EKS VPC Architecture

EKS VPC Architecture An architecture diagram generated by Archify. Internet · Architecture component Internet Internet Gateway · VPC Internet Gateway Public subnet AZ-a · Load balancers · VPC › Availability Zone a Public subnet AZ-a Load balancers NAT Gateway AZ-a · Outbound · VPC › Availability Zone a NAT Gateway AZ-a Outbound Private subnet AZ-a · EKS worker nodes · VPC › Availability Zone a Private subnet AZ-a EKS worker nodes Public subnet AZ-b · Load balancers · VPC › Availability Zone b Public subnet AZ-b Load balancers NAT Gateway AZ-b · Outbound · VPC › Availability Zone b NAT Gateway AZ-b Outbound Private subnet AZ-b · EKS worker nodes · VPC › Availability Zone b Private subnet AZ-b EKS worker nodes Inbound · outbound 0.0.0.0/0 0.0.0.0/0 VPC Availability Zone a Availability Zone b Legend Backend Cloud External

What eksctl builds

  • • By default it creates one VPC, a public and private subnet per AZ, and a NAT Gateway per AZ
  • • Load balancers go in the public subnets and worker nodes in the private ones
  • • It also applies the subnet tags (role/elb, role/internal-elb) for you

If you build it yourself

  • • At least two AZs, plus DNS hostnames and DNS resolution enabled, are mandatory
  • • A private subnet's 0.0.0.0/0 must point at the NAT Gateway in the same AZ
  • • To reuse an existing VPC, list the subnet IDs under vpc.subnets in the eksctl config

Cost considerations

  • • A NAT Gateway per AZ raises availability but multiplies the hourly charge
  • • A single NAT Gateway (--vpc-nat-mode=Single) costs less but is exposed to AZ failure
  • • Routing ECR and S3 traffic through VPC endpoints cuts NAT processing charges