~/ nmadiraju.com Amazon EKS · Private clusters and endpoint access
arrow_back Back to nmadiraju
Visual Walkthrough · Amazon EKS networking

How Private Clusters and Endpoint Access Work on Amazon EKS

Follow shop-prod from a public endpoint to a fully private cluster, then check yourself with 8 questions.

1Visual Walkthrough

An EKS cluster's public and private API endpoints, its VPC, and the VPC endpoints its nodes use The EKS control plane with a public endpoint and the API server; AWS service APIs (ECR, EC2, S3, STS and others) and Docker Hub; and the VPC with a NAT gateway, an EKS-managed Route 53 private hosted zone, the private endpoint's ENIs, two nodes, a route table and VPC endpoints. The walkthrough limits public access CIDRs, turns on the private endpoint, turns off public access, connects over a VPN, adds an access entry, removes the NAT gateway and adds VPC endpoints and an ECR pull through cache. admin laptop Client VPN or Direct Connect, a bastion or SSM EKS CONTROL PLANE · AWS-OWNED Public endpoint public access CIDRs OFF API server shop-prod IAM + access entries Docker Hub docker.io AWS SERVICE APIS · us-east-1 ECR image registry + pull cache EC2 ENIs and IPs for aws-node More STS · EKS Auth Logs · ELB S3 image layers VPC 10.0.0.0/16 PUBLIC SUBNET NAT gateway 203.0.113.10 its Elastic IP Route 53 private hosted zone, managed by EKS: API name → ENI private IPs PRIVATE SUBNETS 10.0.1.250 10.0.2.250 Private endpoint EKS-managed ENIs · cluster SG node-1 · 10.0.1.10 kubelet · aws-node · Pods node-2 · 10.0.2.20 kubelet · aws-node · Pods Private subnets' route table 10.0.0.0/16 → local VPC ENDPOINTS Interface endpoints SG: 443 from the nodes S3 gateway endpoint a route-table target, for ECR layers

    2Quiz to check understanding

    Check yourself