Pattern 3: Pod → EKS Control Plane

Pattern 3: Pod → EKS Control Plane A sequence diagram generated by Archify. 1. dst 172.16.0.1 (kubernetes Service) 2. With CNI NAT, SNAT: src → 10.80.0.2 3. DNAT: 172.16.0.1 → CP ENI 10.0.0.132 4. 10.0.0.0/16 [static] via Gateway 5. Cross boundary via VPN / DX 6–7. 10.0.0.0/16 [local] → CP ENI dst 10.80.0.2 · 10.80.0.0/16 [static] via Gateway Arrives at node IP · CNI reverses SNAT, delivers to pod dst 10.85.1.56 · needs 10.85.0.0/16 [static] via Gateway 10.85.1.0/24 [dynamic] via 10.80.0.2 · pod CIDR reverse route Request path (hops 1–7) Return · with CNI NAT (SNAT) Return · without CNI NAT Pod · 10.85.1.56 · Sequence participant Pod 10.85.1.56 CNI · node 10.80.0.2 · Sequence participant CNI node 10.80.0.2 kube-proxy · iptables · Sequence participant kube-proxy iptables Router · on-premises · Sequence participant Router on-premises Gateway · VPN / DX · Sequence participant Gateway VPN / DX VPC Router · 10.0.0.0/16 · Sequence participant VPC Router 10.0.0.0/16 EKS CP · CP ENI 10.0.0.132 · Sequence participant EKS CP CP ENI 10.0.0.132 Legend NAT translation Return (with CNI NAT) Return (no CNI NAT) Request hop

Cluster VPC routing table

  • • 10.0.0.0/16 [local]
  • • 10.80.0.0/16 [static] via Gateway
  • • 10.85.0.0/16 [static] via Gateway — needed without CNI NAT

On-premises routing table

  • • 10.80.0.0/16 [local] via eth0
  • • 10.0.0.0/16 [static] via Gateway
  • • 10.85.1.0/24 [dynamic] via 10.80.0.2 · 10.85.2.0/24 [dynamic] via 10.80.0.3