Lecture 244: EKS Cluster Networking
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：15:43
- 来源：Udemy Lecture 35813112
- Slide 数量：8
- 画面切换：02:37、04:23、06:42、09:12、10:18、11:28、13:08
扫描说明
逐条读取了 Transcript 面板中的 358 条英文 cue，并按播放器进度同步全长约 15:43 的视频。依据 EKS-owned ENI、Subnet/Cluster SG、API/IP Family、Public Endpoint、Public+Private、Private-only、EKS Service PrivateLink、VPC Extension 划分为 8 个小节。8 张截图来自真实 EKS Network Architecture Slide，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS-managed Control Plane 通过 Customer VPC 中的 EKS-owned ENI 连接 Data Plane
时间范围：00:00–02:37
总结 / Summary
中文
EKS Control Plane 位于 AWS-managed Account/VPC，Worker Node 与 Pod 位于 Customer Account/VPC。为跨越这条边界，EKS 在创建 Cluster 时向用户选择的 Cluster Subnet Provision 2–4 个 Requester-managed/EKS-owned ENI；Control Plane 通过这些 Private ENI 与 kubelet、Webhook、Exec/Logs 等 Data-plane Endpoint 通信。ENI 由 EKS 所有但占用客户 Subnet IP，并受客户 Route/NACL/SG 影响，因此 Cluster Subnet 的 IP Capacity 与 Reachability 是 Control-plane Availability 的一部分。
English
The EKS control plane resides in an AWS-managed account and VPC, while worker nodes and pods reside in the customer account and VPC. EKS bridges that boundary by provisioning two to four requester-managed, EKS-owned ENIs into the selected cluster subnets. The control plane uses these private ENIs to reach kubelets, webhooks, exec and logs paths, and other data-plane endpoints. EKS owns the ENIs, but they consume customer-subnet addresses and depend on customer routes, NACLs, and security groups, making subnet capacity and reachability part of control-plane availability.
Transcript
00:00 Hello and welcome to this lecture,
00:01 "Amazon EKS Cluster Networking."
00:03 So in the earlier lecture,
00:04 we understood the EKS architecture.
00:07 We know that control plane is managed by AWS,
00:10 and data plane is managed by the customer,
00:12 that means by you.
00:14 Now in this lecture, let's understand
00:15 the cluster networking.
00:17 So far, we are not talking about
00:18 the EKS or Kubernetes pod-level networking.
00:21 That means how pod communicates with each other
00:24 or how to expose pod services to the outside world.
00:27 That will be covered in the following lecture.
00:29 But here, we are talking about EKS Cluster Networking,
00:32 that means when you create EKS cluster,
00:34 then how does your network look like
00:36 and what are controls you have over that network?
00:39 So this is about cluster networking
00:41 and not really about the pod networking, right?
00:41 So let's start with EKS Cluster Networking first.
00:47 EKS has the control plane
00:49 which resides in AWS managed VPC
00:52 as you can see here on the top.
00:54 And then the data plane, which means the worker nodes
00:58 are launched in the customer VPC.
01:00 So this is a VPC which you manage
01:02 and this is inside your AWS account.
01:05 So control plane is launched
01:07 in AWS managed account and VPC,
01:09 and data plane nodes are launched
01:11 in a customer account and VPC.
01:13 So the question is, if that is the case,
01:15 then how does the control plane talks to the data plane?
01:18 Of course, there should be some mechanism
01:20 and you are already aware of this
01:22 if you know the requester managed ENIs.
01:25 So if you worked with services like Amazon AppStream
01:28 or Workspaces, or for that matter,
01:32 database service that is RDS.
01:34 Now RDS databases are managed by AWS,
01:36 but still you can control the security group
01:39 for your database.
01:40 You can configure those rules.
01:42 Now, how it is possible?
01:44 In that case, behalf of AWS service,
01:47 it creates ENI into your VPC
01:50 and then it gives you control over that ENI.
