Amazon EKS — Networking — Practice Exercises

3 minute read

Chapter 7 — Practice Exercises

Exercise 1: VPC CNI IP Calculation

Question: You have an m5.large (3 ENIs, 10 IPs per ENI) running 25 pods. With standard VPC CNI, how many VPC IPs are consumed by this single node? What if you enabled prefix delegation?

Show Solution

Standard VPC CNI:

Node IP: 1
Pod IPs: 25
Warm pool (WARM_IP_TARGET default ~1-2 ENIs): ~10
Total consumed: ~36 VPC IPs

But: m5.large max is 29 pods (3 ENIs × 10 - 1)
So 25 pods would use ~26 IPs (1 node + 25 pods)
Plus warm pool IPs that are pre-allocated

With prefix delegation:

Node IP: 1
Each ENI slot gets a /28 prefix (16 IPs)
Allocated: 2-3 prefixes = 32-48 IPs reserved
But only 25 actually used by pods
Max pods increases to 110

Key insight: VPC CNI always consumes more IPs than the number of running pods due to the warm pool.

Exercise 2: Service Discovery

Question: Pod frontend in namespace web needs to call pod api in namespace backend on port 3000. What DNS name should frontend use? Write the Service YAML for the api service.

Show Solution

DNS name: api.backend.svc.cluster.local:3000 (or shorthand: api.backend:3000)

Service YAML:

apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: backend
spec:
  type: ClusterIP
  selector:
    app: api
  ports:
    - port: 3000
      targetPort: 3000

Frontend code: http://api.backend:3000/endpoint

Exercise 3: Network Policy

Question: Write a NetworkPolicy that: (a) denies all ingress to pods labeled app: database in namespace production, then (b) allows only pods labeled app: backend to connect on port 5432.

Show Solution 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend
      ports:
        - port: 5432
          protocol: TCP

This single policy both denies all (by listing Ingress in policyTypes) and allows backend (via the ingress rule). Any traffic not matching the rule is denied.

Exercise 4: Troubleshoot DNS Failure

Question: Pods can’t resolve service names. nslookup kubernetes from a test pod returns SERVFAIL. List 5 things to check.

Show Solution 
# 1. Check CoreDNS pods are running
$ kubectl get pods -n kube-system -l k8s-app=kube-dns
# Should show 2 Running pods

# 2. Check CoreDNS logs for errors
$ kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50

# 3. Check CoreDNS Service has endpoints
$ kubectl get endpoints kube-dns -n kube-system
# Should show IPs of CoreDNS pods

# 4. Check pod DNS config
$ kubectl exec <test-pod> -- cat /etc/resolv.conf
# Should show nameserver pointing to kube-dns ClusterIP

# 5. Check network connectivity to CoreDNS
$ kubectl exec <test-pod> -- nc -zv <coredns-ip> 53

Common causes: CoreDNS crashed, Service has no endpoints, security group blocking port 53, node-level DNS issue.

Exercise 5: IP Exhaustion

Question: Your cluster is reporting FailedCreatePodSandBox: failed to assign an IP address to container. The subnet has 100 IPs remaining, but your 20 nodes each have 15 pods. What’s happening and how do you fix it?

Show Solution

What’s happening:

Active pods: 20 nodes × 15 pods = 300 pod IPs
Node IPs: 20
Warm pool: 20 nodes × ~10 warm IPs = 200 pre-allocated
Total consumed: 300 + 20 + 200 = 520 IPs

If your subnet only had 620 IPs (/22), adding a few more pods
could exhaust the remaining 100 IPs.

Fixes (in order of effort):

  1. Reduce warm pool: 
    $ kubectl set env ds aws-node -n kube-system WARM_IP_TARGET=2 WARM_ENI_TARGET=0
  2. Enable prefix delegation: 
    $ kubectl set env ds aws-node -n kube-system ENABLE_PREFIX_DELEGATION=true

  3. Use custom networking with a larger secondary CIDR (100.64.0.0/16)

  4. Use larger subnets — migrate to /18 subnets if possible

What’s Next?

Persistent storage: Chapter 8 — Storage.

You may also enjoy