I'm trying to build a basic frontend-backend topology in Kubernetes (Amazon EKS actually) with both frontend and backend pods residing on the same node. I want every node to have 2 interfaces: public one, that will connect to internet gateway, and private one, that won't. So it would seem natural to somehow map frontend pods (or service) to the public interface to route traffic to/from the internet and map backend pods to private interface to prevent any external access to them. Is it even possible in Kubernetes? I know that I probably should use public interfaces everywhere and resrict access with ACLs but design with different interfaces looks simplier and more secure to me.
It is possible in Kuberenetes. You need to create ingress or create a loadbalancer service for your frontend pods to access it from public interfaces. Do not create the same for backend pods. To restrict traffic from other pods to your backend and frontend pods, you can create network policy and allow traffic only between these pods.
To spawn pods on specific nodes, use nodeSelector or podAffinity. If you want one pod should run on each node or specific nodes then create daemonset for them.
This is not usually how things work in Kubernetes. Pod IPs would always be "private", i.e. cluster IPs that are not used with the internet. You poke specific holes into the cluster IP space using LoadBalancer-type Services. In AWS terms, all pods have private IPs and you use ELBs to bridge specific things to the public network.
This is an overly complicated way to go about this.
Why don't you rather do the following:
There is no good reason for your nodes to be exposed to the internet. Use a Loadbalancer as a cutout, and NAT gateways to ensure that your private subnets can reach the internet.
This limits your public api surface to those segments of the 'public' pods that are exposed in the public-facing services, while leaving the rest of your cluster dark.
Also,
I know that I probably should use public interfaces everywhere and resrict access with ACLs
is not a good idea. Use private interfaces everywhere, and ensure your nodes are not visible from the public internet. It is almost never a good idea to have a server reachable from the internet as a whole - it exposes you to all sorts of attacks which will be mitigated against by NAT, LoadBalancers or other intermediary systems.