Opinion: You Should Learn Kubernetes 1.32 and AWS Graviton4 to Get a Staff Engineer Role in 2026

// k8s-graviton-check.go
// Validates that all Graviton4 nodes in a Kubernetes 1.32+ cluster run supported kubelet versions
// Requires: go 1.22+, kubernetes/client-go v1.32.0+
package main

import (
    \"context\"
    \"flag\"
    \"fmt\"
    \"os\"
    \"path/filepath\"
    \"strings\"

    v1 \"k8s.io/apimachinery/pkg/apis/meta/v1\"
    \"k8s.io/client-go/kubernetes\"
    \"k8s.io/client-go/tools/clientcmd\"
    \"k8s.io/client-go/util/homedir\"
)

const (
    minKubeletVersion = \"v1.32.0\"
    graviton4LabelKey = \"node.kubernetes.io/instance-type\"
    graviton4Prefix   = \"graviton4\"
)

func main() {
    var kubeconfig *string
    if home := homedir.HomeDir(); home != \"\" {
        kubeconfig = flag.String(\"kubeconfig\", filepath.Join(home, \".kube\", \"config\"), \"(optional) absolute path to kubeconfig\")
    } else {
        kubeconfig = flag.String(\"kubeconfig\", \"\", \"absolute path to kubeconfig\")
    }
    flag.Parse()

    // Validate kubeconfig path exists if provided
    if *kubeconfig != \"\" {
        if _, err := os.Stat(*kubeconfig); os.IsNotExist(err) {
            fmt.Fprintf(os.Stderr, \"Error: kubeconfig file %s does not exist\n\", *kubeconfig)
            os.Exit(1)
        }
    }

    // Build config from kubeconfig or in-cluster config
    config, err := clientcmd.BuildConfigFromFlags(\"\", *kubeconfig)
    if err != nil {
        // Fall back to in-cluster config for pod execution
        config, err = clientcmd.BuildConfigFromFlags(\"\", \"\")
        if err != nil {
            fmt.Fprintf(os.Stderr, \"Error building kubeconfig: %v\n\", err)
            os.Exit(1)
        }
    }

    // Create clientset
    clientset, err := kubernetes.NewForConfig(config)
    if err != nil {
        fmt.Fprintf(os.Stderr, \"Error creating kubernetes clientset: %v\n\", err)
        os.Exit(1)
    }

    // List all nodes in the cluster
    nodes, err := clientset.CoreV1().Nodes().List(context.Background(), v1.ListOptions{})
    if err != nil {
        fmt.Fprintf(os.Stderr, \"Error listing nodes: %v\n\", err)
        os.Exit(1)
    }

    if len(nodes.Items) == 0 {
        fmt.Println(\"No nodes found in cluster\")
        os.Exit(0)
    }

    fmt.Printf(\"Found %d nodes total. Checking Graviton4 nodes for K8s 1.32+ compatibility...\n\", len(nodes.Items))
    gravitonNodeCount := 0
    invalidNodeCount := 0

    for _, node := range nodes.Items {
        instanceType, exists := node.Labels[graviton4LabelKey]
        if !exists {
            continue
        }
        // Check if instance type is Graviton4 (AWS labels instance types as e.g., m8g.medium for Graviton4)
        if !strings.HasPrefix(strings.ToLower(instanceType), graviton4Prefix) {
            continue
        }
        gravitonNodeCount++

        // Get kubelet version from node status
        kubeletVersion := node.Status.NodeInfo.KubeletVersion
        if kubeletVersion == \"\" {
            fmt.Fprintf(os.Stderr, \"Warning: Node %s has no kubelet version reported\n\", node.Name)
            invalidNodeCount++
            continue
        }

