Pattern 2: EKS Control Plane → Kubelet (port 10250)

Pattern 2: EKS Control Plane → Kubelet (port 10250) A sequence diagram generated by Archify. 1. Open connection to node IP 10.80.0.2:10250 Node IP is retrieved from the node status object 2. Routed inside the Cluster VPC 3. 10.80.0.0/16 [static] via Gateway VPC route table lookup 4→5. Crosses the boundary via Direct Connect or VPN 6. 10.80.0.0/16 [local] via eth0 → port 10250 Used for kubectl logs · exec · port-forward AWS — Region · Cluster VPC 10.0.0.0/16 Cloud boundary — Direct Connect or VPN On-prem environment — Remote Node CIDR 10.80.0.0/16 EKS CP · API server · Sequence participant EKS CP API server CP ENI · 10.0.0.132 · Sequence participant CP ENI 10.0.0.132 VPC Router · VPC 10.0.0.0/16 · Sequence participant VPC Router VPC 10.0.0.0/16 Gateway · Direct Connect / VPN · Sequence participant Gateway Direct Connect / VPN On-prem Router · on-prem 10.80.0.0/16 · Sequence participant On-prem Router on-prem 10.80.0.0/16 kubelet · Hybrid Node 10.80.0.2 · Sequence participant kubelet Hybrid Node 10.80.0.2 Legend Reaches kubelet DX/VPN crossing In-VPC routing

VPC route table

  • • 10.0.0.0/16 [local]
  • • 10.80.0.0/16 [static] via Gateway
  • • 10.85.0.0/16 [static] via Gateway

On-prem routing table

  • • 10.80.0.0/16 [local] via eth0
  • • 10.0.0.0/16 [static] via Gateway
  • • 10.85.1.0/24 · 10.85.2.0/24 [dynamic] via each Hybrid Node

Operations that use this path

  • • kubectl logs / kubectl exec / kubectl port-forward
  • • The API server initiates the connection, so the on-prem firewall must allow inbound 10250/TCP
  • • Only the node CIDR (10.80.0.0/16) needs to be routable; the pod CIDR is not required