01:53 And then security groups are attached to the ENI,
01:55 and that's where you get control of managing
01:57 the traffic for those ENIs.
02:00 In the same fashion,
02:01 EKS control plane provisions the ENIs,
02:05 typically 2 to 4 ENIs
02:06 depending on how many availability zones you use
02:09 into your customer VPC.
02:11 And this ENI enables the communication
02:13 from control plane to the data plane.
02:16 So this is the traffic from control plane to the data plane.
02:19 And then also sometimes your data plane needs to communicate
02:23 to the control plane as well,
02:25 and we'll see how that communication happens.
02:27 There are different ways and we'll cover that.
02:29 But here you have ENIs, which are owned by the EKS,
02:33 but they're provisioned inside the customer VPC subnet.
2. Cluster Subnet 预留升级 IP，Cluster Security Group 控制 Control/Data Plane Flow
时间范围：02:37–04:23
总结 / Summary
中文
可把 EKS-owned ENI 与 Worker 放在同一 Subnet，也可用专用 Cluster Subnet 简化 Route/NACL 管理。EKS 在 Cluster Operation/Upgrade 时需要可用 IP；本讲建议每个 Subnet 至少保留 6 个，并用 /28 作为小型专用 Subnet 的参考。EKS 自动创建 Cluster Security Group，默认允许同 SG Resource 之间 All Traffic，并允许宽泛 Outbound；Managed Node Group 通常也关联该 SG。Production 可收紧 Egress/Ingress，但必须保留 Kubernetes API、kubelet、DNS、Webhook 与所需 Inter-node/Control-plane Port，否则 Node Join 或 Cluster Operation 会失败。
English
EKS-owned ENIs may share worker subnets or use dedicated cluster subnets for simpler routing and NACL control. Cluster operations and upgrades need spare addresses; the lecture recommends at least six available IPs per subnet and uses /28 as a small dedicated-subnet reference. EKS creates a cluster security group that initially allows all traffic among resources sharing the SG and broad outbound access, and managed node groups commonly attach it. Production rules may be tightened, but Kubernetes API, kubelet, DNS, webhooks, and required inter-node or control-plane ports must remain reachable or node joining and cluster operations fail.
Transcript
02:37 Now if you look at this architecture,
02:38 typically it is advised that
02:41 for this ENIs, you should have a dedicated subnet.
02:44 Now you could very well use these worker node subnets
02:47 to provision these ENIs,
02:49 but you know, it's always better to have better control
02:51 over those subnets so that you can define the NACL rules,
02:55 you can have the routing rules for your subnet
02:58 and then you dedicate these subnets only for these ENIs.
03:02 And then EKS doesn't need lot of IP addresses
03:06 from this subnet, only six IPs are required,
03:09 but you know, in AWS you can create the smallest subnet
03:11 as /28, which gives you 16 IP addresses.
03:14 So it's recommended that you have the smallest subnets
03:18 allocated for these ENIs.
03:21 Now further, when you create EKS cluster,
03:24 it also creates security group
03:26 and these security groups are attached to these ENIs.
03:30 Now this security groups are also attached to the nodes,
03:34 if you are creating these nodes
03:35 as a part of managed node group.
03:38 And you can see here,
03:39 there are a couple of rules in this security group, right?
03:42 So there is inbound rule which allows all protocol
03:45 on all ports and it references to the self,
03:49 that means wherever this security group is attached,
03:52 the traffic can flow through all those ENIs to each other.
03:56 And then there is outbound rule
03:58 which allows the outbound connection to IPv4
04:01 and IPv6 addresses, all the addresses,
04:04 and then you can very well change those as you need.
04:07 But this is a default security group which gets created,
04:10 and then you also get control
04:12 where you create security group
04:13 and then you provide the security group ID
04:16 while you create the cluster.
04:17 That means it's configurable,
04:18 but this is a default security group
04:20 which gets created if you don't provide your own.
