Amazon EKS — Production Networking Checklist

A solid network foundation prevents outages and security incidents. Validate every item before going live.

---

VPC & Subnets

• VPC CIDR is large enough — /16 recommended for growth; EKS pods consume IPs rapidly
• Private subnets in 3+ AZs — for node placement and HA
• Public subnets in 3+ AZs — for load balancers (not for nodes)
• Nodes in private subnets only — never place production nodes in public subnets
• Subnet tags applied:
  • kubernetes.io/role/internal-elb = 1 on private subnets
  • kubernetes.io/role/elb = 1 on public subnets
  • kubernetes.io/cluster/<name> = shared on all EKS subnets
• Secondary CIDR available — for future IP expansion (100.64.0.0/16)

NAT Gateway

• One NAT Gateway per AZ — for high availability (single NAT = single point of failure)
• NAT Gateway in public subnet — with Elastic IP
• Private route tables route 0.0.0.0/0 through NAT Gateway

DNS

• CoreDNS running with 2+ replicas — for DNS HA
• CoreDNS PDB configured — at least 1 available during disruptions
• ndots optimization — set ndots:2 for pods making frequent external DNS queries
• Private hosted zones (if needed) — Route 53 Resolver for hybrid DNS

API Server Endpoint

• Private endpoint enabled — endpointPrivateAccess: true
• Public endpoint restricted — publicAccessCidrs limited to office/VPN IPs (or disabled entirely)

VPC CNI

• VPC CNI is latest stable version — aws eks describe-addon --addon-name vpc-cni
• Prefix delegation enabled — for high pod density (>100 pods per node)
• Custom networking (if needed) — separate pod CIDR from node CIDR
• VPC CNI uses IRSA — not node IAM role for CNI permissions

Load Balancing

• AWS Load Balancer Controller installed — via Helm with IRSA
• Target type is ip — for direct pod routing (lower latency)
• Health checks configured — on Ingress/Service annotations
• SSL termination — ACM certificates on ALB
• WAF attached (if needed) — for web application protection

Network Policies

• Network policy engine installed — Calico, Cilium, or VPC CNI network policy
• Default deny policies — per namespace to restrict lateral movement
• Explicit allow rules — only for approved traffic flows

---

Validation Commands

# Check subnet IPs remaining
aws ec2 describe-subnets --filters "Name=tag:kubernetes.io/cluster/my-cluster,Values=*" \
  --query 'Subnets[*].{ID:SubnetId,AZ:AvailabilityZone,FreeIPs:AvailableIpAddressCount,CIDR:CidrBlock}' \
  --output table

# Check endpoint configuration
aws eks describe-cluster --name my-cluster \
  --query 'cluster.resourcesVpcConfig.{Public:endpointPublicAccess,Private:endpointPrivateAccess,CIDRs:publicAccessCidrs}'

# Check VPC CNI version
aws eks describe-addon --cluster-name my-cluster --addon-name vpc-cni --query 'addon.addonVersion'

# Check CoreDNS replicas
kubectl get deployment coredns -n kube-system

# Check network policies
kubectl get networkpolicies -A

---