Managed Kubernetes Services

What "Managed" Actually Means

EKS, AKS, and GKE run the hard part for you: a highly available apiserver, etcd, scheduler, and controllers, patched on schedule and backed by an SLA. You never run kubeadm init or snapshot etcd yourself.

The responsibility split is consistent:

• They own: control plane availability, control plane upgrades (often scheduled windows), and core component patching.
• You own: worker nodes and their lifecycle, cluster autoscaling, add-on versions like CNI and CoreDNS, workload security, and cost.

Node management differs: EKS offers managed node groups or Fargate (serverless pods), AKS splits system and user node pools, and GKE provides Autopilot (Google manages nodes too) alongside Standard node pools.

Connecting kubectl

Each cloud merges credentials into your kubeconfig with its own helper:

aws eks update-kubeconfig --name prod --region us-east-1
az aks get-credentials --resource-group rg-payments --name prod
gcloud container clusters get-credentials prod --region us-central1

The commands create a kubeconfig entry whose user authenticates through the cloud CLI — IAM for EKS, Microsoft Entra ID or workload identity for AKS, Google IAM for GKE — so access follows your cloud roles instead of a copied client certificate. Confirm your target before destructive work: kubectl config current-context.

Networking decisions come with the cluster: which CNI (Amazon VPC CNI, Azure CNI, or the GKE dataplane) and whether the API server endpoint is publicly reachable.

Managed Service Pitfalls

Pitfall 1 — assuming upgrades cover everything. The provider upgrades the control plane; your node images, kube-proxy, and CoreDNS add-ons lag until you roll node groups. Mixed versions within one minor are allowed — plan the full sequence anyway.

Pitfall 2 — ignoring adjacent cost. Control plane fees differ (hourly per cluster on EKS, per vCPU-hour on AKS and GKE Standard), but NAT gateway egress, load balancers, and unattached disks often dwarf node spend.

Interview-ready: state the shared-responsibility line, then diagnose "the control plane upgraded but pods still crash" as lagging nodes or add-ons. Name your auth path: cloud IAM mapped onto Kubernetes RBAC through the provider's integration.