A VPC is a dedicated logical network for a Kubernetes cluster, with reserved IP space, subnets, ingress paths, and connectivity to other cloud networks and services. Its design establishes the network boundary in which platform workloads operate. section 7.2 section 7.2.1
A practical VPC design uses:
- One VPC per Kubernetes cluster, named to match the cluster so automation can discover it reliably. section 7.2.1
- Region-specific CIDR allocations sized for future clusters, replacement clusters, nodes, databases, ingress, and other IP-consuming resources. section 7.2 section 7.2.1
- Separate private node, intra, database, and public-ingress subnet groups distributed across availability zones. section 7.2 section 7.2.1
- A transit-network connection for cross-account or cross-region connectivity, with approvals automated through platform workflows where appropriate. section 7.2
A cost-conscious EKS exercise
A sandbox VPC named sbx-i01-aws-us-east-1 uses 10.80.0.0/16 across three availability zones. It assigns large private subnets to nodes, intra subnets to internal resources, database subnets, and public-ingress subnets. The exercise deploys one NAT gateway instead of one per availability zone, reducing cost while accepting greater outbound-traffic and availability-zone risk. section 7.2 section 7.2.1
Figure 7.5 This VPC structure creates a solid foundation for most starting EKS implementations.
Use the VPC structure diagram to inspect how subnets, ingress, NAT, cluster resources, and transit connectivity form an EKS foundation. section 7.2
