~/ nmadiraju.com Amazon EKS · Security groups for Pods
arrow_back Back to nmadiraju
Visual Walkthrough · Amazon EKS networking

How Security Groups for Pods Work on Amazon EKS

Follow the payments Pod to its RDS database as it gets its own security group, then check yourself with 8 questions.

1Visual Walkthrough

An EKS node with a trunk ENI and a branch ENI giving the payments Pod its own security group to reach RDS On the left, the EKS control plane with the VPC resource controller and a SecurityGroupPolicy, and the cluster IAM role. In the VPC, node-1 (an m5.large) runs the kubelet, a web Pod, CoreDNS and the payments Pod, with a trunk ENI and a branch ENI. On the right, Amazon RDS payments-db and the security group rules. The walkthrough shows web reaching RDS through the node's group, the trunk ENI, a policy that skips running Pods, a branch ENI with sg-payments, DNS and probe rules, branch ENIs running out, and the two enforcing modes. EKS CONTROL PLANE VPC resource controller + webhook manages trunk/branch ENIs SecurityGroupPolicy payments-sgp ns payments podSelector: app=payments groupIds: sg-payments Cluster IAM role + AmazonEKSVPC- ResourceController VPC 10.0.0.0/16 PRIVATE SUBNET 10.0.1.0/24 · NODES DB SUBNET 10.0.3.0/24 node-1 · m5.large · 10.0.1.10 kubelet · ENI 1 10.0.1.10 primary ENI · sg-node web · ns shop 10.0.1.31 sg-node (node's ENI) CoreDNS 10.0.1.53:53 sg-node (node's ENI) Trunk ENI aws-k8s-trunk-eni Branch ENI aws-k8s-branch-eni sg-payments payments 10.0.1.40 sg-node (node's ENI) node-2 · m5.large · 10.0.1.11 payments Pod 10 · own branch ENI · sg-payments its trunk ENI: 9 more branch slots Amazon RDS payments-db 10.0.3.20:5432 ITS SG ALLOWS IN Security group rules SG-PAYMENTS (THE POD) SG-NODE (THE NODES) RDS is in its own sg-db

    2Quiz to check understanding

    Check yourself