How does EKS default networking change when Amazon VPC CNI plugin is enabled?

5/22/2020

I am trying to figure out the benefit of using Amazon VPC CNI plugin. If my understanding is correct it does use a ENI which allows pods to be "dual homed", meaning that they have presence even in the VPC subnet in which its EC2 instance resides.

Amazon VPC CNI plugin enables it, by keeping a pool of addresses that are assigned to the pod and to its instance as secondary addresses (thanks to the Elastic Network Interface).

(1) Is my understanding correct?

Considering Kubernetes standards, how does it fit with default networking behaviors? I mean, (2) does it mean that PodIP is no longer a cluster internal-only ip address, so that I can send traffic to my pod by using the relevant instance-attached secondary IP? When it comes to Kubernetes Services of type ClusterIP (that leverage on Virtual IPs), (3) do they adopt the same logic in some way? Maybe I'm going too further with my imagination, but (4) it sounds like a Kubernetes Service with presence in the VPC can be used as a full-fledged (but NOT highly available) internal load balancer. (5) What happens with NodePort? Do they overlap?

Has anyone already used this plugin? Can you kindly advise? (6) What are other benefit or use cases?

Many thanks!

-- amenic
amazon-web-services
eks
kubernetes
networking

0 Answers