The AWS VPC CNI

The Amazon VPC CNI gives every pod a real IP address from your VPC subnet.

EKS uses the Amazon VPC CNI plugin for pod networking. Unlike overlay networks, it assigns each pod a genuine VPC IP address, so pods are first-class citizens on your network.

VPC CNI attaching VPC IP addresses to pods via ENIs on a nodeVPC Subnet 10.0.1.0/24EC2 Worker NodeENI (primary)10.0.1.10ENI (secondary)10.0.1.11Pod A10.0.1.20Pod B10.0.1.21Pod C10.0.1.22Pods get real VPC IPs — routable, no overlay.
The CNI attaches ENIs to the node and hands their secondary IPs to pods, so every pod is directly reachable within the VPC.

Why it matters

  • Pods talk to other AWS services and on-prem networks with no NAT or tunneling.
  • Security groups and VPC flow logs work on pod traffic.
  • Plan your subnets — a busy cluster consumes many IPs. Size your CIDR ranges generously.

Example

Example · bash
# The VPC CNI runs as a DaemonSet called aws-node
kubectl get daemonset aws-node -n kube-system

# Inspect the installed CNI add-on version
aws eks describe-addon --cluster-name demo \
  --addon-name vpc-cni --query 'addon.addonVersion'

When to use it

  • A security team attaches VPC security groups directly to pods running a payment service, controlling inbound traffic at the pod IP level instead of the node level.
  • A platform team enables prefix delegation on the VPC CNI to fit 14x more pods per node on their /24 subnets without adding new IP ranges.
  • A network engineer troubleshoots pod connectivity by checking pod IPs in the VPC flow logs, possible because each pod has a real VPC address.

More examples

Check CNI version and config

Shows the running VPC CNI image version and its configuration map, useful for verifying CNI settings like WARM_IP_TARGET.

Example · bash
kubectl get daemonset aws-node -n kube-system \
  -o jsonpath='{.spec.template.spec.containers[0].image}'
kubectl get configmap amazon-vpc-cni -n kube-system -o yaml

Enable prefix delegation

Enables prefix delegation so each node ENI attachment assigns a /28 prefix (16 IPs) instead of one IP, greatly increasing pod density per node.

Example · bash
kubectl set env daemonset aws-node \
  -n kube-system \
  ENABLE_PREFIX_DELEGATION=true \
  WARM_PREFIX_TARGET=1

Describe pod IP from VPC CNI

Retrieves a pod's real VPC IP and looks it up in EC2 to confirm the CNI assigned it from the node's ENI — demonstrating true VPC integration.

Example · bash
kubectl get pod my-app-7d9f8b-xyz \
  -o jsonpath='{.status.podIP}'
# Output: 10.0.1.45
aws ec2 describe-network-interfaces \
  --filters Name=private-ip-address,Values=10.0.1.45

Related

eks security groups podseks architecture

Discussion

  • Be the first to comment on this lesson.