EKS Networking Architecture Overview

EKS Networking Architecture Overview An architecture diagram generated by Archify. Internet · Clients · Architecture component Internet Clients Internet Gateway · VPC entry point · VPC (10.0.0.0/16) Internet Gateway VPC entry point Application Load Balancer · Public subnet · VPC (10.0.0.0/16) Application Load Balancer Public subnet NAT Gateway · Public subnet · VPC (10.0.0.0/16) NAT Gateway Public subnet Worker Nodes · Private subnet · pods · VPC (10.0.0.0/16) Worker Nodes Private subnet · pods VPC Endpoints · PrivateLink · VPC (10.0.0.0/16) VPC Endpoints PrivateLink S3 · ECR · STS · AWS services · Architecture component S3 · ECR · STS AWS services EKS Control Plane · AWS-managed account · Architecture component EKS Control Plane AWS-managed account Inbound HTTP(S) Target group Outbound SNAT Egress to internet kubelet ↔ API (443) AWS API calls Private connectivity VPC (10.0.0.0/16) Legend Backend Database Cloud Security External

Traffic paths

  • • Inbound: internet → IGW → ALB/NLB in the public subnet → worker nodes in the private subnet
  • • Outbound: worker nodes → NAT Gateway → IGW → internet
  • • Control plane: worker nodes talk directly to the EKS API server on port 443

Private connectivity

  • • S3 uses a gateway endpoint; ECR, EKS, and STS use interface endpoints
  • • VPC endpoints cut NAT Gateway data-processing charges
  • • Placing worker nodes in private subnets is the baseline security design