Lecture 250: EKS Networking Summary
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:11
- 来源：Udemy Lecture 35813182
- Slide 数量：5
- 画面切换：00:56、01:45、02:58、03:29
扫描说明
逐条读取了 Transcript 面板中的 108 条英文 cue，并按播放器进度同步全长约 5:11 的视频。依据 Control/Endpoint、VPC CNI/Prefix、Custom Networking/SNAT、Security Group、Service Exposure 划分为 5 个小节。5 张截图来自真实课程总结 Slide，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Control Plane、Customer VPC ENI 与 Kubernetes API Endpoint 是第一条主线
时间范围：00:00–00:56
总结 / Summary
中文
EKS Control Plane 位于 AWS-managed VPC，Node/Pod Data Plane 位于 Customer VPC；EKS 在 Cluster Subnet 创建 EKS-owned ENI，让 Control Plane 与 kubelet、Webhook 等 Data-plane Endpoint 私下通信。Administrator/kubectl 访问的是 Cluster Kubernetes API Endpoint，可配置 Public-only、Public+Private 或 Private-only；Private-only 要有 VPC/Hybrid Reachability、DNS、Route 与 SG/NACL。不要把该 Endpoint 与 com.amazonaws.<region>.eks Interface Endpoint 混淆，后者只私有化 CreateCluster/DescribeCluster 等 AWS EKS Service API。
English
The EKS control plane resides in an AWS-managed VPC, while the node and pod data plane resides in the customer VPC. EKS creates EKS-owned ENIs in cluster subnets for private control-plane communication with kubelets, webhooks, and other data-plane endpoints. Administrators and kubectl use the cluster Kubernetes API endpoint, configured as public-only, public-plus-private, or private-only. Private-only requires VPC or hybrid reachability, DNS, routes, and SG or NACL permission. Do not confuse this with the com.amazonaws.<region>.eks interface endpoint, which private-enables AWS EKS service APIs such as CreateCluster and DescribeCluster.
Transcript
00:00 Hello, and welcome to this lecture,
00:02 EKS Networking Summary.
00:03 Just trying to summarize what we learned
00:05 in this section quickly,
00:06 and this is important for your exam.
00:09 So we saw that EKS control plane is launched
00:11 in AWS-managed VPC
00:13 and data plane is launched in customer VPC.
00:16 Now, EKS also provisions the EKS-owned ENI
00:20 into the customer VPC and that's where the communication
00:23 between the control plane and data plane happens.
00:26 EKS cluster API endpoint which is a Kubernetes API,
00:29 basically, is by default, publicly accessible
00:32 because this is launched in AWS-managed VPC.
00:35 But then EKS gives you control
00:37 where you can configure this endpoint
00:39 to be only accessible privately or publicly.
00:42 There are multiple combinations of these settings
00:45 and if you configure it to be only accessible privately,
00:49 then it can be accessed from customer VPC
00:53 via this EKS-owned ENIs.
2. VPC CNI 用 ENI/IP Slot 给 Pod 地址；Prefix Delegation 扩容但不替代 Capacity Cap
时间范围：00:56–01:45
总结 / Summary
中文
Amazon VPC CNI 把 Pod 接入 VPC；经典 IPv4 模式使用 ENI Secondary IP，因此 Instance Type 的 ENI 数、每 ENI Address Slot 与 Subnet Free IP 决定 Pod Capacity。Nitro Prefix Delegation 把 /28 IPv4（16 地址）或 /80 IPv6 Prefix 分配给 ENI Slot，大幅减少逐个 IP Allocation 与扩大 Density。IPv6 /80 实际包含 2^48、约 281 万亿个地址，不只是“数百万”。地址容量仍不等于合理的 Pod Count；AMI max-pods、EKS Recommended Cap、CPU/Memory、kube-proxy 与 Scheduler Scale 都需共同评估。
English
Amazon VPC CNI connects pods to the VPC. Classic IPv4 mode uses ENI secondary addresses, so instance ENI count, address slots per ENI, and free subnet addresses determine capacity. Nitro prefix delegation assigns an IPv4 /28, containing 16 addresses, or an IPv6 /80 prefix to an ENI slot, reducing per-address allocation and greatly increasing density. An IPv6 /80 contains 2^48, roughly 281 trillion addresses, not merely millions. Address capacity is not the same as a sensible pod count; AMI max-pods settings, EKS recommended caps, CPU and memory, kube-proxy, and scheduler scale still apply.
Transcript
00:56 EKS uses Amazon VPC Container Network Interface,
00:59 that is CNI plugin for pod networking.
01:01 And as you know, CNI allocates private IP addresses
01:05 to each pod from the available secondary IPs of those ENIs.
