How EKS Networking Components Relate

How EKS Networking Components Relate A workflow diagram generated by Archify. 01 / Inbound Traffic 02 / Outbound Traffic 03 / Control Plane Communication Internet · Client requests · Inbound Traffic Internet Client requests Internet Gateway · VPC entry point · Inbound Traffic Internet Gateway VPC entry point Public Subnet · ALB / NLB · Inbound Traffic Public Subnet ALB / NLB Worker Nodes · Private subnet · Inbound Traffic Worker Nodes Private subnet NAT Gateway · SNAT translation · Outbound Traffic NAT Gateway SNAT translation EKS Control Plane · AWS-managed account · Control Plane Communication EKS Control Plane AWS-managed account 1 enters 2 routed to load balancer 3 target group forward 4 outbound 5 egress to internet 6 API calls (443) Legend Workload AWS service External

Inbound · outbound

  • • Inbound flows IGW → load balancer in the public subnet → worker nodes in the private subnet
  • • Outbound flows worker nodes → NAT Gateway → IGW → internet
  • • Worker nodes and the EKS control plane use a direct path governed by security groups

High-availability design

  • • Use at least two Availability Zones with a public and a private subnet in each
  • • Put a NAT Gateway in every AZ to remove the single point of failure
  • • Spread load balancers across multiple AZs

Security · cost

  • • Keep worker nodes in private subnets and apply least privilege to security groups
  • • Reach AWS services through VPC endpoints to cut NAT data-processing charges
  • • Minimize unnecessary cross-AZ traffic