Cloud Native Operations

English

한국어

English

한국어

Appearance

EKS Hybrid Nodes ​

Supported Versions: Current EKS-supported versions; examples reviewed for EKS 1.36 / nodeadm 1.0.20 Last Updated: October 12, 2026

Amazon EKS Hybrid Nodes connects customer-operated on-premises or edge nodes to an AWS-managed EKS control plane. You continue to operate the hosts, operating systems, connectivity and workloads. This guide distinguishes supported interfaces from example configurations; it is not evidence that a particular on-premises production deployment has been tested.

EKS 1.37 became available on October 1, 2026. The examples in this guide remain reviewed against EKS 1.36 and nodeadm 1.0.20.

Before choosing a version, check the EKS version calendar, Hybrid Nodes documentation, and host/CNI support information.

Table of Contents ​

  1. Prerequisites and System Requirements
  2. Network Configuration
  3. Restricted-Internet Setup (S3 + VPC Endpoints)
  4. Node Bootstrap
  5. GPU Server Integration
  6. Workload Placement Strategies
  7. Node Lifecycle Management
  8. Operations and Maintenance
  9. Bare Metal Server OS Installation and Migration Guide
  10. Hybrid Nodes Gateway
  11. Network Separation Security Review

What Are Hybrid Nodes? ​

Hybrid Nodes can share a cluster with ordinary AWS compute nodes. Registering a cloud machine as a hybrid node is a different matter: AWS does not support hybrid-node infrastructure in AWS Regions, Local Zones, Outposts or other clouds, and EC2 use still incurs hybrid fees.

EKS hybrid nodes network overview diagram running from the on-prem router and gateway to the control plane ENI in the AWS cluster VPC.

EKS hybrid nodes network overview diagram running from the on-prem router and gateway to the control plane ENI in the AWS cluster VPC.Open full screen ↗

The following diagram shows the network prerequisites including VPC, subnets, Transit Gateway/Virtual Private Gateway, and Remote Node/Pod CIDR connectivity.

Hybrid nodes prerequisites diagram tying the cluster's RemoteNodeNetwork and RemotePodNetwork settings to route tables on both the VPC and on-prem sides.

Hybrid nodes prerequisites diagram tying the cluster's RemoteNodeNetwork and RemotePodNetwork settings to route tables on both the VPC and on-prem sides.Open full screen ↗

The diagrams illustrate private connectivity and routing, not automatic creation of every on-premises route, firewall rule or AWS service endpoint.

For security-team reviews, use the network-separation review guide. It distinguishes private cluster endpoints, EKS ENIs, and AWS service PrivateLink endpoints, and identifies evidence for management connections and data boundaries across DX.

Use Cases and Data Boundaries ​

On-premises GPUs, large local datasets, edge processing and existing hardware can be reasons to use Hybrid Nodes. Data-locality requirements still need application, storage, egress and logging controls. Kubernetes API objects and control-plane metadata are managed in AWS; a node selector alone does not establish data sovereignty or regulatory compliance.

Use the actual hybrid compute label and an explicitly maintained organization label for placement, rather than assuming an AWS zone named on-premises exists:

yaml
# Pod spec fragment; set organization labels through the node owner.
nodeSelector:
  eks.amazonaws.com/compute-type: hybrid
  example.com/data-location: on-premises

This fragment does not create a label, a complete application, a security boundary or a data-retention policy. Validate image/runtime compatibility and actual data paths.

