Pattern 4: Control Plane → Webhook Pod

Pattern 4: Control Plane → Webhook Pod A sequence diagram generated by Archify. 1. Initiate webhook call → 10.85.1.23 The API server opens a direct connection to the webhook pod IP 2. Forward to VPC router 3. 10.85.0.0/16 [static] via Gateway 4. Cross boundary via VPN/DX 5. 10.85.1.0/24 [dynamic] via 10.80.0.2 6. Pass through iptables 7. Deliver to webhook pod AWS — Cluster VPC 10.0.0.0/16 Cloud boundary crossing On-premises — Remote Pod CIDR 10.85.0.0/16 EKS CP · API server · Sequence participant EKS CP API server CP ENI · 10.0.0.132 · Sequence participant CP ENI 10.0.0.132 Router · VPC 10.0.0.0/16 · Sequence participant Router VPC 10.0.0.0/16 Gateway · VPN / DX · Sequence participant Gateway VPN / DX On-prem · Router 10.80.0.0/16 · Sequence participant On-prem Router 10.80.0.0/16 Node · Hybrid · 10.80.0.2 · Sequence participant Node Hybrid · 10.80.0.2 CNI · 10.85.1.0/24 · Sequence participant CNI 10.85.1.0/24 Webhook · Pod 10.85.1.23 · Sequence participant Webhook Pod 10.85.1.23 Legend Webhook · TCP 8443+ Boundary · VPN/DX Routing hop

VPC route table

  • • 10.0.0.0/16 [local]
  • • 10.80.0.0/16 [static] via Gateway
  • • 10.85.0.0/16 [static] via Gateway

On-premises route table

  • • 10.80.0.0/16 [local] via eth0
  • • 10.0.0.0/16 [static] via Gateway
  • • 10.85.1.0/24 [dynamic] via 10.80.0.2
  • • 10.85.2.0/24 [dynamic] via 10.80.0.3

Requirements

  • • Requires a routable pod CIDR (AWS → On-Prem, TCP 8443+)
  • • If the on-premises pod CIDR is not routable, run all webhooks on cloud nodes
  • • The VPC route table must have a route for the remote pod CIDR