EKS Hybrid Nodes Gateway High-Level Architecture

EKS Hybrid Nodes Gateway High-Level Architecture An architecture diagram generated by Archify. API Server · EKS control plane · AWS Cloud · VPC (10.0.0.0/16) API Server EKS control plane VPC Route Table · 10.100.0.0/20 → leader ENI · AWS Cloud · VPC (10.0.0.0/16) VPC Route Table 10.100.0.0/20 → leader ENI VPC Pod · 10.0.x.x · VPC CNI node · AWS Cloud · VPC (10.0.0.0/16) VPC Pod 10.0.x.x · VPC CNI node Gateway EC2 + Gateway Pod · Leader · Subnet A · hybrid_vxlan0 · AWS Cloud · VPC (10.0.0.0/16) · Leader Gateway EC2 + Gateway Pod Leader · Subnet A · hybrid_vxlan0 Leader Gateway EC2 + Gateway Pod · Standby (follower) · Subnet B · AWS Cloud · VPC (10.0.0.0/16) · Standby Gateway EC2 + Gateway Pod Standby (follower) · Subnet B Standby Hybrid Node 1 · Cilium agent · Pod CIDR 10.100.0.0/24 · On-Premises Data Center (Direct Connect / VPN) Hybrid Node 1 Cilium agent · Pod CIDR 10.100.0.0/24 Hybrid Node 2 · Cilium agent · Pod CIDR 10.100.1.0/24 · On-Premises Data Center (Direct Connect / VPN) Hybrid Node 2 Cilium agent · Pod CIDR 10.100.1.0/24 VPC routing VXLAN tunnel · VNI 2, UDP 8472 VXLAN tunnel Automatic route programming Control plane ENI Lease leader election AWS Cloud · VPC (10.0.0.0/16) On-Premises Data Center (Direct Connect / VPN) Legend Backend Cloud External

Gateway

  • • Kubernetes Pod running on an EC2 instance (source/destination check disabled)
  • • 2-replica Deployment with Lease-based leader election

VXLAN tunnel

  • • hybrid_vxlan0 ↔ Cilium VTEP, VNI 2 / UDP 8472
  • • Encapsulated packets traverse Direct Connect or VPN

Routing

  • • Hybrid Pod CIDR → leader gateway ENI routes kept up to date in the VPC route table
  • • All replicas reconcile local entries from CiliumNode changes