Architecture and Ownership ​

ComponentLocationResponsibility
EKS API server, etcd, controllers, schedulerAWSAWS-managed control plane
nodeadmOn-premises supported Linux hostInstallation/bootstrap/upgrade CLI; not the long-running node agent
kubelet / containerdOn-premisesNode agent / CRI runtime, operated by the host owner
Cilium or CalicoOn-premises and clusterCompatible CNI configuration; VPC CNI does not manage hybrid nodes
SSM Agent or Roles Anywhere signing helperOn-premisesObtains temporary credentials from the corresponding AWS service
SSM / IAM Roles Anywhere serviceAWSCredential service, not a local offline CA substitute
VPN / Direct Connect and routingBoth environmentsBidirectional connectivity; Direct Connect alone does not imply encryption

Bottlerocket's supported VMware variants use their own bootstrap path and do not use nodeadm. For other supported hosts, nodeadm install installs dependencies and nodeadm init configures/joins the node. SSM-based new installations/upgrades require nodeadm 1.0.19 or later because of SSM signing-key changes; the reviewed current release is 1.0.20.

Constraints to Plan Around ​

  • Connected environment: Reliable private bidirectional connectivity to AWS is required. Hybrid Nodes is not intended for disconnected/intermittent DDIL operation. “Air-gap” in this guide means restricted internet access with required AWS connectivity, not isolation from AWS.
  • Addresses: IPv4 RFC1918 or CGNAT ranges, with no overlap between remote node/Pod, VPC and service CIDRs. Up to 15 node CIDRs and 15 Pod CIDRs per cluster are supported.
  • Authentication: Use API or API_AND_CONFIG_MAP and prepare the Hybrid Nodes IAM role/access entries.
  • API endpoint: AWS recommends public-only or private-only. With both enabled, nodes outside the VPC resolve public endpoint addresses; that can prevent joining if the expected path/access rules are private. It is not a universal API prohibition. Even a public API endpoint does not remove the private control-plane-to-node connectivity requirement.
  • Regions: Available except AWS GovCloud (US) and AWS China Regions, according to the current overview.
  • Host support: Review the OS, architecture, CNI and kernel together. AL2023 is for on-premises virtualized environments, not a generic bare-metal recommendation.
  • Charges: Hybrid fees use reported vCPU-hours while nodes are attached. Hyperthreaded bare-metal cores can report two vCPUs. Idle workloads do not automatically stop node charges; cluster and other service fees are separate.

Credential Providers ​

Both providers need access to AWS service endpoints to refresh credentials. A local CA does not let IAM Roles Anywhere issue AWS credentials offline. Prefer one provider consistently across the fleet unless there is a reviewed reason to mix them.

TopicSSM hybrid activationsIAM Roles Anywhere
BootstrapActivation ID/code and prepared SSM-trusting rolePKI, per-node certificate/key, trust anchor, profile and role
NamingSSM-generated mi-... nameCustom node name bound to the certificate identity
Session durationFixed one hour, refreshed by SSMDefault one hour; supported request/profile durations 15 minutes–12 hours, subject to effective duration and role maximum
DisconnectionCannot refresh; retry backoff can delay reconnection after network recoveryCannot obtain new credentials offline; credential-process obtains them on demand when connectivity returns
Scale / costNo SSM node-registration or per-node management charge; feature-usage pricing is separateReview IAM Roles Anywhere quotas and PKI operating requirements
Typical choiceNo existing PKI; simpler registrationExisting PKI and managed certificate lifecycle

Pricing checked September 16, 2026: SSM removed the Advanced Instances Tier effective June 30, 2026. Consult current SSM pricing for Session Manager and Run Command usage terms; EKS Hybrid Nodes vCPU charges remain separate.

The Roles Anywhere profile must accept a custom role session name, and the trust policy must bind it to the chosen certificate attribute. Its effective session duration must not exceed the IAM role maximum; equality is allowed by the CreateSession API. The prerequisites detail these contracts and secure preparation.

Example Workloads ​

  1. Local GPU training or inference with a verified runtime and recovery plan.
  2. Local data processing with separately reviewed AWS metadata/telemetry/egress paths.
  3. Factory/edge applications with reliable connectivity and tested disconnection behavior.
  4. Media processing near large existing datasets.

Next Steps ​

Start with the Prerequisites and System Requirements to ensure your environment is ready for EKS Hybrid Nodes.

Quiz ​

To test your understanding of EKS Hybrid Nodes, try the following quiz:

Official Documentation ​