Amazon EKS to STACKIT Kubernetes Engine

An EKS cluster and node group, converted

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "aws_eks_cluster" "platform" {
  name     = "platform"
  version  = "1.31"
  role_arn = aws_iam_role.cluster.arn

  vpc_config {
    subnet_ids = [aws_subnet.private_a.id, aws_subnet.private_b.id]
  }
}

resource "aws_eks_node_group" "workloads" {
  cluster_name    = aws_eks_cluster.platform.name
  node_group_name = "workloads"
  node_role_arn   = aws_iam_role.nodes.arn
  subnet_ids      = [aws_subnet.private_a.id, aws_subnet.private_b.id]
  instance_types  = ["m6i.xlarge"]

  scaling_config {
    desired_size = 3
    min_size     = 2
    max_size     = 6
  }
}

resource "stackit_ske_cluster" "platform" {
  project_id = var.project_id
  name       = "platform"
  node_pools = [{
    name               = "workloads"
    machine_type       = var.pool_workloads_machine_type
    minimum            = 2
    maximum            = 6
    availability_zones = var.availability_zones
  }]
  kubernetes_version_min = "1.36"
}

• Node group becomes a node pool

  min_size and max_size become the pool’s minimum and maximum. SKE scales between them, so desired_size has no counterpart, and the code says so.

• Machine type sized from the source

  m6i.xlarge has 4 vCPU and 16 GiB. StackToIT proposes g1a.4d from the STACKIT eu01 catalogue as the default and records the choice as a decision you confirm.

• Version checked against SKE

  The source runs Kubernetes 1.31. SKE in eu01 offers 1.35 and newer, but the run's lifecycle data gives 1.35 no support status yet, so the code asks for 1.36, the lowest version marked supported above the source, and flags the upgrade so you check removed APIs first.

• Cluster and node roles fall away

  SKE runs its own control plane and node pools take no role. The code asks what the node credentials were used for, so that access moves to the workloads.

How the EKS estate maps

Classes as the run decided them. Which network the cluster runs in is left to your architects, because it depends on whether the STACKIT project sits in a Network Area.

What changes around the workloads

• Workload identity

  IAM roles for service accounts (IRSA) become STACKIT Workload Identity for the pods that call cloud APIs.

• Networking and storage

  The VPC CNI and EBS CSI add-ons give way to SKE’s own networking and storage classes.

• Zones

  SKE spreads a pool across its zones and recommends multiples of the zone count. The code flags a minimum of 2 nodes across 3 zones.

Questions platform teams ask

Sources

• AWS Docs: What is Amazon EKS?
• STACKIT Docs: Kubernetes Engine (SKE)
• STACKIT Docs: Terraform provider