~/ nmadiraju.com Amazon EKS · Prefix delegation and custom networking
arrow_back Back to nmadiraju
Visual Walkthrough · Amazon EKS networking

How Prefix Delegation and Custom Networking Work on Amazon EKS

Follow node group ng-web on m5.large as it runs out of Pod IPs, then check yourself with 8 questions.

1Visual Walkthrough

An EKS node's ENIs, its subnet split into /28 blocks, and a secondary pod CIDR with ENIConfigs A VPC with private subnet 10.0.1.0/24 holding an m5.large node with three ENIs, the aws-node agent and its settings, and a map of the subnet as 16 /28 blocks; a secondary CIDR 100.64.0.0/16 with a pod subnet; ENIConfig objects per zone; the EC2 API and the internet. The walkthrough shows max pods at 29, raising max pods alone failing, prefix delegation, a fragmented subnet, a prefix reservation, the subnet running out, custom networking on new nodes, and SNAT to the node's IP. EC2 API assigns IPs and /28 prefixes Internet api.example.com via the NAT gateway PRIVATE SUBNET 10.0.1.0/24 · us-east-1a aws-node ipamd VPC CNI P P P 161616161616161616 1616161616 161616161616161616 161616161616161616 ContainerCreating 10.0.1.0/24 AS 16 BLOCKS OF /28 RESERVED · 10.0.1.128/25 SECONDARY CIDR 100.64.0.0/16 + 100.64.32.0/19 in us-east-1b POD SUBNET 100.64.0.0/19 · 1a 8,192 − 5 reserved = 8,187 usable holds Pod ENIs only, no nodes web-214 100.64.0.37 web-215 100.64.0.38 PRIVATE SUBNET 10.0.2.0/24 · us-east-1b node-2 · m5.large K8S API capacity ENIConfig us-east-1asubnet + SGs:100.64.0.0/19 ENIConfig us-east-1bsubnet + SGs:100.64.32.0/19

    2Quiz to check understanding

    Check yourself