~/ nmadiraju.com Amazon EKS · VPC CNI
arrow_back Back to nmadiraju
Visual Walkthrough · Amazon EKS networking

How the VPC CNI Works on Amazon EKS

Follow Pod IPs from a node's ENIs to the limits of the node and the subnet, then check yourself with 8 questions.

1Visual Walkthrough

An EKS node's ENIs handing VPC IPs to Pods, with the subnet and a secondary pod CIDR A VPC with a private subnet holding node-1 (a t3.medium) and its aws-node agent, two ENIs and several Pods, plus a pod subnet in a secondary CIDR and an RDS database. The walkthrough shows warm IPs, a Pod getting a VPC IP, a second ENI attached through the EC2 API, max pods at 17, prefix delegation raising it to 110, the subnet running out, custom networking, and security groups on Pod traffic. EC2 API attaches ENIs, assigns IPs VPC · 10.0.0.0/16 + 100.64.0.0/16 PRIVATE SUBNET 10.0.1.0/24 POD SUBNET 100.64.0.0/19 secondary CIDR, via ENIConfig node-1 · t3.medium · 10.0.1.10 aws-node CNI plugin + ipamd keeps spare IPs warm ENI 1 (primary) 10.0.1.10 · the node ENI 2 attached by ipamd pod a 10.0.1.15 pod b 10.0.1.16 pod c 10.0.1.41 pod d 10.0.1.42 pod e 100.64.0.21 pod f 100.64.0.22 Amazon RDS 10.0.3.20:5432 allows the node security group

    Pod traffic IP management AWS resource (ENI, RDS, EC2 API) Pod or agent VPC and subnets

    Press Play to watch all eight steps, or step through with Back and Next. Red step tabs are where something breaks; green ones add the fix. Voice reads each step aloud with your browser's built-in speech.

    2Quiz to check understanding

    Check yourself