EKS Hybrid Nodes Gateway Component Interaction

EKS Hybrid Nodes Gateway Component Interaction An architecture diagram generated by Archify. Gateway Pod · Cloud EC2 worker · Gateway controller / Kubernetes API state · all replicas Gateway Pod Cloud EC2 worker all replicas Lease · leader election · Gateway controller / Kubernetes API state Lease leader election CiliumNode · Every replica watches · Gateway controller / Kubernetes API state CiliumNode Every replica watches CiliumVTEPConfig · spec.endpoints · Gateway controller / Kubernetes API state CiliumVTEPConfig spec.endpoints hybrid_vxlan0 · tunnel endpoint · Data plane hybrid_vxlan0 tunnel endpoint Cilium Agent · hybrid node · Data plane Cilium Agent hybrid node VPC Route Table · pod CIDR routes · Data plane VPC Route Table pod CIDR routes Gateway ENI · EC2 network iface · Data plane Gateway ENI EC2 network iface election watch leader: endpoints FDB / ARP / routes leader: EC2 API read by VXLAN VNI 2 routes to forwards Gateway controller / Kubernetes API state Data plane Legend Backend Database Cloud External

Leader only

  • • Creates/replaces configured aggregate Pod-CIDR routes to its ENI
  • • Then updates endpoints: tunnelEndpoint, cidr and mac
  • • Runs on cloud EC2 workers, not in the managed control plane

Tunnel

  • • hybrid_vxlan0: VNI 2, UDP 8472, learning disabled
  • • Cilium VTEP encapsulates VPC-bound Pod traffic toward the leader

Standby

  • • Watches CiliumNode and maintains local tunnel entries
  • • Does not change AWS routes or leader VTEP configuration
  • • Default Lease retry1s; not an end-to-end recovery guarantee