Private Cluster Access via Transit Gateway

Private Cluster Access via Transit Gateway An architecture diagram generated by Archify. Admin Workstation · kubectl client · On-Premises Admin Workstation kubectl client Direct Connect · or Site-to-Site VPN · AWS Direct Connect or Site-to-Site VPN Transit Gateway · on-prem ↔ VPC routing · AWS Transit Gateway on-prem ↔ VPC routing EKS VPC · private subnets · AWS EKS VPC private subnets EKS Cluster · Private Endpoint (API server) · AWS EKS Cluster Private Endpoint (API server) kubectl (HTTPS 443) On-Premises AWS Legend Backend Cloud External

Private Endpoint Access Patterns

  • • Private-only clusters are reachable only via VPN, Direct Connect, or a bastion host
  • • Transit Gateway links the on-premises network to the EKS VPC
  • • Alternatives: direct Site-to-Site VPN, SSM Session Manager port forwarding