3. Kubernetes Cluster Endpoint 与 AWS EKS Service API 是两个不同 Endpoint
时间范围：04:23–06:42
总结 / Summary
中文
kubectl 访问的是每个 Cluster 独有的 Kubernetes API Server Endpoint，用于创建 Pod/Service、更新 Kubernetes Object 与读取 Cluster State；CreateCluster、DescribeCluster 等则调用 Regional AWS EKS Service API，由 AWS CLI/SDK/eksctl 使用。两者的 DNS、Authorization 与 Private Access 方法不同，考试题必须先判断调用的是哪套 API。本讲还给出 EKS Cluster 选择 IPv4 或 IPv6 IP Family、Pod 不同时拥有两种地址的口径；IP-family 与 Dual-stack 能力会随 EKS/Plugin 版本演进，实际设计应核对当前平台文档。
English
kubectl uses the per-cluster Kubernetes API server endpoint to create pods or services, update Kubernetes objects, and read cluster state. CreateCluster, DescribeCluster, and similar operations call the regional AWS EKS service API through AWS CLI, SDKs, or eksctl. Their DNS names, authorization, and private-access methods differ, so exam questions must first identify which API is involved. The lecture also presents EKS clusters as selecting an IPv4 or IPv6 IP family rather than assigning both to a pod; IP-family and dual-stack capabilities evolve with EKS and plugin versions, so current platform documentation should govern real designs.
Transcript
04:23 Okay, next thing, how do you access the control plane?
04:26 Now, here is the thing to understand.
04:29 When we talked about the Kubernetes architecture,
04:31 we said that Kubernetes APIs servers
04:34 kind of the heart of the communication.
04:35 If you want to talk to Kubernetes cluster,
04:37 you need to make an API call to the API server.
04:40 Now in this case,
04:41 that API server is a part of this EKS control plane.
04:45 And if you're using some kind of client,
04:47 Kubernetes client like kubectl on your workstation,
04:50 then you need to connect to this control plane API server
04:53 and then you can deploy your pods, you can create services,
04:56 you can attach nodes to the Kubernetes cluster.
04:58 All those are Kubernetes-level operation
05:01 and for that, you need to hit
05:03 that Kubernetes control plane API.
05:06 So by default, this API server
05:09 is accessible over the internet.
05:10 And as you can see, this is managed by AWS
05:12 because it's inside AWS managed VPC
05:16 and then AWS will allow the internet access to this.
05:19 Now, there are ways to disable the internet access
05:22 and we'll see that in the same lecture,
05:25 but this is what happens when you create the EKS cluster.
05:29 Now, one thing to understand that don't get confused
05:32 between the Kubernetes API server
05:34 which is used to manage the Kubernetes cluster components.
05:38 For example, launching pods, launching services,
05:41 and then there is something called EKS APIs,
05:44 those are AWS EKS APIs.
05:46 That means if you want to create the cluster,
05:48 you need to make an API call to AWS.
05:50 For example, if you launch an EC2,
05:51 you make an API call to EC2 service.
05:54 Similarly, you are now making call to the EKS service
05:57 of AWS and then it creates the cluster for you.
06:00 That's AWS API,
06:01 we are not talking about that at this moment.
06:03 We are talking about the Kubernetes API
06:05 to really manage the internal components of the Kubernetes
06:09 and to make the deployments into the Kubernetes, right?
06:13 So by default, this API server it's accessible
06:16 over the internet.
06:17 Finally, you can have both IPv4
06:21 and IPv6 IP addresses assigned to your pods
06:24 which are running on this worker node.
06:27 But thing to remember is that
06:28 it doesn't support dualstack mode.
06:30 That means, pod cannot have both the IPs at the same time,
06:34 either they can have IPv4 addresses
06:36 or they can have IPv6 addresses.
06:38 So that means both the options are available to you.
