<p>I am new to Kubernetes. I am planning to build/deploy an application to EKS. This will likely be deployed on azure and gcp as well.</p>
<p>I want to separate data plane and control plane in my application deployed in EKS.</p>
<p>Is there anyway EKS/kubernetes allows to accomplish this?</p>
<p>Or should we go for two EKS with one for data plane and another for control plane?</p>
<p>Here is the problem(copied from the answer below)</p>
<blockquote>
<p>I have an application, built using the microservice architecture
(meaning you will have it split into components that will communicate
with eachother).</p>
<p>I want to deploy this application on a public cloud (EKS, GCP, AWS).</p>
<p>I want a separation of the APPLICATION control plane (decision making
components like authentication APIs, internal service routing) from
the APPLICATION data plane (the serving of your application data to
the clients through the egress).</p>
</blockquote>

infinite_loop
<h2>My Understanding</h2>
<p>What I understand from your description is:</p>
<ol>
<li>You have an application, built using the microservice architecture (meaning you will have it split into components that will communicate with eachother).</li>
<li>You want to deploy this application on a public cloud (EKS, GCP, AWS).</li>
<li>You want a separation of the <em>APPLICATION</em> control plane (decision making components like authentication APIs, internal service routing) from the <em>APPLICATION</em> data plane (the serving of your application data to the clients through the egress).</li>
</ol>
<p>If those 3 points above are true, then the answer is yes, every cloud platform has these capabilities. You will need to architect your application in a manner that your <code>control</code> microservices are isolated from your <code>data</code> microservices. There are many ways in which you can do it (most/all of them are available in all public clouds).</p>
<h2>Some Design Ideas</h2>
<p>Here is a conceptual description:</p>
<ol>
<li>By using authentication and authorization mechanisms to ensure authorized communication between control and data plane applications. Think kubernetes <code>ServiceAccounts</code>.</li>
<li>By using network policies to restrict unauthorized traffic flow between microservices. You will require a networking overlay that supports these. Think <code>calico</code> CNI.</li>
<li>By using separate namespaces for your application services as necessary for better isolation.</li>
<li>At one level below, in your cloud, you can limit the traffic using <code>security groups</code>. Or even <code>gateways</code>.</li>
<li>You can use different instance types that match your various workload types, this will not only ensure optimal performance but also separation of failure domains. For example, if a dedicated database instance crashed, the event streaming service will still be running.</li>
</ol>
<h2>Some Notes</h2>
<p>Also understand that in a public cloud solution (even EKS) a <code>cluster-&gt;cluster</code> traffic is more expensive for you than the traffic inside a single cluster. This will be a very important cost factor and you should consider using a single cluster for your application. (k8s clusters can typically scale to 1000s of nodes).</p>
<p>I hope this somewhat answers your question. There are a lot of decisions you need to make but in short, yes, it is possible to do this separation, and your entire application will have to be designed in this way.</p>