        // Compare versions (simplified: check if version starts with v1.32 or higher)
        if !strings.HasPrefix(kubeletVersion, \"v1.32.\") && !strings.HasPrefix(kubeletVersion, \"v1.33.\") {
            fmt.Fprintf(os.Stderr, \"Invalid: Node %s (Graviton4, %s) runs kubelet %s, requires >= %s\n\",
                node.Name, instanceType, kubeletVersion, minKubeletVersion)
            invalidNodeCount++
        } else {
            fmt.Printf(\"Valid: Node %s (Graviton4, %s) runs kubelet %s\n\", node.Name, instanceType, kubeletVersion)
        }
    }

    fmt.Printf(\"\nSummary: %d Graviton4 nodes found, %d invalid (kubelet < %s)\n\",
        gravitonNodeCount, invalidNodeCount, minKubeletVersion)
    if invalidNodeCount > 0 {
        os.Exit(1)
    }
}

\"\"\"
provision_eks_graviton.py
Provisions an AWS EKS 1.32 cluster with Graviton4 managed node groups, estimates monthly costs
Requires: boto3>=1.34.0, python>=3.10
\"\"\"

import argparse
import json
import sys
import time
from typing import Dict, List

import boto3
from botocore.exceptions import ClientError, NoCredentialsError

# Constants
EKS_VERSION = \"1.32\"
GRAVITON4_INSTANCE_TYPES = [\"m8g.medium\", \"m8g.large\", \"c8g.xlarge\", \"r8g.2xlarge\"]
CLUSTER_ROLE_ARN = \"arn:aws:iam::123456789012:role/EKSClusterRole\"  # Replace with your role
NODE_ROLE_ARN = \"arn:aws:iam::123456789012:role/EKSNodeRole\"        # Replace with your role
REGION = \"us-east-1\"

def get_boto3_client(service: str, region: str = REGION) -> boto3.client:
    \"\"\"Initialize and return a boto3 client with error handling.\"\"\"
    try:
        return boto3.client(service, region_name=region)
    except NoCredentialsError:
        print(\"Error: AWS credentials not found. Configure via AWS CLI or environment variables.\", file=sys.stderr)
        sys.exit(1)

def estimate_monthly_cost(instance_types: List[str], node_count: int) -> float:
    \"\"\"Estimate monthly cost for Graviton4 node group using AWS Pricing API.\"\"\"
    pricing_client = get_boto3_client(\"pricing\", region=\"us-east-1\")  # Pricing API only in us-east-1
    total_cost = 0.0

    for instance_type in instance_types:
        try:
            response = pricing_client.get_products(
                ServiceCode=\"AmazonEC2\",
                Filters=[
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"instanceType\", \"Value\": instance_type},
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"operatingSystem\", \"Value\": \"Linux\"},
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"preInstalledSw\", \"Value\": \"NA\"},
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"location\", \"Value\": \"US East (N. Virginia)\"},
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"tenancy\", \"Value\": \"Shared\"},
                    {\"Type\": \"TERM_MATCH\", \"Field\": \"capacitystatus\", \"Value\": \"Used\"},
                ],
                MaxResults=1
            )
        except ClientError as e:
            print(f\"Warning: Could not fetch pricing for {instance_type}: {e}\", file=sys.stderr)
            continue

        if not response.get(\"PriceList\"):
            print(f\"Warning: No pricing data found for {instance_type}\", file=sys.stderr)
            continue

        # Parse price (simplified: take on-demand hourly price)
        product = json.loads(response[\"PriceList\"][0])
        terms = product.get(\"terms\", {}).get(\"OnDemand\", {})
        for term_id, term_data in terms.items():
            for price_dimension_id, price_dimension in term_data.get(\"priceDimensions\", {}).items():
                hourly_price = float(price_dimension.get(\"pricePerUnit\", {}).get(\"USD\", 0))
                total_cost += hourly_price * 730  # 730 hours per month average

    return total_cost * node_count

def create_eks_cluster(cluster_name: str) -> bool:
    \"\"\"Create EKS 1.32 cluster with basic VPC configuration.\"\"\"
    eks_client = get_boto3_client(\"eks\")
    ec2_client = get_boto3_client(\"ec2\")

