EKS interview question · Most asked
How should you design the VPC and subnets for an EKS cluster?
Summary
Use at least two, preferably three, Availability Zones; put nodes and pods in private subnets with enough IP space for future growth (the VPC CNI uses VPC IPs for pods); use public subnets only for internet-facing load balancers and NAT gateways; tag subnets so the load balancer controller can discover them; and plan for egress costs and limits.
Longer Answer
Considerations: NAT gateway per AZ for resilience (and cost of data processing through NAT); VPC endpoints (ECR, S3, STS, CloudWatch) to keep image pulls and AWS API calls off NAT and cheaper; separate subnets or secondary CIDRs for pods if IPv4 is tight; security groups for the cluster and nodes; and private cluster endpoints or restricted public endpoint CIDRs. Changing a cluster's subnets later is constrained, so get the layout right early.
Key Points
- Multi-AZ private subnets with ample IPs.
- Public subnets for ALBs and NAT.
- VPC endpoints to cut NAT traffic.
- Plan early; changes are hard.
More most-asked EKS questions
- What is Amazon EKS, and what does AWS manage versus what do you manage?
- Compare the EKS compute options: managed node groups, self-managed nodes, Fargate, Karpenter and EKS Auto Mode.
- How does the Amazon VPC CNI work, and why do EKS clusters run out of IP addresses?
- IRSA or EKS Pod Identity: how do pods get AWS permissions?
- How do you expose services on EKS? Explain the AWS Load Balancer Controller.
- How do you upgrade an EKS cluster, and what are standard and extended support?
- Why is Karpenter popular on EKS, and how does it differ from the Cluster Autoscaler?
- How do you secure an EKS cluster end to end?