The first time someone runs kubectl get nodes on an EKS cluster, they pause briefly. Where's the control plane? Why did two nodes suddenly appear? Why does each Pod consume an ENI slot? Using managed K8s doesn't make K8s disappear. Only the ugliest operational parts—etcd backups, control plane patches—shift to AWS. SAP exams target this "remainder." How Managed Node Groups auto-drain, which STS API IRSA calls, how Karpenter provisions EC2 without ASG—these appear as one to two questions per domain.
This article dissects EKS' data plane into three layers: how to launch nodes (node groups), how to grant permissions to Pods (IRSA·Pod Identity), how to auto-adjust node count per demand (Karpenter)