Amazon EKS simplifies running Kubernetes on AWS, but VPC and subnet design directly affect security, performance, and cost. Understanding how your pods, services, and nodes communicate within your network is essential for reliable clusters.
This guide focuses on practical VPC and subnet considerations for Amazon EKS, covering planning, implementation patterns, and operational guidance. The table and sections below help you align networking choices with security and compliance requirements.
| Design Pattern | VPC CIDR | Subnet Targeting | Use Case Guidance |
|---|---|---|---|
| Public-Only | /16 | Public subnets in two AZs | Bastion, CI runners, non-sensitive workloads |
| Private with NAT | /16 | Private subnets for pods, public subnets for NAT | Standard production clusters, outbound internet access |
| Private with Transit Gateway | /16 | Isolated subnets, TGW attachment | Hybrid networks, centralized security appliances |
| Multi-VPC Peering | /16 per VPC | Matched peered subnets | Shared services, data plane isolation |
VPC Design for EKS Cluster Networking
The base VPC layout determines IP space, availability zone resilience, and connectivity options. A dedicated VPC for EKS reduces noisy neighbor risk and simplifies route management. Use non-overlapping RFC 1918 ranges that do not conflict on premises or with other clouds.
Plan subnets per availability zone to meet high availability requirements. For most production workloads, align at least two subnets per zone, with distinct roles such as public, private for nodes, and private for pods. This structure supports rolling updates and failure isolation.
CNI and Pod Networking Configuration
AWS VPC CNI assigns a primary Elastic Network Interface to each node and reserves IP addresses for pods ahead of assignment. Careful IP accounting against your VPC size prevents resource exhaustion as you scale nodes or pods. Monitor IP utilization in each subnet to avoid scheduling failures.
Placement groups are typically unnecessary for nodes, but you can optimize network throughput by choosing instance families with enhanced networking. Use security groups for pod-to-pod policies and network policies for application segmentation, rather than relying on subnet isolation alone.
Subnet Layout and Security Controls
Adopt a subnet per workload type pattern to enforce consistent security postures. Keep node subnets separate from pod subnets to limit lateral movement and apply least privilege via security group rules and network policies. Outbound access should be mediated by NAT gateways or managed transit endpoints.
Use private subnets for control plane exposure, and consider VPC endpoints for Kubernetes API access within the AWS network. This minimizes exposure of the API server and reduces dependence on public IPs for management operations.
Route Tables, Peering, and Connectivity
Route tables must direct internet-bound traffic from private subnets through NAT, and egress-only internet gateways for IPv6 if required. Align route propagation with your design, and test cross-subnet and cross-AZ traffic paths to validate expected latency and reliability.
For hybrid and multi-account designs, evaluate VPC peering or Transit Gateway. Ensure overlapping CIDR blocks are avoided, and manage route propagation to maintain deterministic path selection between on premises and EKS workloads.
Operational Recommendations for VPC and Subnet Management
- Map IP address usage per subnet and track pod density to prevent exhaustion.
- Standardize tagging across subnets, NAT gateways, and route tables for clarity and automation.
- Test network ACLs and security group rules in non-production before applying to critical workloads.
- Document route tables and peering connections, and review them during architecture reviews.
- Enable VPC flow logs and integrate with observability tools to detect anomalies quickly.
- Plan for high availability by distributing subnets across at least two availability zones.
FAQ
Reader questions
How do I determine the right VPC CIDR size for my EKS clusters?
Choose a CIDR that accommodates your current and future node, service, and pod IP needs while leaving room for growth. A /16 provides ample addresses for most deployments, but assess total pod IP density per node and across subnets to avoid later renumbering.
What are the best practices for mixing public and private subnets in an EKS VPC?
Place nodes and managed workloads in private subnets where possible, and restrict public subnets to bastion hosts, NAT gateways, and load balancers. Control inbound access with security groups and network ACLs, and minimize direct exposure of Kubernetes components to the internet.
How does subnet selection affect pod IP availability and scaling?
Each node subnets has a finite IP pool for both nodes and ENIs, while the AWS VPC CNI reserves pod IPs from the subnet CIDR. Monitor subnet utilization, plan for additional subnets before scaling limits, and use secondary CIDRs or IP address pools to sustain large pod densities.
Can I use VPC endpoints to protect traffic between EKS and AWS services?
Yes, interface endpoints for Amazon EKS API and private links for Elastic Load Balancer simplify traffic routing, reduce exposure to the public internet, and lower attack surface. Combine endpoint policies with least privilege IAM roles for secure service interaction.