Choosing pod networking use cases
The Amazon VPC CNI plugin provides networking for pods. The following table helps you
understand which networking use cases you can use together and the capabilities and Amazon VPC
CNI plugin settings that you can use with different Amazon EKS node types. All information in the
table applies to Linux IPv4
nodes only.
Amazon EKS node type | Amazon EC2 | Fargate | ||
---|---|---|---|---|
Use case | Individual IP addresses assigned to network interface | IP address prefixes assigned to network interface | Tutorial: Security groups for pods | |
Tutorial: Custom networking – Assign IP addresses from a different subnet than the node's subnet | Yes | Yes | Yes | Yes (subnets controlled through Fargate profile) |
SNAT for pods | Yes (default is false ) |
Yes (default is false ) |
Yes (true only) |
Yes (true only) |
Capabilities | ||||
Security group scope | Node | Node | Pod | Pod |
Amazon VPC subnet types | Private and public | Private and public | Private only | Private only |
Network policy (Calico) | Compatible | Compatible | Compatible Only with version |
Not supported |
Pod density per node | Medium | High | Low | One |
Pod launch time | Better | Best | Good | Moderate |
Amazon VPC CNI plugin
settings (for more information about each setting, see amazon-vpc-cni-k8s |
||||
WARM_ENI_TARGET |
Yes | Not applicable | Not applicable | Not applicable |
WARM_IP_TARGET |
Yes | Yes | Not applicable | Not applicable |
MINIMUM_IP_TARGET |
Yes | Yes | Not applicable | Not applicable |
WARM_PREFIX_TARGET |
Not applicable | Yes | Not applicable | Not applicable |
-
You can't use
IPv6
with custom networking. -
IPv6 addresses are not translated, so SNAT doesn't apply.
-
You can use Calico network policy with
IPv6
. -
Traffic flow to and from pods with associated security groups are not subjected to Calico network policy enforcement and are limited to Amazon VPC security group enforcement only.
-
IP prefixes and IP addresses are associated with standard Amazon EC2 elastic network interfaces. Pods requiring specific security groups are assigned the primary IP address of a branch network interface. You can mix pods getting IP addresses, or IP addresses from IP prefixes with pods getting branch network interfaces on the same node.
Windows nodes
Each Windows node only supports one network interface and secondary IPv4
addresses for pods.
As a result, you can't use IP address prefixes or IPv6
with Windows nodes. The maximum
number of pods for each node is equal to the number of IP addresses that you can assign
to each Elastic network interface, minus one. Calico network policies are supported on
Windows. For more information, see Open
Source Calico for Windows Containers on Amazon EKS