4. Public-only Cluster Endpoint 可由 Internet 访问，但应限制 Public Access CIDR
时间范围：06:42–09:12
总结 / Summary
中文
默认模式可启用 Kubernetes API Public Endpoint、关闭 Private Endpoint；Endpoint DNS 解析为 Public IP，Administrator 的 kubectl 与 Worker Node 都经可用的 Internet Egress 连接。Worker 不一定必须在 Public Subnet：Private Subnet + NAT Gateway 也能到达 Public Endpoint，关键是 Route/Egress 与 DNS。Public Endpoint 仍受 IAM/Kubernetes Authentication/Authorization 保护，但应额外用 Public Access CIDR 限制允许的 Source NAT/Public IP，避免让所有 Internet Source 都能探测 API Surface。
English
The default pattern can enable the Kubernetes API public endpoint and disable the private endpoint. Its DNS name resolves to public addresses, so administrator kubectl clients and worker nodes connect through available Internet egress. Workers need not be in public subnets; private subnets with a NAT gateway can also reach the public endpoint, so routing, egress, and DNS are what matter. IAM and Kubernetes authentication and authorization still protect the API, but public-access CIDRs should restrict allowed source NAT or public addresses to reduce exposure.
Transcript
06:42 Now, with that, let's look into the particular use cases.
06:46 Now to start with, let's see
06:47 what are the options you have when you say
06:50 you want to access the EKS Kubernetes API server?
06:55 So here is the same architecture
06:57 and then you have kubectl as a client
06:59 which you can install on your workstation,
07:01 assuming that you have permissions
07:03 to connect to the Kubernetes API server
07:06 then you can very well go over the internet.
07:08 Now this is a default setting
07:10 where EKS cluster endpoint public access is enabled
07:13 and the private access is disabled.
07:15 And we'll talk shortly about what is private access.
07:18 But if that is the case, you create the cluster
07:21 then you can connect from your workstation.
07:24 So EKS will provide you the DNS,
07:30 some uniquename.eks.amazonaws.com
07:31 and which results to the public IP,
07:33 and then you can connect it over the internet.
07:36 Now, how do then worker nodes connects to the control plane?
07:42 Because as I said, this ENIs by default
07:45 will only allow access from control plane to the data plane.
07:49 But then data plane also needs to communicate
07:51 to the control plane.
07:52 For example, to let control plane know
07:55 that some of the pod went down,
07:57 so there should be a replacement pod.
07:59 So for the reporting purpose
08:01 or to get the instruction from the control plane, right?
08:05 So by default,
08:06 if you enable the cluster endpoint public access
08:09 then this worker nodes here
08:11 and it runs kubelet, as you know,
08:14 needs to communicate with the control plane
08:15 over the internet as well.
08:17 So the traffic will go from here to the control plane.
08:21 Now, for that, as you might have understood
08:23 your nodes needs to be in public subnet
08:26 and then you should be allowed to connect
08:29 to the internet through internet gateway.
08:31 And we'll talk about more patterns of public
08:34 or private network going forward.
08:36 But this is what happens
08:37 if you go with the Kubernetes default public access.
08:41 Okay, so obviously this works well,
08:43 but then it means that anybody can connect
08:45 to your control plane.
08:46 So do you have any control over who can connect
08:49 over the internet? Yes, of course, you have
08:51 because AWS EKS provides you ability
08:55 to provide the CIDR block to whitelist the IP addresses.
08:58 So you can restrict that which IPs can access
09:01 this control plane.
09:03 So if you know the customer side of the CIDR
09:07 then you can provide that
09:08 and only traffic from those IPs will be allowed.