01:11 Maximum number of pods per node depends on number
01:13 of ENIs and number of IP addresses per ENI.
01:17 And then we saw a mechanism where you could increase
01:20 this number of IP addresses allocated to your pods.
01:26 And for that, you have to use something called
01:28 prefix delegation and it is supported only
01:31 on the Nitro-based instances, where for every IP addresses,
01:35 you get /28 prefix for IPv4,
01:38 that means 16 additional IP address,
01:40 and /80 for IPv6 which gives you millions of IP addresses.
3. Custom Networking 扩展 IPv4；Node SNAT 与 External NAT 是 Identity/Route 选择
时间范围：01:45–02:58
总结 / Summary
中文
Primary Subnet IPv4 不足时，可给 VPC 关联 Secondary CIDR（如 100.64.0.0/16），按 AZ 创建 Custom Pod Subnet，并用 ENIConfig + CUSTOM_NETWORK_CFG=true 让 Additional ENI/Pod IP 来自该范围。默认 EXTERNALSNAT=false 表示 Node-side SNAT Enabled，Remote Side 看到 Node Primary IP；EXTERNALSNAT=true 保留 Pod IP 到 Private Connected Network，把 Internet NAT 交给 NAT Gateway。课程总结称 Private Node 使用 NAT Gateway 必须启用 External SNAT，这并不严格：NAT Gateway 在默认 Node SNAT 下也能工作；开启它的主要价值是保留 Pod Identity/对称 Route。
English
When primary subnets lack IPv4 space, associate a secondary CIDR such as 100.64.0.0/16, create custom pod subnets per AZ, and use ENIConfig with CUSTOM_NETWORK_CFG=true so additional ENIs and pod addresses come from that range. The default EXTERNALSNAT=false means node-side SNAT is enabled and remote networks see the node primary address. EXTERNALSNAT=true preserves pod addresses toward connected private networks and delegates Internet NAT to a NAT gateway. The summary says private nodes require external SNAT to use a NAT gateway, but that is not strict: NAT gateways also work with default node SNAT; the setting's key value is pod identity and symmetric routing.
Transcript
01:45 Also, if you are exhausting the allocated VPC range
01:50 for your pods, then you can use
01:53 the custom-networking feature.
01:55 In that case, you can allocate the secondary CIDR
01:58 to the VPC in the range 100.64.0.0/16,
02:02 and then you enable the custom networking.
02:04 In that case, there will be a second ENI created
02:07 and that ENI will be part of the extended subnet
02:11 from this range.
02:12 And then you use the SNAT feature at the node level
02:16 so that your private IP address range
02:18 from 164 is not exposed outside.
02:21 And we saw the entire communication from within the pod
02:24 to outside and from outside to the pod.
02:27 Now, CNI also allows pods to enable and disable SNAT.
02:31 We saw this feature as well where if you want
02:34 to reach directly to the internet,
02:36 then either you can use instances in a public subnet
02:40 and with external SNAT disabled, you can do that.
02:44 But if you want to really have your machines
02:48 in a private subnet, it makes sense to use a NAT gateway.
02:51 And in that case, external SNAT has to be enabled.
02:55 And we saw that with the architecture.
4. Security Boundary：普通 Pod 共享 Node SG，Selected Pod 可用 Branch ENI 获得独立 SG
时间范围：02:58–03:29
总结 / Summary
中文
普通 VPC CNI Pod 使用 Node ENI Secondary IP，因此共享该 ENI 的 SG，无法逐 Pod 设置不同 VPC Firewall Rule。Kubernetes NetworkPolicy 可做 Label/Namespace/Port 级 Segmentation；AWS Security Groups for Pods 则通过 SecurityGroupPolicy 选择 Pod，由 VPC Resource Controller 在兼容 Nitro Node 上创建 Trunk ENI/Branch ENI，并把指定 SG 关联到 Branch ENI。两种机制可叠加，Flow 必须被所有适用层允许；Branch ENI Quota、VPC CNI Enforcement Mode、Windows/IPv6/Instance Compatibility 要查当前 Support Matrix。
English
Ordinary VPC CNI pods use secondary addresses on node ENIs and therefore share those ENI security groups, preventing distinct per-pod VPC firewall rules. Kubernetes NetworkPolicy provides label, namespace, and port segmentation. AWS security groups for pods use SecurityGroupPolicy to select pods; the VPC resource controller creates trunk and branch ENIs on compatible Nitro nodes and attaches the requested security groups to branch ENIs. The mechanisms can be layered, and every applicable layer must permit the flow. Check branch-ENI quotas, VPC CNI enforcement mode, and current Windows, IPv6, and instance compatibility.
