EKS networking with VPC CNI in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does the VPC CNI plugin assign IP addresses to pods in EKS?

In Amazon EKS using the VPC CNI plugin, how are IP addresses assigned to pods?

A Pods use NAT to translate their IP addresses to the node's IP address for external communication.

B Pods share the node's IP address and use port mapping to communicate externally.

C Pods receive IP addresses from the Kubernetes cluster CIDR, separate from the VPC subnet.

D Pods receive IP addresses directly from the VPC subnet, making them part of the VPC network.

💡 Hint

Think about how pods integrate with the VPC network for direct connectivity.

The VPC CNI plugin assigns IP addresses to pods from the VPC subnet, so pods appear as native VPC network interfaces. This allows pods to communicate directly with other AWS resources without NAT.

❓ Architecture

intermediate

Choosing subnets for EKS nodes with VPC CNI

You are designing an EKS cluster with the VPC CNI plugin enabled. Which subnet type should you select for your worker nodes to ensure pods get IP addresses correctly?

A Public subnets with auto-assign public IP enabled.

B Any subnet type, as subnet choice does not affect pod IP assignment.

C Private subnets with NAT gateway for internet access.

D Isolated subnets without any route to the internet.

💡 Hint

Consider where pods get their IPs and how nodes communicate externally.

Worker nodes should be in private subnets with NAT gateways to allow nodes and pods to access the internet securely. Pods get IPs from the subnet, so subnet choice affects IP availability and routing.

❓ Configuration

advanced

Effect of setting AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG to true

What is the effect of setting the environment variable AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG to true in the VPC CNI plugin configuration?

A It enables automatic scaling of the number of ENIs attached to nodes.

B It enables the plugin to allocate IP addresses from multiple custom subnets instead of the default ones.

C It forces the plugin to assign IP addresses only from the primary subnet of the VPC.

D It disables the VPC CNI plugin and uses the default Kubernetes networking instead.

💡 Hint

Think about customizing IP address allocation sources.

Setting AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG=true allows the VPC CNI plugin to allocate IP addresses from custom subnets specified by the user, enabling advanced networking setups.

❓ security

advanced

Security group requirements for EKS nodes using VPC CNI

Which security group rule is essential for EKS worker nodes to allow pod networking when using the VPC CNI plugin?

A Allow all traffic between nodes within the security group.

B Allow inbound TCP traffic on port 443 from the internet.

C Allow outbound UDP traffic on port 53 to the internet.

D Allow inbound ICMP traffic from any source.

💡 Hint

Consider how pods communicate across nodes inside the cluster.

Nodes must allow all traffic between themselves to enable pod-to-pod communication across nodes, as pods get IPs from the VPC subnet and communicate directly.

❓ service_behavior

expert

Impact of ENI and IP address limits on pod density per node

Given an EC2 instance type with a maximum of 4 ENIs and 15 IP addresses per ENI, what is the maximum number of pods that can be scheduled on a single node using the VPC CNI plugin?

A 56 pods, because one IP per ENI is reserved for the node itself.

B 60 pods, because each ENI provides 15 IPs and 4 ENIs are allowed.

C 56 pods, because two IPs per ENI are reserved for AWS networking.

D 64 pods, because the plugin can assign IPs beyond ENI limits.

💡 Hint

Remember that the node uses one IP per ENI, reducing available pod IPs.

Each ENI has 15 IPs, but one IP per ENI is used by the node, leaving 14 IPs per ENI for pods. With 4 ENIs, 4 * 14 = 56 pod IPs. The primary ENI is counted the same way, so total pods = (4 ENIs * 15 IPs) - 4 reserved IPs = 56 pods.

Practice

1. What is the main purpose of the VPC CNI plugin in Amazon EKS?

easy

A. To assign VPC IP addresses directly to Kubernetes pods

B. To provide a web interface for managing EKS clusters

C. To store container images in Amazon S3

D. To monitor CPU usage of EKS nodes

Solution

1. Step 1: Understand VPC CNI role in EKS

   The VPC CNI plugin allows pods to get IP addresses from the VPC subnet, enabling direct networking.

2. Step 2: Compare options with VPC CNI function

   Options A, B, and D describe unrelated features like UI, storage, and monitoring, not networking.

3. Final Answer:

   To assign VPC IP addresses directly to Kubernetes pods -> Option A

4. Quick Check:

   VPC CNI assigns IPs to pods = C [OK]

Hint: VPC CNI = pod IPs from VPC subnet [OK]

Common Mistakes:

• Confusing VPC CNI with monitoring tools
• Thinking VPC CNI manages container images
• Assuming VPC CNI provides UI features

2. Which command correctly enables the AWS VPC CNI plugin on an existing EKS cluster named my-cluster using eksctl?

easy

A. eksctl create cluster --name my-cluster --enable-vpc-cni

B. eksctl utils update-cni --cluster my-cluster

C. aws eks enable-cni --cluster-name my-cluster

D. kubectl apply -f vpc-cni.yaml

Solution

1. Step 1: Identify eksctl command to update CNI

   The correct eksctl command to update or enable the VPC CNI plugin on an existing cluster is eksctl utils update-cni --cluster my-cluster.

