Hot Take: Kubernetes 1.32 Is Overkill for 90% of Startups Using AWS Lambda 2026 and Cloudflare Workers 3.2

# Full Terraform configuration for AWS EKS 1.32 cluster
# Provider configuration with version pinning for reproducibility
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.0"
    }
  }
  required_version = ">= 1.3.0"
}

# Configure AWS provider with error handling for missing credentials
provider "aws" {
  region = var.aws_region

  # Validate that required credentials are present
  dynamic "assume_role" {
    for_each = var.aws_assume_role_arn != "" ? [1] : []
    content {
      role_arn = var.aws_assume_role_arn
    }
  }

  default_tags {
    tags = {
      Project     = var.project_name
      Environment = var.environment
      ManagedBy   = "terraform"
    }
  }
}

# Variables with validation for error handling
variable "aws_region" {
  type        = string
  description = "AWS region to deploy EKS cluster"
  default     = "us-east-1"

  validation {
    condition     = contains(["us-east-1", "us-west-2", "eu-west-1"], var.aws_region)
    error_message = "Unsupported AWS region. Choose us-east-1, us-west-2, or eu-west-1."
  }
}

variable "project_name" {
  type        = string
  description = "Name of the project for resource tagging"
  default     = "startup-eks-cluster"
}

variable "environment" {
  type        = string
  description = "Deployment environment (dev, staging, prod)"
  default     = "prod"

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "eks_version" {
  type        = string
  description = "Kubernetes version for EKS cluster"
  default     = "1.32"

  validation {
    condition     = var.eks_version == "1.32"
    error_message = "This config is pinned to EKS 1.32 for benchmark consistency."
  }
}

variable "node_instance_type" {
  type        = string
  description = "EC2 instance type for EKS worker nodes"
  default     = "t3.medium"

  validation {
    condition     = contains(["t3.medium", "t3.large", "m5.large"], var.node_instance_type)
    error_message = "Unsupported instance type for startup workloads."
  }
}

# VPC configuration for EKS cluster
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "${var.project_name}-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["${var.aws_region}a", "${var.aws_region}b", "${var.aws_region}c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true # Cost optimization for startups

  tags = {
    "kubernetes.io/cluster/${var.project_name}-eks" = "shared"
  }
}

# EKS cluster configuration
module "eks" {
  source = "terraform-aws-modules/eks/aws"

  cluster_name    = "${var.project_name}-eks"
  cluster_version = var.eks_version

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  # Enable private cluster endpoint for security
  cluster_endpoint_private_access = true
  cluster_endpoint_public_access  = true

  # Add cluster logging for troubleshooting
  cluster_enabled_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]

  # Node group configuration
  eks_managed_node_groups = {
    startup_nodes = {
      instance_types = [var.node_instance_type]

      min_size     = 2
      max_size     = 5
      desired_size = 3

      # Enable detailed monitoring for cost tracking
      enable_monitoring = true

      # Add tags for resource management
      tags = {
        Name = "${var.project_name}-eks-node"
      }
    }
  }

  tags = {
    Project     = var.project_name
    Environment = var.environment
  }
}

# Output cluster details for kubectl configuration
output "eks_cluster_id" {
  value = module.eks.cluster_id
}

output "eks_cluster_endpoint" {
  value = module.eks.cluster_endpoint
}

output "eks_cluster_certificate_authority_data" {
  value = module.eks.cluster_certificate_authority_data
  sensitive = true
}

// AWS Lambda 2026 Node.js 22 runtime function with full error handling and observability
// Environment variables required:
// - DB_HOST: PostgreSQL host endpoint
// - DB_PORT: PostgreSQL port (default 5432)
// - DB_USER: Database user
// - DB_PASSWORD: Database password (stored in AWS Secrets Manager)
// - LOG_LEVEL: Logging level (info, debug, error)

const { SecretsManagerClient, GetSecretValueCommand } = require("@aws-sdk/client-secrets-manager");
const { Pool } = require("pg");
const AWSXRay = require("aws-xray-sdk-core");
const AWS = AWSXRay.captureAWS(require("aws-sdk"));

// Initialize clients with error handling for missing config
let secretsClient;
let dbPool;

try {
  secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION || "us-east-1" });
} catch (err) {
  console.error("Failed to initialize Secrets Manager client:", err);
  throw new Error("Secrets Manager initialization failed");
}

// Validate required environment variables on cold start
const requiredEnvVars = ["DB_HOST", "DB_PORT", "DB_USER"];
for (const envVar of requiredEnvVars) {
  if (!process.env[envVar]) {
    throw new Error(`Missing required environment variable: ${envVar}`);
  }
}

