EKS Hybrid Nodes Network Overview

EKS Hybrid Nodes Network Overview An architecture diagram generated by Archify. EKS control plane · AWS-managed account · AWS Region EKS control plane AWS-managed account Control plane ENI · Placed in the cluster VPC · AWS Region Control plane ENI Placed in the cluster VPC Cluster VPC subnets · 172.16.0.0/16 · AWS Region Cluster VPC subnets 172.16.0.0/16 Cloud nodes · EC2 workers in the VPC · AWS Region Cloud nodes EC2 workers in the VPC VPC endpoints · Access to other AWS services · AWS Region VPC endpoints Access to other AWS services On-prem ↔ AWS link · Direct Connect · Site-to-Site VPN · Architecture component On-prem ↔ AWS link Direct Connect · Site-to-Site VPN Hybrid nodes · On-prem workers subnet · On-prem environment Hybrid nodes On-prem workers subnet ENI kubelet node IP private remote CIDRs via router AWS Region On-prem environment Legend Backend Cloud Security Message bus

How it connects

  • • The EKS control plane creates ENIs in the cluster VPC to reach nodes
  • • Hybrid nodes must reach those ENIs from on-premises over a private path
  • • Cloud nodes and hybrid nodes can coexist in the same cluster

Required private connectivity

  • • Either AWS Direct Connect or Site-to-Site VPN is mandatory
  • • Going over the public internet is unsupported, and routing must work both ways
  • • Add routes for the remote node and pod CIDRs to the gateway in the VPC route table

Reaching AWS services

  • • Hybrid nodes also need credentials, through SSM or IAM Roles Anywhere
  • • Services such as ECR and S3 can be reached privately through VPC endpoints
  • • The DNS resolution path out of on-premises needs designing too