EKS networking with VPC CNI in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the VPC CNI plugin in Amazon EKS?

The VPC CNI plugin allows Kubernetes pods to have IP addresses from the VPC network, enabling them to communicate directly with other AWS resources using native VPC networking.

beginner

How does the VPC CNI plugin assign IP addresses to pods?

It assigns each pod an IP address from the VPC subnet, just like an EC2 instance, so pods can communicate directly with other resources in the VPC without NAT.

intermediate

Why is it important to have enough free IP addresses in your VPC subnets when using VPC CNI?

Because each pod gets its own IP from the subnet, running many pods can exhaust available IPs, causing pods to fail to start due to lack of IP addresses.

intermediate

What is the benefit of using VPC CNI over other Kubernetes networking plugins in EKS?

VPC CNI provides high performance and native AWS networking features, such as security groups and routing, making pod networking seamless with AWS infrastructure.

advanced

How can you scale the number of pods in EKS without running out of IP addresses with VPC CNI?

You can add more subnets with additional IP ranges or use features like 'prefix delegation' to allocate larger blocks of IPs to nodes, increasing available pod IPs.

What does the VPC CNI plugin assign to each Kubernetes pod in EKS?

A An IP address from the VPC subnet

B A private IP from a separate Kubernetes network

C A public IP address

D No IP address, uses node IP

VPC CNI assigns each pod an IP address from the VPC subnet, allowing direct communication within the VPC.

Why might pods fail to start when using VPC CNI in EKS?

A Because the cluster is out of CPU resources

B Because there are no free IP addresses in the subnet

C Because pods need public IPs

D Because the VPC CNI plugin is disabled

Pods need IP addresses from the subnet; if none are free, pods cannot get an IP and fail to start.

Which AWS resource's IP range does VPC CNI use for pod IPs?

A Elastic IP pool

B Internet Gateway IPs

C VPC subnet CIDR block

D AWS Lambda IP range

VPC CNI uses the VPC subnet CIDR block to assign IPs to pods.

What is a common way to increase available pod IPs in an EKS cluster using VPC CNI?

A Use public IPs for pods

B Add more nodes without changing subnets

C Disable VPC CNI plugin

D Add more subnets with larger CIDR blocks

Adding subnets with more IP addresses increases the pool of IPs available for pods.

What networking feature does VPC CNI enable for pods in EKS?

A Pods have native VPC networking with security groups

B Pods cannot communicate outside the cluster

C Pods use NAT to access the internet

D Pods share node IP addresses

VPC CNI allows pods to have native VPC networking, including security group integration.

Explain how the VPC CNI plugin manages pod networking in an EKS cluster.

Think about how pods connect to other AWS services and the IP addresses they use.

Describe strategies to avoid IP exhaustion when using VPC CNI in EKS.

Consider how IP addresses are allocated and ways to increase their availability.

Practice

1. What is the main purpose of the VPC CNI plugin in Amazon EKS?

easy

A. To assign VPC IP addresses directly to Kubernetes pods

B. To provide a web interface for managing EKS clusters

C. To store container images in Amazon S3

D. To monitor CPU usage of EKS nodes

Solution

1. Step 1: Understand VPC CNI role in EKS

   The VPC CNI plugin allows pods to get IP addresses from the VPC subnet, enabling direct networking.

2. Step 2: Compare options with VPC CNI function

   Options A, B, and D describe unrelated features like UI, storage, and monitoring, not networking.

3. Final Answer:

   To assign VPC IP addresses directly to Kubernetes pods -> Option A

4. Quick Check:

   VPC CNI assigns IPs to pods = C [OK]

Hint: VPC CNI = pod IPs from VPC subnet [OK]

Common Mistakes:

• Confusing VPC CNI with monitoring tools
• Thinking VPC CNI manages container images
• Assuming VPC CNI provides UI features

2. Which command correctly enables the AWS VPC CNI plugin on an existing EKS cluster named my-cluster using eksctl?

easy

A. eksctl create cluster --name my-cluster --enable-vpc-cni

B. eksctl utils update-cni --cluster my-cluster

C. aws eks enable-cni --cluster-name my-cluster

D. kubectl apply -f vpc-cni.yaml

Solution

1. Step 1: Identify eksctl command to update CNI

   The correct eksctl command to update or enable the VPC CNI plugin on an existing cluster is eksctl utils update-cni --cluster my-cluster.