    # Get default VPC and subnets
    try:
        vpcs = ec2_client.describe_vpcs(Filters=[{\"Name\": \"isDefault\", \"Values\": [\"true\"]}])
        if not vpcs[\"Vpcs\"]:
            print(\"Error: No default VPC found. Create a VPC first.\", file=sys.stderr)
            return False
        vpc_id = vpcs[\"Vpcs\"][0][\"VpcId\"]
        subnets = ec2_client.describe_subnets(Filters=[{\"Name\": \"vpc-id\", \"Values\": [vpc_id]}])
        subnet_ids = [subnet[\"SubnetId\"] for subnet in subnets[\"Subnets\"]]
        if len(subnet_ids) < 2:
            print(\"Error: Need at least 2 subnets in different AZs for EKS\", file=sys.stderr)
            return False
    except ClientError as e:
        print(f\"Error fetching VPC config: {e}\", file=sys.stderr)
        return False

    # Create cluster
    try:
        print(f\"Creating EKS {EKS_VERSION} cluster {cluster_name}...\")
        eks_client.create_cluster(
            name=cluster_name,
            version=EKS_VERSION,
            roleArn=CLUSTER_ROLE_ARN,
            resourcesVpcConfig={\"subnetIds\": subnet_ids, \"endpointPublicAccess\": True},
            tags={\"Purpose\": \"Graviton4-Staff-Prep\", \"ManagedBy\": \"provision_eks_graviton.py\"}
        )
    except ClientError as e:
        if e.response[\"Error\"][\"Code\"] == \"ResourceInUseException\":
            print(f\"Cluster {cluster_name} already exists, skipping creation\")
            return True
        print(f\"Error creating cluster: {e}\", file=sys.stderr)
        return False

    # Wait for cluster to be active
    print(\"Waiting for cluster to become active (up to 15 minutes)...\")
    waiter = eks_client.get_waiter(\"cluster_active\")
    try:
        waiter.wait(name=cluster_name, WaiterConfig={\"Delay\": 30, \"MaxAttempts\": 30})
    except Exception as e:
        print(f\"Cluster creation timed out or failed: {e}\", file=sys.stderr)
        return False

    print(f\"Cluster {cluster_name} is active\")
    return True

def create_graviton_node_group(cluster_name: str, node_group_name: str, instance_types: List[str], node_count: int) -> bool:
    \"\"\"Create Graviton4 managed node group for EKS cluster.\"\"\"
    eks_client = get_boto3_client(\"eks\")

    try:
        print(f\"Creating Graviton4 node group {node_group_name} with {node_count} nodes...\")
        eks_client.create_nodegroup(
            clusterName=cluster_name,
            nodegroupName=node_group_name,
            nodeRole=NODE_ROLE_ARN,
            subnets=subnet_ids,  # Reuse subnets from cluster creation (pass as arg in real implementation)
            instanceTypes=instance_types,
            scalingConfig={\"minSize\": 1, \"maxSize\": node_count * 2, \"desiredSize\": node_count},
            amiType=\"AL2023_ARM_64\",  # Amazon Linux 2023 for ARM (Graviton)
            tags={\"InstanceType\": \"Graviton4\", \"K8sVersion\": EKS_VERSION}
        )
    except ClientError as e:
        print(f\"Error creating node group: {e}\", file=sys.stderr)
        return False

    # Wait for node group to be active
    print(\"Waiting for node group to become active (up to 10 minutes)...\")
    waiter = eks_client.get_waiter(\"nodegroup_active\")
    try:
        waiter.wait(clusterName=cluster_name, nodegroupName=node_group_name, WaiterConfig={\"Delay\": 30, \"MaxAttempts\": 20})
    except Exception as e:
        print(f\"Node group creation timed out or failed: {e}\", file=sys.stderr)
        return False

    print(f\"Node group {node_group_name} is active\")
    return True

def main():
    parser = argparse.ArgumentParser(description=\"Provision EKS 1.32 cluster with Graviton4 nodes\")
    parser.add_argument(\"--cluster-name\", required=True, help=\"Name of the EKS cluster\")
    parser.add_argument(\"--node-group-name\", default=\"graviton4-workers\", help=\"Name of the node group\")
    parser.add_argument(\"--instance-types\", nargs=\"+\", default=GRAVITON4_INSTANCE_TYPES[:2],
                        help=\"Graviton4 instance types to use\")
    parser.add_argument(\"--node-count\", type=int, default=2, help=\"Desired number of nodes\")
    args = parser.parse_args()