// Initialize database pool with connection limits for Lambda
const initDbPool = async () => {
  if (dbPool) return dbPool;

  try {
    // Fetch database password from Secrets Manager
    const secretCommand = new GetSecretValueCommand({
      SecretId: process.env.DB_SECRET_ARN,
    });
    const secretResponse = await secretsClient.send(secretCommand);
    const secret = JSON.parse(secretResponse.SecretString);

    dbPool = new Pool({
      host: process.env.DB_HOST,
      port: parseInt(process.env.DB_PORT, 10),
      user: process.env.DB_USER,
      password: secret.password,
      database: process.env.DB_NAME || "startup_db",
      max: 5, // Limit connections for Lambda's ephemeral nature
      idleTimeoutMillis: 1000,
      connectionTimeoutMillis: 5000,
    });

    // Test database connection on initialization
    await dbPool.query("SELECT 1");
    console.info("Database pool initialized successfully");
    return dbPool;
  } catch (err) {
    console.error("Failed to initialize database pool:", err);
    throw new Error("Database initialization failed");
  }
};

// Lambda handler with full error handling and tracing
exports.handler = AWSXRay.captureAsyncFunc("lambdaHandler", async (event, context) => {
  context.callbackWaitsForEmptyEventLoop = false;
  const startTime = Date.now();

  try {
    // Validate event structure
    if (!event.httpMethod || !event.path) {
      return {
        statusCode: 400,
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ error: "Invalid event structure" }),
      };
    }

    // Initialize dependencies
    const pool = await initDbPool();

    // Handle different HTTP methods
    switch (event.httpMethod) {
      case "GET": {
        // Fetch user data from database
        const userId = event.pathParameters?.userId;
        if (!userId) {
          return {
            statusCode: 400,
            body: JSON.stringify({ error: "Missing userId parameter" }),
          };
        }

        const query = "SELECT id, name, email FROM users WHERE id = $1";
        const result = await pool.query(query, [userId]);

        if (result.rows.length === 0) {
          return {
            statusCode: 404,
            body: JSON.stringify({ error: "User not found" }),
          };
        }

        return {
          statusCode: 200,
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify(result.rows[0]),
        };
      }

      case "POST": {
        // Create new user
        const body = JSON.parse(event.body || "{}");
        const { name, email } = body;

        if (!name || !email) {
          return {
            statusCode: 400,
            body: JSON.stringify({ error: "Missing name or email" }),
          };
        }

        const query = "INSERT INTO users (name, email) VALUES ($1, $2) RETURNING id";
        const result = await pool.query(query, [name, email]);

        return {
          statusCode: 201,
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({ id: result.rows[0].id, name, email }),
        };
      }

      default: {
        return {
          statusCode: 405,
          body: JSON.stringify({ error: "Method not allowed" }),
        };
      }
    }
  } catch (err) {
    console.error("Lambda execution failed:", err);
    // Capture error in X-Ray for observability
    AWSXRay.getSegment()?.addError(err);
    return {
      statusCode: 500,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ error: "Internal server error" }),
    };
  } finally {
    const duration = Date.now() - startTime;
    console.info(`Lambda execution duration: ${duration}ms`);
    AWSXRay.getSegment()?.close();
  }
});

// Cloudflare Workers 3.2 TypeScript script with Durable Objects for stateful edge workloads
// wrangler.toml configuration:
// name = "startup-edge-api"
// main = "src/index.ts"
// compatibility_date = "2026-03-01"
// compatibility_flags = ["nodejs_compat"]
//
// [durable_objects]
// bindings = [
//   { name = "USER_SESSIONS", class_name = "UserSession" }
// ]
//
// [[migrations]]
// tag = "v1"
// new_classes = ["UserSession"]

import { DurableObject } from "cloudflare:workers";

// Interface for user session data
interface UserSessionData {
  userId: string;
  lastActive: number;
  preferences: Record;
}

// Durable Object for managing user sessions at the edge
export class UserSession extends DurableObject {
  private storage: DurableObjectStorage;
  private sessions: Map;

  constructor(ctx: DurableObjectState, env: Env) {
    super(ctx, env);
    this.storage = ctx.storage;
    this.sessions = new Map();

    // Load existing sessions from storage on initialization
    ctx.blockConcurrencyWhile(async () => {
      const storedSessions = await this.storage.get>("sessions");
      if (storedSessions) {
        this.sessions = storedSessions;
      }
    });
  }

  // Handle HTTP requests to the Durable Object
  async fetch(request: Request): Promise {
    const url = new URL(request.url);
    const sessionId = url.pathname.split("/").pop();

    if (!sessionId) {
      return new Response(JSON.stringify({ error: "Missing session ID" }), {
        status: 400,
        headers: { "Content-Type": "application/json" },
      });
    }

    try {
      switch (request.method) {
        case "GET": {
          // Retrieve session data
          const session = this.sessions.get(sessionId);
          if (!session) {
            return new Response(JSON.stringify({ error: "Session not found" }), {
              status: 404,
              headers: { "Content-Type": "application/json" },
            });
          }

