Amazon EKS — Pod Networking

Pod Networking

Understanding how pods communicate is fundamental to running applications on EKS. Every pod gets its own IP, and all pods can reach all other pods without NAT.

---

The Four Networking Scenarios

EKS Networking Paths
┌─────────────────────────────────────────────────────────┐
│                                                         │
│  1. Pod-to-Pod (same node)     2. Pod-to-Pod (diff node)│
│  ┌──────────────────┐         ┌──────┐     ┌──────┐   │
│  │ ┌────┐   ┌────┐  │         │┌────┐│     │┌────┐│   │
│  │ │PodA│──▶│PodB│  │         ││PodA│├────▶││PodC││   │
│  │ └────┘   └────┘  │         │└────┘│ VPC │└────┘│   │
│  │   (veth bridge)   │         └──────┘     └──────┘   │
│  └──────────────────┘                                   │
│                                                         │
│  3. Pod-to-Service             4. External-to-Pod       │
│  ┌────┐    ┌─────────┐        Internet ──▶ LB ──▶ Pod  │
│  │Pod │──▶ │ClusterIP│──▶Pod                            │
│  └────┘    └─────────┘                                  │
│   (kube-proxy / iptables)     (LoadBalancer Service)    │
└─────────────────────────────────────────────────────────┘

---

Pod-to-Pod (Same Node)

Traffic stays on the node, routed through the Linux bridge:

PodA (10.0.1.11) → veth → bridge → veth → PodB (10.0.1.12)

No network overhead — fastest path.

---

Pod-to-Pod (Different Nodes)

VPC routing handles it natively (no overlay):

PodA (10.0.1.11) → Node1 eth0 → VPC → Node2 eth0 → PodC (10.0.2.15)

Since pod IPs are real VPC IPs, the VPC route table routes traffic directly.

---

Pod-to-Service

Kubernetes Services provide stable endpoints. kube-proxy manages the routing:

# Create a Service
$ kubectl expose deployment web --port=80 --type=ClusterIP

# The Service gets a cluster IP
$ kubectl get svc web
NAME   TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)
web    ClusterIP   172.20.45.67   <none>        80/TCP

---

Security Groups for Pods

EKS supports assigning security groups directly to pods:

apiVersion: vpcresources.k8s.aws/v1beta1
kind: SecurityGroupPolicy
metadata:
  name: my-policy
spec:
  podSelector:
    matchLabels:
      app: database
  securityGroups:
    groupIds:
      - sg-0abc123def456   # Database security group

This is a unique EKS feature — most K8s distributions only support security at the node level.

---

Common Mistakes

Mistake	Impact
Assuming pod IPs are stable	Pod IPs change on restart — use Services
Security groups blocking node-to-node	Pods can’t communicate across nodes
Not opening port 443 (node → control plane)	kubelet can’t reach API server

---

What’s Next?

Service discovery and DNS: Services & DNS.