Amazon EKS — VPC CNI Plugin

1 minute read

VPC CNI Plugin

The Amazon VPC CNI plugin is what makes EKS networking unique. Unlike other Kubernetes CNIs that use overlay networks, every pod gets a real VPC IP address.

How VPC CNI Works

VPC CNI — IP Address Assignment
┌──────────────────────────────────────────────────────┐
│  Node: 10.0.1.10                                     │
│                                                      │
│  eth0 (primary ENI)    eth1 (secondary ENI)          │
│  ┌─────────────────┐   ┌─────────────────┐          │
│  │ 10.0.1.10 (node)│   │ 10.0.1.50       │          │
│  │ 10.0.1.11 (pod) │   │ 10.0.1.51 (pod) │          │
│  │ 10.0.1.12 (pod) │   │ 10.0.1.52 (pod) │          │
│  │ 10.0.1.13 (pod) │   │ 10.0.1.53 (pod) │          │
│  └─────────────────┘   └─────────────────┘          │
│                                                      │
│  Total: 1 node IP + 7 pod IPs = 8 VPC IPs consumed  │
└──────────────────────────────────────────────────────┘

Why VPC-Native Networking?

Feature VPC CNI Overlay CNI (Calico, Flannel)
Pod IP Real VPC IP Private overlay IP
Security groups Applied to pods Only at node level
VPC Flow Logs See pod-level traffic See only node traffic
Direct connectivity Pods reachable from VPC Need NAT/proxy
IP consumption High (every pod = 1 VPC IP) Low (overlay reuses)
Performance Native (no encapsulation) Slight overhead

ENI and IP Warm Pool

VPC CNI pre-allocates IPs for fast pod scheduling:

Environment Variables (aws-node DaemonSet):
┌──────────────────────────────────────────────────────┐
│  WARM_ENI_TARGET = 1                                 │
│  → Keep 1 extra ENI attached (with all its IPs)      │
│                                                      │
│  WARM_IP_TARGET = 5                                  │
│  → Keep 5 pre-allocated IPs ready for new pods       │
│                                                      │
│  MINIMUM_IP_TARGET = 10                              │
│  → Always have at least 10 IPs allocated             │
└──────────────────────────────────────────────────────┘

Configure VPC CNI

# Check current version
$ kubectl describe daemonset aws-node -n kube-system | grep Image
    Image: 602401143452.dkr.ecr.us-east-1.amazonaws.com/amazon-k8s-cni:v1.15.1

# Update via EKS addon
$ aws eks update-addon \
    --cluster-name demo \
    --addon-name vpc-cni \
    --resolve-conflicts OVERWRITE

Common Mistakes

Mistake Impact
Small subnets (/24) with VPC CNI IP exhaustion (each pod needs a VPC IP)
Not tuning WARM_IP_TARGET Wastes IPs or slow pod scheduling
Ignoring max pods per instance Pods stuck in Pending
Not enabling prefix delegation for large clusters IP exhaustion

Quick Reference

# Check pod IPs
$ kubectl get pods -o wide

# Check CNI version
$ kubectl describe ds aws-node -n kube-system | grep Image

# Check IP allocation on a node
$ kubectl exec -n kube-system <aws-node-pod> -- /opt/cni/bin/aws-cni-support.sh

What’s Next?

How pods talk to each other: Pod Networking.

You may also enjoy