          // Update last active timestamp
          session.lastActive = Date.now();
          this.sessions.set(sessionId, session);
          await this.storage.put("sessions", this.sessions);

          return new Response(JSON.stringify(session), {
            status: 200,
            headers: { "Content-Type": "application/json" },
          });
        }

        case "POST": {
          // Create or update session
          const body: Partial = await request.json();
          if (!body.userId) {
            return new Response(JSON.stringify({ error: "Missing userId" }), {
              status: 400,
              headers: { "Content-Type": "application/json" },
            });
          }

          const existingSession = this.sessions.get(sessionId);
          const updatedSession: UserSessionData = {
            userId: body.userId,
            lastActive: Date.now(),
            preferences: body.preferences || existingSession?.preferences || {},
          };

          this.sessions.set(sessionId, updatedSession);
          await this.storage.put("sessions", this.sessions);

          return new Response(JSON.stringify(updatedSession), {
            status: 200,
            headers: { "Content-Type": "application/json" },
          });
        }

        case "DELETE": {
          // Delete session
          const deleted = this.sessions.delete(sessionId);
          if (!deleted) {
            return new Response(JSON.stringify({ error: "Session not found" }), {
              status: 404,
              headers: { "Content-Type": "application/json" },
            });
          }

          await this.storage.put("sessions", this.sessions);
          return new Response(JSON.stringify({ success: true }), {
            status: 200,
            headers: { "Content-Type": "application/json" },
          });
        }

        default: {
          return new Response(JSON.stringify({ error: "Method not allowed" }), {
            status: 405,
            headers: { "Content-Type": "application/json" },
          });
        }
      }
    } catch (err) {
      console.error("Durable Object error:", err);
      return new Response(JSON.stringify({ error: "Internal server error" }), {
        status: 500,
        headers: { "Content-Type": "application/json" },
      });
    }
  }
}

// Main Worker handler
export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise {
    const url = new URL(request.url);

    // Route requests to Durable Objects for session management
    if (url.pathname.startsWith("/sessions")) {
      const sessionId = url.pathname.split("/sessions/")[1];
      if (!sessionId) {
        return new Response(JSON.stringify({ error: "Missing session ID" }), {
          status: 400,
          headers: { "Content-Type": "application/json" },
        });
      }

      // Get Durable Object stub for the session
      const id = env.USER_SESSIONS.idFromName(sessionId);
      const stub = env.USER_SESSIONS.get(id);

      return stub.fetch(request);
    }

    // Handle static edge responses for non-session routes
    if (url.pathname === "/health") {
      return new Response(JSON.stringify({ status: "healthy", version: "3.2" }), {
        status: 200,
        headers: { "Content-Type": "application/json" },
      });
    }

    return new Response(JSON.stringify({ error: "Not found" }), {
      status: 404,
      headers: { "Content-Type": "application/json" },
    });
  },
};

// Environment interface for type safety
interface Env {
  USER_SESSIONS: DurableObjectNamespace;
}

// AWS CDK 2026 configuration for Lambda with Provisioned Concurrency v3
import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";

const function_ = new lambda.Function(this, "StartupApiFunction", {
  runtime: lambda.Runtime.NODEJS_22_X,
  handler: "index.handler",
  code: lambda.Code.fromAsset("lambda"),
  memorySize: 1024,
  timeout: cdk.Duration.minutes(15),
});

// Configure Provisioned Concurrency v3 with scheduled scaling
const version = function_.currentVersion;
const alias = new lambda.Alias(this, "ProdAlias", {
  aliasName: "prod",
  version: version,
  provisionedConcurrencyConfig: {
    provisionedConcurrentExecutions: 50,
  },
});

// Scheduled scaling to reduce concurrency off-hours
new lambda.CfnScalingSchedule(this, "OffHoursScaling", {
  functionName: function_.functionName,
  qualifier: alias.aliasName,
  scalingSchedule: {
    schedule: "cron(0 22 ? * MON-FRI *)", // 10pm weekdays
    targetValue: 5,
  },
});

// Durable Object for real-time leaderboard
export class Leaderboard extends DurableObject {
  async updateScore(userId: string, score: number): Promise {
    const current = await this.storage.get(userId) || 0;
    if (score > current) {
      await this.storage.put(userId, score);
    }
  }

  async getTop10(): Promise> {
    const allScores = await this.storage.list();
    return Array.from(allScores.entries())
      .map(([userId, score]) => ({ userId, score }))
      .sort((a, b) => b.score - a.score)
      .slice(0, 10);
  }
}

// Worker for edge routing and auth
export default {
  async fetch(request: Request, env: Env): Promise {
    const url = new URL(request.url);

    // Auth check via Cloudflare Access
    const jwt = request.headers.get("Cf-Access-Jwt-Assertion");
    if (!jwt && url.pathname.startsWith("/api")) {
      return new Response("Unauthorized", { status: 401 });
    }

    // Route to Lambda for API requests
    if (url.pathname.startsWith("/api")) {
      const lambdaUrl = "https://api.startup.com";
      return fetch(`${lambdaUrl}${url.pathname}`, {
        method: request.method,
        headers: request.headers,
        body: request.body,
      });
    }

    // Route to R2 for static assets
    if (url.pathname.startsWith("/static")) {
      return env.STATIC_ASSETS.fetch(request);
    }

    return new Response("Not found", { status: 404 });
  },
};