VPC networking and isolation

EKS networking connects Pods, nodes, load balancers, AWS services, the internet, and private data centers.

Address planning

With the Amazon VPC CNI, Pods normally receive VPC IP addresses. Estimate Pods per node, ENI limits, subnets, growth, peering, hybrid networks, and future clusters. Prefix delegation, IPv6, or secondary CIDRs can improve scale, but they do not excuse late planning.

Use at least two Availability Zones. Size private subnets for nodes and Pods and public subnets only for internet-facing load balancers when required.

Private clusters and egress

Restrict the Kubernetes API endpoint using private access and controlled public CIDRs, or private-only access when operations paths support it. Private nodes need designed routes to ECR, S3, STS, CloudWatch, and other services through VPC endpoints or NAT. “Private” does not mean “no dependencies.”

Three policy layers

1. Security groups control ENI-level flows.
2. Security Groups for Pods can give selected Pods AWS security-group rules.
3. Kubernetes NetworkPolicy controls Pod communication when an enforcing implementation is enabled. Start default-deny and allow required DNS, ingress, egress, identity, metrics, and data paths.

Troubleshooting order

Check DNS, Service/endpoints, NetworkPolicy, security groups, NACLs, routes, subnet IPs, NAT/endpoints, load-balancer health, and application listeners.

Feynman check

A Pod IP is like an apartment number in the VPC. The Service is the permanent reception desk. Network policies and security groups decide which visitors can reach which doors.