    # Step 1: Create cluster
    if not create_eks_cluster(args.cluster_name):
        sys.exit(1)

    # Step 2: Create node group (simplified: reuse subnet_ids from cluster creation)
    # In real implementation, fetch subnet_ids from cluster config
    ec2_client = get_boto3_client(\"ec2\")
    vpcs = ec2_client.describe_vpcs(Filters=[{\"Name\": \"isDefault\", \"Values\": [\"true\"]}])
    vpc_id = vpcs[\"Vpcs\"][0][\"VpcId\"]
    subnets = ec2_client.describe_subnets(Filters=[{\"Name\": \"vpc-id\", \"Values\": [vpc_id]}])
    subnet_ids = [subnet[\"SubnetId\"] for subnet in subnets[\"Subnets\"]]

    if not create_graviton_node_group(args.cluster_name, args.node_group_name, args.instance_types, args.node_count):
        sys.exit(1)

    # Step 3: Estimate cost
    monthly_cost = estimate_monthly_cost(args.instance_types, args.node_count)
    print(f\"\nEstimated monthly cost for {args.node_count} nodes: ${monthly_cost:.2f}\")
    print(f\"To delete resources: aws eks delete-nodegroup --cluster-name {args.cluster_name} --nodegroup-name {args.node_group_name}\")
    print(f\"Then: aws eks delete-cluster --name {args.cluster_name}\")

if __name__ == \"__main__\":
    main()

// graviton-deployment.ts
// AWS CDK app defining a Kubernetes 1.32 deployment optimized for AWS Graviton4
// Requires: aws-cdk>=2.150.0, typescript>=5.0, Node.js>=18
import * as cdk from 'aws-cdk-lib';
import * as eks from 'aws-cdk-lib/aws-eks';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

// Graviton4-optimized deployment stack
export class GravitonK8s132Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. Create VPC for EKS cluster
    const vpc = new ec2.Vpc(this, 'GravitonEksVpc', {
      maxAzs: 3,
      natGateways: 1, // Cost-optimized for dev/test
      subnetConfiguration: [
        {
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        },
      ],
    });

    // 2. Create IAM roles for EKS cluster and nodes
    const clusterRole = new iam.Role(this, 'EksClusterRole', {
      assumedBy: new iam.ServicePrincipal('eks.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEKSClusterPolicy'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEKSVPCResourceController'),
      ],
    });

    const nodeRole = new iam.Role(this, 'EksNodeRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEKSWorkerNodePolicy'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEKS_CNI_Policy'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryReadOnly'),
      ],
    });

    // 3. Create EKS 1.32 cluster
    const cluster = new eks.Cluster(this, 'GravitonEksCluster', {
      version: eks.KubernetesVersion.V1_32,
      vpc: vpc,
      role: clusterRole,
      defaultCapacity: 0, // We'll add Graviton node group manually
      endpointAccess: eks.EndpointAccess.PUBLIC_AND_PRIVATE,
      clusterName: 'staff-prep-eks-132',
    });

    // 4. Add Graviton4 managed node group
    cluster.addNodegroupCapacity('Graviton4NodeGroup', {
      instanceTypes: [ec2.InstanceType.of(ec2.InstanceClass.M8G, ec2.InstanceSize.LARGE)], // Graviton4 M8g.large
      minSize: 2,
      maxSize: 5,
      desiredSize: 3,
      nodeRole: nodeRole,
      amiType: eks.NodeAmiType.AL2023_ARM_64, // ARM64 AMI for Graviton
      labels: {
        'workload-type': 'graviton-optimized',
        'k8s-version': '1.32',
      },
      tags: {
        'CostCenter': 'StaffPrep',
        'InstanceFamily': 'Graviton4',
      },
    });