5. Public+Private 模式让 External Admin 走 Public、VPC Node 走 Private ENI
时间范围：09:12–10:18
总结 / Summary
中文
同时启用 Public 与 Private Access 时，外部 Administrator 仍可从允许的 CIDR 访问 Public Endpoint，而 VPC 内的 Worker/Client 通过 EKS-owned ENI 的 Private IP 访问 Kubernetes API。Cluster Endpoint DNS 会根据来源提供合适的解析/路径，使 Node 无需为 Control-plane Communication 经过 NAT/IGW。该模式兼顾 Remote Administration 与 Private Node，但仍应最小化 Public CIDR，并保证 VPC DNS、Cluster SG、Route/NACL 允许 TCP 443 等必要 Flow。
English
With both public and private access enabled, external administrators can use the public endpoint from allowed CIDRs, while workers and clients inside the VPC reach the Kubernetes API through private EKS-owned ENI addresses. Endpoint DNS provides the appropriate resolution and path so node-to-control-plane communication need not traverse a NAT gateway or IGW. This balances remote administration with private nodes, but public CIDRs should be minimized and VPC DNS, cluster security groups, routes, and NACLs must allow required flows such as TCP 443.
Transcript
09:12 Okay, but in certain cases, maybe you want that
09:15 your worker node doesn't have the outbound internet access
09:18 and still you want these worker nodes to communicate
09:20 or say data plane to communicate with your control plane,
09:24 or the private network.
09:26 Now in that case, there is an option
09:28 where what you can do is you can enable both
09:31 the public and private access
09:32 for this control plane endpoint.
09:35 So in that case, a client can connect over the internet,
09:39 but the data plane can be in the private subnet
09:43 and there is no internet gateway here.
09:45 And then it can access the control plane
09:48 via this EKS owned ENI.
09:50 So when it tries to resolve the DNS,
09:53 it results to the ENI private IP.
09:56 In that case, you don't need outbound internet access
09:59 for your worker nodes.
10:00 So that's one case where you can enable
10:03 both the public and private access.
10:06 Now, in this case as well,
10:07 you could still have the CIDR block
10:10 and you can whitelist the public IP range
10:13 from which you want external client to make connection
10:16 to the control plane API server.
6. Private-only Endpoint 要求 Administrator 先获得到 VPC 的 Private Layer-3 Reachability
时间范围：10:18–11:28
总结 / Summary
中文
关闭 Public、启用 Private Access 后，Kubernetes API 只通过 Customer VPC 中的 Private Endpoint/ENI Path 可达。kubectl 必须运行在 VPC 内的 Bastion/Management Host，或来自通过 Site-to-Site VPN、Client VPN、Direct Connect、Transit Gateway 等连接的 Network。Private-only 降低 Internet Exposure，但不会自动解决 DNS、Route、SG/NACL 或 Authentication；On-prem Resolver 还需能解析 Cluster Private DNS，并且端到端 Return Path 必须对称可达。
English
When public access is disabled and private access enabled, the Kubernetes API is reachable only through the private endpoint and ENI path in the customer VPC. kubectl must run on a bastion or management host inside the VPC, or come from a network connected through Site-to-Site VPN, Client VPN, Direct Connect, Transit Gateway, or similar private routing. Private-only reduces Internet exposure but does not solve DNS, routes, SGs, NACLs, or authentication automatically; on-premises resolvers must resolve the private cluster name and the return path must be reachable.
Transcript
10:18 Now, while this is good, maybe in certain cases,
10:22 you don't even want this public connectivity.
10:26 You want that all the connection from your network
10:29 to the Kubernetes control plan is private.
10:32 That means it's secured,
10:34 so it could be over VPN
10:35 or it could be over a Direct Connect.
10:38 If you have that kind of requirement,
10:39 you can completely disable the public access
10:43 to your control plane cluster endpoint, right?
10:47 But in that case,
10:48 you need to have some kind of Layer 4 connectivity
10:52 between the data center and the customer VPC.
10:57 Typically, it is turn over a VPN or a Direct Connect
10:59 and then you have client inside this network,
11:02 and this client can then reach out to the EKS owned ENI,
11:06 and then the traffic can go to your control plane.
11:09 Now, in this case,
11:10 we have disabled the EKS cluster endpoint public access,
11:15 but we have enabled the private access
11:17 so that it can only be accessed from this EKS owned ENI.
11:21 So these are the ways in which you can control the access
11:25 to the EKS cluster endpoint.