2. Step 2: Eliminate incorrect commands

   eksctl create cluster --name my-cluster --enable-vpc-cni creates a new cluster, not update CNI. aws eks enable-cni --cluster-name my-cluster is invalid AWS CLI syntax. kubectl apply -f vpc-cni.yaml applies a manifest but does not enable CNI via eksctl.

3. Final Answer:

   eksctl utils update-cni --cluster my-cluster -> Option B

4. Quick Check:

   eksctl update-cni command = A [OK]

Hint: Use eksctl utils update-cni for existing clusters [OK]

Common Mistakes:

• Using create cluster instead of update-cni
• Trying invalid AWS CLI commands
• Applying manifests without eksctl update

3. Given the following pod spec snippet using AWS VPC CNI, what IP address range will the pod likely receive?

{
  "metadata": {"name": "mypod"},
  "spec": {
    "containers": [{"name": "app", "image": "nginx"}],
    "nodeSelector": {"eks.amazonaws.com/nodegroup": "group1"}
  }
}

Assuming the VPC subnet CIDR is 10.0.0.0/16 and the node group subnet is 10.0.1.0/24.

medium

A. An IP from 10.0.1.0/24 subnet

B. An IP from 192.168.0.0/16 subnet

C. An IP from 172.16.0.0/12 subnet

D. An IP from 127.0.0.1 loopback

Solution

1. Step 1: Understand VPC CNI IP assignment

   VPC CNI assigns pod IPs from the subnet of the node where the pod runs. Here, node group subnet is 10.0.1.0/24.

2. Step 2: Match pod IP range with node subnet

   Since the pod runs on a node in 10.0.1.0/24 subnet, pod IP will be from that subnet, not from unrelated ranges.

3. Final Answer:

   An IP from 10.0.1.0/24 subnet -> Option A

4. Quick Check:

   Pod IP = node subnet CIDR = B [OK]

Hint: Pod IPs come from node subnet CIDR [OK]

Common Mistakes:

• Assuming pod IPs come from unrelated subnets
• Confusing pod IP with loopback or private ranges
• Ignoring node group subnet CIDR

4. You deployed the VPC CNI plugin but pods fail to get IP addresses and remain in Pending state. What is the most likely cause?

medium

A. The EKS cluster control plane is stopped

B. The pod image is missing from the container registry

C. The VPC subnet has no available IP addresses left

D. The Kubernetes API server is overloaded

Solution

1. Step 1: Identify reason pods stay Pending with VPC CNI

   If pods cannot get IPs, a common cause is no free IPs in the VPC subnet used by nodes.

2. Step 2: Exclude unrelated causes

   Pod image missing causes image pull errors, not IP issues. Control plane stopped or API overload cause cluster-wide failures, not just IP assignment.

3. Final Answer:

   The VPC subnet has no available IP addresses left -> Option C

4. Quick Check:

   Pods Pending due to no IPs = A [OK]

Hint: No free IPs in subnet causes pod Pending [OK]

Common Mistakes:

• Blaming image pull errors for IP assignment issues
• Assuming control plane is stopped without checking
• Ignoring subnet IP exhaustion

5. You want to optimize your EKS cluster networking to support thousands of pods per node using the VPC CNI plugin. Which configuration change should you apply?

hard

A. Reduce the pod security policies to allow more pods

B. Increase the node instance type to the largest available

C. Disable the VPC CNI plugin and use Calico instead

D. Enable the 'WARM_IP_TARGET' setting to pre-allocate more IP addresses per node

Solution

1. Step 1: Understand how to scale pod IPs with VPC CNI

   The VPC CNI plugin uses environment variables like 'WARM_IP_TARGET' to keep extra IPs ready per node, allowing more pods to launch quickly.

2. Step 2: Evaluate other options

   Increasing instance size helps but does not directly increase IPs. Disabling VPC CNI changes networking model. Pod security policies do not affect IP allocation.

3. Final Answer:

   Enable the 'WARM_IP_TARGET' setting to pre-allocate more IP addresses per node -> Option D

4. Quick Check:

   WARM_IP_TARGET pre-allocates IPs = D [OK]

Hint: Use WARM_IP_TARGET to pre-allocate pod IPs [OK]

Common Mistakes:

• Thinking instance size alone increases IPs
• Confusing network plugins instead of tuning VPC CNI
• Misunderstanding pod security policies impact