlarge$41.68,c6g.xlarge$42.63,r6g.xlarge$59.57;c7g.xlargewas not priced. Each node has a 20 GiB gp3 volume. - Interface endpoints: about $7.30 each per AZ. Each extra AZ adds one per service and a NAT Gateway.
- Not counted, because they depend on use: the NAT Gateways (one per AZ,
hourly plus per GB), the Gateways’ NLBs when
gateway_certificateis set, CloudWatch Logs ingestion and storage, EBS volumes and snapshots, and the workloads’ own nodes.
Status
Section titled “Status”- Built: the foundations (
opentofu/aws) and the one-apply root. - Proven in CI: static checks on every pull request
(
pr-static.yaml), a plan against floci (integration.yaml), and, on every published artifact, the real root applied on floci’s k3s, every module checked by Chainsaw, then uninstalled and destroyed (e2e.yaml). Not proven: Cilium on real nodes, Pod Identity, IAM enforcement, ACM, Route 53, the NLBs. - Not built: Karpenter (#53), the Upgrade Insights pre-check, cloud-resource observability.