How does the Amazon VPC CNI work, and why do EKS clusters run out of IP addresses?

Summary

The VPC CNI gives every pod a real IP address from the VPC subnet by attaching elastic network interfaces (ENIs) with secondary IPs to nodes. Pods are directly routable in the VPC, which is simple and fast, but each pod consumes a subnet IP, and each instance type supports a limited number of ENIs and IPs per ENI, which caps pods per node.

Longer Answer

IP exhaustion happens with small subnets, many small pods, or the CNI pre-allocating warm IPs. Mitigations:

• Size subnets generously (for example /19 or larger for node subnets) when creating the VPC.
• Prefix delegation: assign /28 prefixes to ENIs, greatly increasing pods per node and allocation speed.
• Custom networking with a secondary CIDR (for example from the 100.64.0.0/10 range) for pod IPs.
• Tune warm pool settings (WARM_IP_TARGET, MINIMUM_IP_TARGET).
• IPv6 clusters avoid IPv4 scarcity entirely.

Key Points

• Pods get VPC IPs via ENIs.
• Pods per node limited by ENIs/IPs.
• Prefix delegation, secondary CIDRs, IPv6.
• Plan subnet sizes early.