EKS networking with VPC CNI in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does the VPC CNI plugin assign IP addresses to pods in EKS?

In Amazon EKS using the VPC CNI plugin, how are IP addresses assigned to pods?

A Pods use NAT to translate their IP addresses to the node's IP address for external communication.

B Pods share the node's IP address and use port mapping to communicate externally.

C Pods receive IP addresses from the Kubernetes cluster CIDR, separate from the VPC subnet.

D Pods receive IP addresses directly from the VPC subnet, making them part of the VPC network.

💡 Hint

Think about how pods integrate with the VPC network for direct connectivity.

The VPC CNI plugin assigns IP addresses to pods from the VPC subnet, so pods appear as native VPC network interfaces. This allows pods to communicate directly with other AWS resources without NAT.

❓ Architecture

intermediate

Choosing subnets for EKS nodes with VPC CNI

You are designing an EKS cluster with the VPC CNI plugin enabled. Which subnet type should you select for your worker nodes to ensure pods get IP addresses correctly?

A Public subnets with auto-assign public IP enabled.

B Any subnet type, as subnet choice does not affect pod IP assignment.

C Private subnets with NAT gateway for internet access.

D Isolated subnets without any route to the internet.

💡 Hint

Consider where pods get their IPs and how nodes communicate externally.

Worker nodes should be in private subnets with NAT gateways to allow nodes and pods to access the internet securely. Pods get IPs from the subnet, so subnet choice affects IP availability and routing.

❓ Configuration

advanced

Effect of setting AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG to true

What is the effect of setting the environment variable AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG to true in the VPC CNI plugin configuration?

A It enables automatic scaling of the number of ENIs attached to nodes.

B It enables the plugin to allocate IP addresses from multiple custom subnets instead of the default ones.

C It forces the plugin to assign IP addresses only from the primary subnet of the VPC.

D It disables the VPC CNI plugin and uses the default Kubernetes networking instead.

💡 Hint

Think about customizing IP address allocation sources.

Setting AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG=true allows the VPC CNI plugin to allocate IP addresses from custom subnets specified by the user, enabling advanced networking setups.

❓ security

advanced

Security group requirements for EKS nodes using VPC CNI

Which security group rule is essential for EKS worker nodes to allow pod networking when using the VPC CNI plugin?

A Allow all traffic between nodes within the security group.

B Allow inbound TCP traffic on port 443 from the internet.

C Allow outbound UDP traffic on port 53 to the internet.

D Allow inbound ICMP traffic from any source.

💡 Hint

Consider how pods communicate across nodes inside the cluster.

Nodes must allow all traffic between themselves to enable pod-to-pod communication across nodes, as pods get IPs from the VPC subnet and communicate directly.

❓ service_behavior

expert

Impact of ENI and IP address limits on pod density per node

Given an EC2 instance type with a maximum of 4 ENIs and 15 IP addresses per ENI, what is the maximum number of pods that can be scheduled on a single node using the VPC CNI plugin?

A 56 pods, because one IP per ENI is reserved for the node itself.

B 60 pods, because each ENI provides 15 IPs and 4 ENIs are allowed.

C 56 pods, because two IPs per ENI are reserved for AWS networking.

D 64 pods, because the plugin can assign IPs beyond ENI limits.

💡 Hint

Remember that the node uses one IP per ENI, reducing available pod IPs.

Each ENI has 15 IPs, but one IP per ENI is used by the node, leaving 14 IPs per ENI for pods. With 4 ENIs, 4 * 14 = 56 pod IPs. The primary ENI is counted the same way, so total pods = (4 ENIs * 15 IPs) - 4 reserved IPs = 56 pods.