7. EKS Interface VPC Endpoint 私有化 AWS EKS API，不等于 Cluster Kubernetes Endpoint
时间范围：11:28–13:08
总结 / Summary
中文
若 Private Network 中的 AWS CLI/SDK/eksctl 要调用 CreateCluster、ListClusters 等 AWS EKS API，可在 VPC 创建 com.amazonaws.<region>.eks Interface Endpoint，经 PrivateLink 到 Regional EKS Service，避免 Internet/NAT。它只私有化 AWS Service API；Cluster 创建后，kubectl 仍访问该 Cluster 自己的 Kubernetes API Endpoint，需按 Public/Private Cluster Endpoint 模式单独配置。此区分也是常见考点：Interface Endpoint 不能替代 Kubernetes API Private Access。
English
AWS CLI, SDK, or eksctl clients in a private network can call CreateCluster, ListClusters, and other AWS EKS APIs through the com.amazonaws.<region>.eks interface endpoint over PrivateLink, avoiding Internet or NAT paths. This private endpoint covers the regional AWS service API only. After cluster creation, kubectl still uses that cluster's own Kubernetes API endpoint, whose public or private mode is configured separately. This distinction is a common exam point: the interface endpoint does not replace Kubernetes API private access.
Transcript
11:28 Now, at the same time,
11:29 we also need to look at the AWS EKS APIs.
11:33 Now, for example,
11:34 if you're creating the EKS cluster altogether.
11:37 Now for creating EKS cluster,
11:39 you don't need access to the cluster endpoint, right?
11:42 Because it is after creating the cluster.
11:44 But for that, you need access to the EKS service of AWS
11:49 like EC2 as I said.
11:51 Now, typically, all the services
11:53 are available publicly, right?
11:54 You can access that,
11:55 but in certain cases you want to only allow
11:59 the client inside a VPC, for example,
12:01 or client inside a private network
12:04 to create the EKS cluster.
12:06 So in that case, if you need to do that,
12:09 you can use VPC interface endpoint for EKS service.
12:14 Now, what we are doing here,
12:15 in customer VPC, we are creating a VPC interface endpoint
12:19 for EKS service of AWS.
12:21 And then your client are sitting here,
12:24 but this time they're not using kubectl,
12:26 but they're using other tools like eksctl,
12:28 which is used to create the Kubernetes cluster
12:31 and eksctl talks to AWS EKS service endpoint, right?
12:37 So in this case, it will fire AWS EKS API
12:41 and the traffic will flow from the customer location
12:45 to the customer VPC via VPN or a Direct Connect.
12:48 And from there, through VPC interface endpoint,
12:51 it can reach to the EKS service endpoint
12:54 and then you can fire all the EKS-related APIs.
12:58 To start with, it will create the cluster,
13:00 and once cluster is available
13:02 then the kubectl will be used to connect
13:05 to the control plane
13:06 and then perform all the operations.
8. EKS Data Plane 可使用完整 VPC Toolkit：LB、NAT/Egress-only、Endpoint 与 Hybrid Routing
时间范围：13:08–15:43
总结 / Summary
中文
Worker/Pod 位于普通 Customer VPC，因此可在 Public Subnet 部署 Internet-facing ALB/NLB，把 Service Traffic 引向 Pod；Private IPv4 Workload 通过 NAT Gateway Egress，IPv6 可用 Egress-only Internet Gateway 限制 Unsolicited Inbound。访问 S3/ECR/CloudWatch/STS 等 AWS Service 可配置 Gateway/Interface VPC Endpoint，构建无 NAT 的 Private Cluster。VPC Peering、Transit Gateway、VPN、Direct Connect 还可连接其他 VPC 与 On-prem。Subnet IP Capacity、AZ 对称性、DNS 与 Return Route 必须一起设计。
English
Workers and pods reside in an ordinary customer VPC, so Internet-facing ALBs or NLBs can live in public subnets and steer Service traffic to pods. Private IPv4 workloads use NAT-gateway egress, while IPv6 can use an egress-only Internet gateway to block unsolicited inbound connections. Gateway or interface VPC endpoints for services such as S3, ECR, CloudWatch, and STS can support private clusters without NAT. VPC peering, Transit Gateway, VPN, and Direct Connect connect other VPCs and on-premises networks. Subnet address capacity, AZ symmetry, DNS, and return routes must be designed together.
