Deloitte Cut Kubernetes Test Environment Provisioning From 45 Minutes to Under 5

Deloitte’s QA teams were provisioning dedicated Amazon EKS clusters for each ephemeral testing need — a process that took 30 to 45 minutes per environment and generated redundant load balancers, DNS configurations, and monitoring agents across every run. After moving to vCluster virtual clusters on a shared EKS host, provisioning now takes under five minutes, without platform team involvement.

The root problem isn’t unique to Deloitte. As Kubernetes adoption scales inside large organizations, the default pattern of spinning up dedicated clusters for each team or testing scenario creates infrastructure overhead that compounds faster than engineering headcount does. Separate clusters mean separate control planes, separate tooling deployments, and separate IAM configurations. The cost isn’t just money — it’s the accumulated coordination overhead that slows CI/CD pipelines and adds friction to every test cycle.

vCluster solves this by virtualizing the Kubernetes control plane rather than the infrastructure. A vCluster runs as a pod inside a namespace on a real host cluster — in Deloitte’s case, an EKS cluster with Auto Mode enabled. From the tenant’s perspective, the virtual cluster behaves as a fully functional independent Kubernetes environment with its own API server, scheduler, and controller manager. From the host’s perspective, it’s just workloads running in a namespace. Shared infrastructure components — ingress controllers, storage provisioners, monitoring agents — are deployed once on the host and made available to all virtual clusters, eliminating the per-environment duplication.

Deloitte’s specific configuration runs 50+ virtual clusters on a single shared 12-node EKS host. Each virtual cluster provisions in under five minutes without touching kubectl or filing a platform team ticket. The architecture uses Application Load Balancer with path-based routing to direct traffic across multiple virtual environments through a single entry point, AWS Certificate Manager for HTTPS termination, and EBS CSI with gp3 encryption for persistent storage. AWS Architecture Blog documents the result as 89% faster provisioning and 500 annual hours recovered from QA team time previously spent on setup and teardown. Adding EC2 Spot Instances to the host cluster brings an additional 70% cost reduction on compute.

The pattern also addresses the access management complexity that scales badly with dedicated clusters. Multiple clusters mean multiple IAM roles, multiple RBAC configurations, and multiple audit surfaces. vCluster consolidates that surface: the host cluster manages the underlying permissions, and the virtual cluster inherits a clean, isolated Kubernetes RBAC environment for each tenant team.

For platform teams already managing Kubernetes hidden costs through virtual clusters, the Deloitte case provides concrete production metrics at enterprise scale. The 45-minute-to-5-minute improvement isn’t a benchmark number — it’s the measured outcome of a team that previously submitted provisioning requests and waited. The shift from request-and-wait to self-service is the operational change that matters: QA engineers can now create and destroy environments on demand within a single sprint cycle. Platform teams using EKS Auto Mode will find the integration straightforward — Auto Mode handles node provisioning, and vCluster sits above that layer.

Photo by Pachon in Motion on Pexels

Source: AWS Architecture Blog

Content created with AI assistance and reviewed for accuracy.