    // 5. Define Graviton4-optimized deployment manifest
    const appLabels = { app: 'graviton-web-app' };
    const deployment = {
      apiVersion: 'apps/v1',
      kind: 'Deployment',
      metadata: { name: 'graviton-web-deployment', namespace: 'default' },
      spec: {
        replicas: 3,
        selector: { matchLabels: appLabels },
        template: {
          metadata: { labels: appLabels },
          spec: {
            nodeSelector: {
              'beta.kubernetes.io/instance-type': 'm8g.large', // Pin to Graviton4
            },
            containers: [
              {
                name: 'web-app',
                image: 'public.ecr.aws/nginx/nginx:1.25-alpine-arm64', // ARM64-compatible image
                ports: [{ containerPort: 80 }],
                resources: {
                  requests: { cpu: '500m', memory: '1Gi' },
                  limits: { cpu: '1', memory: '2Gi' },
                },
                livenessProbe: {
                  httpGet: { path: '/', port: 80 },
                  initialDelaySeconds: 30,
                  periodSeconds: 10,
                },
                readinessProbe: {
                  httpGet: { path: '/', port: 80 },
                  initialDelaySeconds: 5,
                  periodSeconds: 5,
                },
              },
            ],
            affinity: {
              nodeAffinity: {
                requiredDuringSchedulingIgnoredDuringExecution: {
                  nodeSelectorTerms: [
                    {
                      matchExpressions: [
                        {
                          key: 'node.kubernetes.io/instance-type',
                          operator: 'In',
                          values: ['m8g.large', 'm8g.xlarge', 'c8g.large'],
                        },
                      ],
                    },
                  ],
                },
              },
            },
          },
        },
      },
    };

    // 6. Add deployment to cluster
    cluster.addManifest('GravitonWebDeployment', deployment);

    // 7. Add service to expose the deployment
    const service = {
      apiVersion: 'v1',
      kind: 'Service',
      metadata: { name: 'graviton-web-service', namespace: 'default' },
      spec: {
        selector: appLabels,
        ports: [{ port: 80, targetPort: 80 }],
        type: 'LoadBalancer',
      },
    };
    cluster.addManifest('GravitonWebService', service);

    // Output cluster endpoint and service URL
    new cdk.CfnOutput(this, 'ClusterEndpoint', { value: cluster.clusterEndpoint });
    new cdk.CfnOutput(this, 'ServiceUrl', {
      value: `http://${cluster.getServiceLoadBalancerAddress('graviton-web-service')}`,
    });
  }
}

// App initialization
const app = new cdk.App();
new GravitonK8s132Stack(app, 'GravitonK8s132Stack', {
  env: { region: 'us-east-1' },
});
app.synth();

# Kubelet configuration snippet for Graviton4 nodes (kubelet.conf)
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
featureGates:
  MemoryManager: true
  TopologyManager: true
topologyManagerPolicy: single-numa-node
memoryManagerPolicy:
  name: Static
reservedMemory:
  - numaNode: 0
    limits:
      memory: 1Gi

# GitHub Actions workflow snippet to build multi-arch ARM64 image
name: Build Multi-Arch Image
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
      - name: Build and push multi-arch image
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ secrets.ECR_REGISTRY }}/myapp:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# Prometheus scrape config for Graviton4 kubelet metrics (k8s 1.32+)
scrape_configs:
  - job_name: 'graviton4-kubelet'
    kubernetes_sd_configs:
      - role: node
    scheme: https
    tls_config:
      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
    relabel_configs:
      - source_labels: [__address__]
        regex: '(.*):10250'
        target_label: __address__
        replacement: '${1}:10255' # Kubelet read-only port for metrics
      - source_labels: [node_labels_instance_type]
        regex: 'm8g.*|c8g.*|r8g.*'
        action: keep # Only scrape Graviton4 nodes
      - source_labels: [node_labels_instance_type]
        target_label: instance_type