Transcript
13:08 Now, this is how the VPCs look like and the, you know,
13:11 networking look like for your EKS cluster.
13:14 Now, few additional things, maybe recommendation
13:16 or best practices, what you can do inside your customer VPC.
13:20 So of course, you could have public subnets
13:23 inside your customer VPC
13:25 so that you can launch the elastic load balancers
13:28 like ALB or NLB,
13:30 and then you can distribute traffic to your pods.
13:32 And we'll cover this in detail in the following lectures.
13:35 And also for the outbound access to the pod,
13:38 you can do that through the NAT gateways as usual.
13:41 So for that, also, you could have your public subnets.
13:44 Now if you're allocating IPv6 addresses,
13:47 you know that IPv6 addresses are public, right?
13:51 So you don't need NAT gateway,
13:53 but then if you want to allow only outbound access
13:56 then you need egress only internet gateway.
13:58 Now, what is egress only internet gateway?
14:01 It only allows traffic
14:02 from IPv6 addresses to go out, right?
14:05 But from outside,
14:07 traffic cannot reach to those IP addresses.
14:09 So this is particularly used for IPv6 addresses.
14:13 But if it's IPv4 address, as you know,
14:15 you should have the NAT gateways.
14:17 And then NAT gateway should be in public subnet,
14:19 so traffic goes from your pods to the NAT gateways
14:22 to the internet gateway, to out to the internet.
14:25 Further, you can also enable the VPC endpoints
14:28 through private link to access other AWS services.
14:31 For example, pod wants to send some logs to the S3 service
14:36 or pod needs to access the EKS service,
14:38 so all these endpoints are available
14:40 because we are still operating as a normal VPC, right?
14:44 So all those VPC-related services
14:46 are available in the customer VPC as well.
14:50 Further, you can connect your VPCs
14:51 to other networking component.
14:53 For example, you could connect it to on-premise data center
14:55 or a VPN, or a Direct Connect.
14:57 You can peer multiple VPCs.
15:00 You can peer your VPC to the transit gateway.
15:02 So all this is possible.
15:04 That means you leverage all your VPC capabilities
15:07 while you deploy your Kubernetes data plane
15:09 into your own VPC.
15:11 So we'll stop here for this lecture
15:14 and now we'll slowly get into the pod-level networking
15:17 and that's the most important part of this section
15:22 because you will have a lot of questions related
15:24 to the pod networking.
15:26 How EKS assign the IP addresses to the pods?
15:29 How to expose pod services externally?
15:32 All that will follow,
15:33 but I hope the basic building block is clear
15:36 how the Kubernetes control plane
15:37 and data plane networking looks like.
15:40 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
EKS Cluster Networking 的主线是两类边界：AWS-managed Control Plane 通过 EKS-owned ENI/Cluster SG 进入 Customer VPC；Administrator/Node 通过 Public、Public+Private 或 Private-only Kubernetes Endpoint 访问 API。同时必须区分 Kubernetes Cluster Endpoint 与 AWS EKS Service Interface Endpoint。其余 Data Plane 完全继承 VPC 的 Load Balancer、NAT、IPv6 Egress、PrivateLink 与 Hybrid Connectivity 能力。
English
EKS cluster networking has two central boundaries: the AWS-managed control plane enters the customer VPC through EKS-owned ENIs and cluster security groups, while administrators and nodes reach the Kubernetes API through public, public-plus-private, or private-only endpoint modes. The Kubernetes cluster endpoint must be distinguished from the AWS EKS service interface endpoint. The data plane otherwise inherits VPC load balancers, NAT, IPv6 egress, PrivateLink, and hybrid-connectivity capabilities.
返回顶部 ↑