Amazon Elastic Kubernetes (EKS) vs Azure Kubernetes Service (AKS)

High availability is one of the biggest selling points for modern cloud computing technologies. You want your application or service to always be available to customers from anywhere in the world via an internet connection.

Service Level Agreements

Service Level Agreements (SLAs) include availability levels as a percentage value. A user can expect an application’s uptime to be on or above the percentage for a given period of time.

EKS: By default, it offers SLAs with 99.95% uptime for all clusters.

AKS: Offers SLAs with 99.5% uptime for free clusters. You can pay extra to achieve an uptime of 99.95%.

Node repair

Node repair ensures that a cluster remains healthy and reduces the chances of possible downtime.

EKS: Does not perform node health checks or repairs. However, it allows you to perform custom checks and automatic node replacements.

AKS: Continuously monitors the health of nodes in a cluster and automatically initiates auto repair when it detects a problem.

Security

Users of managed Kubernetes services want a provider that can guarantee the security of their cluster. An aspect that makes both AKS and EKS very popular is the network and security capabilities offered to clients.

EKS:

• Supports configurable IPs and use role-based access control (RBAC) in their clusters.
• AWS makes EKS-optimized AMI up to date with Kubernetes, but users are responsible for applying this to their clusters.
• AWS offers managed or self-managed nodes. The self-managed nodes behave like Azure, but the managed nodes follow a preset, customizable procedure.
• Compliant with HIPAA, ISO, PCI DSS, and SOC.

AKS:

• Supports configurable IPs and use role-based access control (RBAC) in their clusters.
• Supports the deployment of confidential containers. This feature allows you to run applications in isolated containers for enhanced security.
• Users are responsible for updating Kubernetes versions of their cluster. 
• The node OS (typically Linux) is automatically updated, but requires a manually scheduled restart to complete.
• Compliant with HIPAA, ISO, PCI DSS, and SOC.

RBAC lets you manage how developers interact with your cluster. For example, you can restrict the namespaces where a developer can deploy apps. However, implementing this functionality comes with some complexity in both services.

Quota Limits

Quota limits are the maximum number of Kubernetes components. The components include clusters, pods, nodes, and node pools. Both services provide clearly defined limits:

• Cluster per region
  • EKS: Maximum of 100 clusters per region
  • AKS: Mmaximum of 5000 clusters per subscription
• Node pools— Both services organize nodes with similar configurations into pools for easier management.
  • EKS: Maximum of 30 node pools per cluster
  • AKS: Limit of 10 pools.
• Nodes in a cluster
  • EKS: Maximum of 450 nodes per node group and a maximum of 30 node groups. This adds up to a maximum of 13,500 nodes per cluster.
  • AKS: Maximum of 1000 nodes per cluster.
• Pods per node —
  • EKS: The maximum number of pods depends on the Elastic Network Interfaces (ENIs). An ENI is a network component that represents a virtual network card in a Virtual Private Network (VPN). The ENI enables Amazon EC2 instances to connect to other networks. The maximum number of pods supported by EKS varies because an EC2 instance can have more than one ENI attached.
  • AKS: Maximum of 250 pods per node

Network policy

Network policies allow you to control the components in a cluster that can communicate with each other.

By default, a Kubernetes cluster allows for pod-to-pod communication. This increases flexibility and makes the development process much easier. While this can be okay in a development environment, it is considered insecure in a production environment.

EKS:

• Two network policy options that depend on the cluster type:
  • Amazon VPC networking
  • Calico network policies
• You must select the network policy when you create the cluster. You cannot change the policy afterward.

AKS:

• Users can implement network policies in two ways:
  • Azure network policies
  • Calico network policies
• Both policies use Linux IPTables and are organized into sets of allowed and disallowed IP pairs. You cannot change the policies after creating a cluster.

Integration with other services

Both services make the process of integrating other tools and services very easy. You can integrate several services into a Kubernetes cluster to increase its capability. For example, you can add monitoring and security tools to your cluster.

Pricing

One of the biggest benefits of cloud computing is you pay for what you use.

EKS:

• Only charge you for the infrastructure under your control. You don’t pay for the primary node or other critical services that work in the background.
• Charges you $0.10 per hour per cluster for Kubernetes master node operation. While this may seem like a small fee, it can grow significantly if an organization is managing many clusters at once.

AKS:

• Only charge you for the infrastructure under your control. You don’t pay for the primary node or other critical services that work in the background.

Conclusion

AKS and EKS are two of the biggest cloud computing service providers. They offer mature services that guarantee consistency in performance.

When choosing a cloud provider to use, it’s important to consider your level of expertise, familiarity with each offering, and the total cost.

With EKS, you get high availability at no extra cost and more customization options with than you get with Azure Kubernetes Services.

For more information on securing your containers, check out the documentation for Trend Micro Cloud One™ – Container Security or explore these resources:

5 Tips for Lifecycle Security for Containers
Container Security