AWS · EKS · Now on AWS Marketplace

Enterprise EKS
Orchestration

EKS Manager delivers a complete, revision-controlled, production-grade EKS cluster — not just the cluster itself — with internal DNS, TLS, ingress, monitoring, and deployment tooling pre-integrated and kept consistent across all dev, QA, integration, UAT, and production environments via GitOps.

EKS Route53 Pod Identity KMS Secrets ArgoCD Traefik
Beyond eksctl

Native AWS tools provision a cluster. EKS Manager provisions a platform — declarative, reproducible, and identical from your laptop to production.

eksctl

Stops at the cluster boundary

eksctl creates the EKS control plane and node groups — then leaves you to manually wire DNS, TLS, ingress, and monitoring. Every engineer does it differently every time.

Terraform

Infrastructure only, not the platform

Terraform provisions AWS resources but is not opinionated about what runs inside the cluster. You still need to separately manage ArgoCD apps, cert lifecycles, and ingress config — and keep them in sync across environments.

Helm / Raw Manifests

No environment consistency guarantee

Without GitOps as the source of truth, dev, QA, UAT, and production clusters drift. A hotfix applied manually in prod is never reflected in dev. EKS Manager uses ArgoCD to make every environment a declared, auditable state.

Helm CRD Upgrades

Helm doesn't upgrade CRDs at all

By design, helm upgrade installs CRDs once and never touches them again — so when a component's definitions change between versions, working it out is left to you. And deleting a CRD cascades: every custom resource using it goes with it. EKS Manager sequences it — the resources are captured, the definitions replaced and the resources restored. Where deleting a definition would be unsafe, it is applied in place instead.

DIY Open Source Stack

Assembly and maintenance are the hard part

ArgoCD, Traefik, ExternalDNS, ECK, and Headlamp are individually free. Integrating them, keeping them compatible, and upgrading them safely across a cluster lifecycle is weeks of engineering every trimester. EKS Manager does this for you.

Least Privileged Access

EKS Manager is a least-privilege access agent — powerful enough to safely provision clusters, node groups, and vault secrets, yet scoped to block the most dangerous AWS Full Admin permissions.

Security Pillar
AWS Full Admin
EKS Manager Guardrails
Identity Control
Can create IAM Users & Keys
Blocked: No persistence backdoors
Security Integrity
Can delete CloudTrail / GuardDuty
Locked: No CloudTrail or GuardDuty access
Persistence Risk
High: Shadow Admin keys
Zero: No long-lived credentials
Data Safety
Can delete S3 / KMS keys
Protected: No S3 access, KMS deletion denied
Financial Risk
Can change billing / POs
Protected: No billing access
EKS Orchestration Features

Pod Identity

Native EKS Pod Identity ensures least-privilege access with short-lived tokens — no static keys, no IRSA complexity.

KMS Envelope Encryption

Automated KMS integration encrypts secrets at rest via hardware-backed security.

Node Group Isolation

Automated Taints and Tolerations for Node Groups ensure dedicated compute isolation.

Secrets Management Lifecycle

Integrated with AWS Secrets Manager with a GUI to dynamically update secrets.

Automated & Maintained

Every component upgraded trimesterly — no manual patching, no version drift.

GitOps

ArgoCD & Workflows

The core of our GitOps delivery and DAG batch processing, upgraded trimesterly.

Ingress / DNS

Traefik & ExternalDNS

Automated lifecycle for ingress, TLS, and DNS automation for reliable AWS routing.

Observability

Headlamp & ECK

Modern Kubernetes UI and full-stack observability updated to latest releases.

CRD Upgrades Without Data Loss

helm upgrade does not upgrade CRDs. That is documented Helm behaviour — they are installed once and never touched again, so when a component's definitions change between versions, working it out is left to you. And deleting a CRD cascades: every custom resource using it goes with it.

Captured, Replaced, Restored

ArgoCD, Argo Workflows, Traefik and the GitHub Actions Runner Controller

EKS Manager sequences it. The custom resources are captured, the definitions replaced, and the resources restored — as part of the upgrade, not a separate exercise you have to invent.

Applied In Place Instead

Elasticsearch and the AWS Load Balancer Controller

Elasticsearch holds data, so its definitions are never deleted — they are applied server-side, leaving every Elasticsearch, Kibana and Beat resource untouched. The load balancer controller is treated the same way.

EKS Version Upgrades

The data stays where it is

Upgrading the EKS cluster itself replaces every node. Elasticsearch is scaled down onto its retained volumes first and brought back afterwards, so the node roll never has to move or rebalance the data it holds — which is what makes it quick.

Managed EKS Add-ons

EKS add-ons are the drivers and core networking components that must stay version-compatible with your cluster on every upgrade. EKS Manager manages their full lifecycle — no manual intervention, no silent breakage.

vpc-cni · kube-proxy

Core networking drivers. A version mismatch after a Kubernetes upgrade breaks pod-to-pod communication cluster-wide.

coredns

In-cluster DNS resolution. Stale versions cause service discovery failures that are notoriously difficult to diagnose.

aws-ebs-csi-driver

Persistent volume provisioning. Outdated CSI drivers leave StatefulSets unable to mount storage after a node replacement.

metrics-server · eks-pod-identity-agent

HPA scaling and IAM federation. Both must be kept compatible with the control plane version to prevent silent autoscaling and auth failures.

Managed Lifecycle

Every EKS cluster and add-on upgraded trimesterly via AWS Marketplace — with a support tier to match your team's needs.

AWS Marketplace

Marketplace Lifecycle

Full stack and EKS cluster upgrades every trimester — add-ons, ingress, observability and GitOps tooling moved together to a tested combination.

AWS Marketplace
Public Offering

Community Support

Best-efforts support via email. Ideal for teams evaluating the platform or running non-critical workloads.

Email support
Best-efforts response
No SLA guarantee
Enterprise

Production Support

Business hours support (Mon–Fri, CET) for teams running production workloads on EKS Manager.

P1 response:  4 hours
P2 response:  1 business day
Mon–Fri, 09:00–18:00 CET
Get in Touch
General Enquiries & Support

General Enquiries & Trial Support

Have a question about EKS Manager, or need help during your trial? Our team will get back to you shortly.

Contact Us →

Customer Support

For licensed customers only. Use our verified support chat to connect directly with our team.

Response within 4 business hours · Mon–Fri 09:00–18:00 CET

Open Support Chat →