EKS Control Plane Security

Hi,

A customer in the enterprise sector who is currently evaluating EKS. They have an internal security document and they need help answering the following questions:

• Can you customize the AMI for the control pane nodes?

I know it is possible to build custom AMI for the worker nodes but what about the control pane? My guess is that it isn't possible as part of the managed service offering but I want to double check.

• Can you activate AppArmor or SELinux on control pane nodes?

• Are the K8S components (api, scheduler, etc.) containerised on the control pane and can we limit the number of processes?

For the latter part I assume the answer is no, but I'm just curious about the first part.