Transcript
02:58 Moving forward, by default,
03:00 if you talk about the security group,
03:02 then ENIs comes with the security group,
03:05 and all the pods which are using the IPs
03:07 from that ENI will use the same security group.
03:09 Now, that's a limitation.
03:11 Often you would want separate security group
03:13 for your pods and in order to do that,
03:16 you can use either the external network plugins
03:20 like the Calico, or you can use Trunk and Branch ENI feature
03:24 which also works with the Nitro system-based instances.
5. Service Exposure Checklist：ClusterIP → NodePort → NLB/ALB，并明确 Client IP Trade-off
时间范围：03:29–05:11
总结 / Summary
中文
ClusterIP 提供 Cluster 内 VIP/DNS；NodePort 在每个 Node 暴露固定高位 Port；LoadBalancer Service 通常由 AWS Load Balancer Controller 创建 NLB，Instance Target 走 NodePort、IP Target 直达 Pod；Ingress 是独立 L7 Resource（不是第四种 Service Type），由 Controller 创建 ALB 并做 Host/Path Routing。旧 In-tree Controller/CLB 是 Legacy。NLB Instance Mode 下 externalTrafficPolicy: Cluster 分布较均匀但可能丢失 Client IP，Local 可保留 Source IP但要求 Local Endpoint 并可能倾斜；ALB 使用受信任的 X-Forwarded-For 传递 Client IP。
English
ClusterIP provides an in-cluster VIP and DNS name. NodePort exposes a fixed high port on every node. A LoadBalancer Service is normally reconciled by AWS Load Balancer Controller into an NLB, with instance targets using NodePort and IP targets reaching pods directly. Ingress is a separate Layer 7 resource, not a fourth service type, and the controller creates an ALB for host and path routing. The old in-tree controller and CLB path are legacy. With NLB instance mode, externalTrafficPolicy: Cluster distributes more evenly but can lose client IP, while Local preserves source identity but requires local endpoints and can skew load. ALB carries client identity in trusted X-Forwarded-For.
Transcript
03:29 If you want to expose the Kubernete services,
03:31 then there are four ways:
03:33 ClusterIP, NodePort, LoadBalancer, and Ingress.
03:36 As you know, ClusterIP is accessible
03:39 from within the cluster only,
03:41 NodePort is accessible outside and for that,
03:43 you have to use Node IP address and a static port.
03:47 Again, not a great idea.
03:49 Essentially, you can use either LoadBalancer or Ingress.
03:52 Now, LoadBalancer service typically work
03:55 for layer four and Ingress for layer seven,
03:58 but there are multiple implementation
04:00 of LoadBalancer controller.
04:02 There is older controller.
04:04 With that, you can use both CLP and NLP,
04:07 but it is advisable that you use the newer controller
04:10 that is AWS LoadBalancer controller.
04:13 In that case you can use NLB
04:14 in both instance mode as well as IP mode.
04:18 And with Ingress you can use ALB
04:21 and you can use all the ALB features
04:23 like path-based routing or the host-based routing.
04:26 So that's about the AWS load balancer controller.
04:29 And finally, there is something called
04:32 external traffic policy,
04:33 which is set to cluster by default.
04:35 But due to that, what happens
04:37 that the client source IP is not preserved,
04:40 because then kube-proxy sends the traffic
04:43 to the other nodes and the source IP's replaced.
04:46 But if you want to make sure
04:47 that the client source IP is preserved,
04:50 then you can set the external traffic policy to the local,
04:54 but then it may result in uneven load balancing
04:57 because traffic cannot be sent to the other node service.
05:01 So these are few essential things that you need
05:03 to remember for your exam and I hope that is clear.
05:06 So thanks for watching and stay tuned for the next sections.
05:09 Thank you.
整讲总结 / Overall Summary
中文
本节考试主线可压缩为五问：Control Plane/Cluster Endpoint 如何到 Customer VPC；Pod IP 来自哪块 ENI/Subnet；ENI Limit、Prefix 与 Custom Networking 如何影响容量；SNAT/Route 是否保留 Pod Identity；SG/NetworkPolicy 与 NLB/ALB 在哪一层执行。先回答这五问，再判断 Endpoint Mode、Target Type、Client IP 与 Return Path，绝大多数 EKS Networking 题都能拆开。
English
The section can be reduced to five exam questions: how the control plane and cluster endpoint reach the customer VPC; which ENI and subnet supply pod addresses; how ENI limits, prefixes, and custom networking affect capacity; whether SNAT and routing preserve pod identity; and where security groups, NetworkPolicy, NLB, and ALB enforce policy. Answering those questions first usually makes endpoint mode, target type, client-IP, and return-path scenarios tractable.
返回顶部 ↑