EKS Architecture
See how the AWS-managed control plane connects to your worker node groups inside your own VPC.
An EKS cluster spans two ownership boundaries: the AWS-managed control plane and your VPC where worker nodes and pods live.
Each worker node runs the kubelet, which registers with the control plane and reports pod health. Elastic Network Interfaces (ENIs) attached to your nodes let the control plane reach pods.
Example
# Nodes in your VPC that have joined the managed control plane
kubectl get nodes -o wide
# The VPC and subnets the cluster is wired into
aws eks describe-cluster --name demo \
--query 'cluster.resourcesVpcConfig.{vpc:vpcId,subnets:subnetIds}'When to use it
- A security team designs private EKS clusters where the control plane endpoint is accessible only from within the VPC, reducing attack surface.
- An SRE team spreads node groups across three Availability Zones to ensure pods keep running even if one AZ experiences an outage.
- A platform team deploys the AWS VPC CNI so each pod gets a routable VPC IP, enabling direct integration with RDS security group rules.
More examples
Inspect node AZ distribution
Shows which Availability Zone each worker node is in, verifying the cluster spans multiple AZs for high availability.
kubectl get nodes -o custom-columns=\
'NODE:.metadata.name,AZ:.metadata.labels.topology\.kubernetes\.io/zone'Multi-AZ node group config
eksctl ClusterConfig that pins the node group to all three AZs, matching the multi-AZ managed control plane topology.
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
name: prod
region: us-east-1
managedNodeGroups:
- name: workers
instanceType: m5.large
minSize: 3
maxSize: 9
availabilityZones: ["us-east-1a", "us-east-1b", "us-east-1c"]Lock down control plane endpoint
Disables the public API server endpoint so kubectl access is restricted to within the VPC — a standard EKS hardening step.
aws eks update-cluster-config \
--name prod \
--resources-vpc-config \
endpointPublicAccess=false,endpointPrivateAccess=true
Discussion