2. Step 2: Eliminate incorrect commands

   eksctl create cluster --name my-cluster --enable-vpc-cni creates a new cluster, not update CNI. aws eks enable-cni --cluster-name my-cluster is invalid AWS CLI syntax. kubectl apply -f vpc-cni.yaml applies a manifest but does not enable CNI via eksctl.

3. Final Answer:

   eksctl utils update-cni --cluster my-cluster -> Option B

4. Quick Check:

   eksctl update-cni command = A [OK]

Hint: Use eksctl utils update-cni for existing clusters [OK]

Common Mistakes:

• Using create cluster instead of update-cni
• Trying invalid AWS CLI commands
• Applying manifests without eksctl update

3. Given the following pod spec snippet using AWS VPC CNI, what IP address range will the pod likely receive?

{
  "metadata": {"name": "mypod"},
  "spec": {
    "containers": [{"name": "app", "image": "nginx"}],
    "nodeSelector": {"eks.amazonaws.com/nodegroup": "group1"}
  }
}

Assuming the VPC subnet CIDR is 10.0.0.0/16 and the node group subnet is 10.0.1.0/24.

medium

A. An IP from 10.0.1.0/24 subnet

B. An IP from 192.168.0.0/16 subnet

C. An IP from 172.16.0.0/12 subnet

D. An IP from 127.0.0.1 loopback

Solution

1. Step 1: Understand VPC CNI IP assignment

   VPC CNI assigns pod IPs from the subnet of the node where the pod runs. Here, node group subnet is 10.0.1.0/24.

2. Step 2: Match pod IP range with node subnet

   Since the pod runs on a node in 10.0.1.0/24 subnet, pod IP will be from that subnet, not from unrelated ranges.

3. Final Answer:

   An IP from 10.0.1.0/24 subnet -> Option A

4. Quick Check:

   Pod IP = node subnet CIDR = B [OK]

Hint: Pod IPs come from node subnet CIDR [OK]

Common Mistakes:

• Assuming pod IPs come from unrelated subnets
• Confusing pod IP with loopback or private ranges
• Ignoring node group subnet CIDR

4. You deployed the VPC CNI plugin but pods fail to get IP addresses and remain in Pending state. What is the most likely cause?

medium

A. The EKS cluster control plane is stopped

B. The pod image is missing from the container registry

C. The VPC subnet has no available IP addresses left

D. The Kubernetes API server is overloaded

Solution

1. Step 1: Identify reason pods stay Pending with VPC CNI

   If pods cannot get IPs, a common cause is no free IPs in the VPC subnet used by nodes.

2. Step 2: Exclude unrelated causes

   Pod image missing causes image pull errors, not IP issues. Control plane stopped or API overload cause cluster-wide failures, not just IP assignment.

3. Final Answer:

   The VPC subnet has no available IP addresses left -> Option C

4. Quick Check:

   Pods Pending due to no IPs = A [OK]

Hint: No free IPs in subnet causes pod Pending [OK]

Common Mistakes:

• Blaming image pull errors for IP assignment issues
• Assuming control plane is stopped without checking
• Ignoring subnet IP exhaustion

5. You want to optimize your EKS cluster networking to support thousands of pods per node using the VPC CNI plugin. Which configuration change should you apply?

hard

A. Reduce the pod security policies to allow more pods

B. Increase the node instance type to the largest available

C. Disable the VPC CNI plugin and use Calico instead

D. Enable the 'WARM_IP_TARGET' setting to pre-allocate more IP addresses per node

Solution

1. Step 1: Understand how to scale pod IPs with VPC CNI

   The VPC CNI plugin uses environment variables like 'WARM_IP_TARGET' to keep extra IPs ready per node, allowing more pods to launch quickly.

2. Step 2: Evaluate other options

   Increasing instance size helps but does not directly increase IPs. Disabling VPC CNI changes networking model. Pod security policies do not affect IP allocation.

3. Final Answer:

   Enable the 'WARM_IP_TARGET' setting to pre-allocate more IP addresses per node -> Option D

4. Quick Check:

   WARM_IP_TARGET pre-allocates IPs = D [OK]

Hint: Use WARM_IP_TARGET to pre-allocate pod IPs [OK]

Common Mistakes:

• Thinking instance size alone increases IPs
• Confusing network plugins instead of tuning VPC CNI
• Misunderstanding pod security policies impact