Operational notes on AWS EKS

Most EKS operational pain shows up at the IAM boundary — IRSA (IAM Roles for Service Accounts) misconfiguration is a common source of pods that can authenticate to AWS but can't authorize the specific action they need.

Node group sizing and pod disruption budgets matter more than they seem to at first — under-provisioned node groups turn routine deployments into cascading evictions.