View a markdown version of this page

Deal with Pod IP Exhaustion - Expose Microservices Using Amazon EKS
Deal with Pod IP ExhaustionFurther readingDiagram history

Deal with Pod IP Exhaustion

This architecture shows how to deal with pod IP exhaustion by adding secondary CIDR blocks from the RFC 6598 address space to your Amazon VPC. Using the CNI Custom Networking feature, pods no longer consume RFC 1918 IP addresses in the VPC.

Deal with Pod IP Exhaustion

Architecture diagram showing Amazon EKS custom networking with secondary CIDR blocks to address pod IP exhaustion.

The following steps describe the inbound external flow:

  1. Amazon Route 53 resolves incoming requests to the public ELB deployed by the AWS Load Balancer Controller.

  2. The ELBs forward traffic to applications. You choose between instance mode (traffic sent to a worker node, then the service redirects to the pod) or IP mode (traffic directed to the pod IP directly).

The following steps describe the inbound internal flow:

  1. Amazon Route 53 resolves incoming requests to the private ELB deployed by the AWS Load Balancer Controller using a private hosted zone.

  2. The ELBs forward traffic to applications in instance mode or IP mode.

The following steps describe the outbound external flow:

  1. A pod in a private subnet initiates an outbound request to the internet. The private route table forwards traffic to the NAT gateway (NGW).

  2. The public route table forwards traffic from the NGW to the internet gateway (IGW).

The following steps describe the outbound internal flow:

  1. A pod in a private subnet initiates an outbound request to the on-premises network. The private route table forwards traffic to the virtual private gateway (VGW).

  2. Traffic reaches the on-premises network over the VPN or AWS Direct Connect connection.

Note

The default behavior of Amazon EKS is to source NAT pod traffic to the primary IP address of the hosting worker node. AWS Fargate for Amazon EKS supports additional CIDRs. The ENIConfig custom resource defines the subnet in which pods are scheduled. See this blog post for multi-account settings.

Further reading

For additional information, refer to the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

February 22, 2022

Initial publication

Reference architecture diagram first published.

February 22, 2022

Initial publication

Reference architecture diagram first published.

February 22, 2022

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.