Amazon EKS now supports customer-routed control plane egress

Amazon EKS Introduces Customer-Routed Control Plane Egress

Amazon EKS now offers customer-routed control plane egress, allowing outbound Kubernetes API server traffic to be routed through your own Amazon VPC. This includes admission webhook callbacks, OpenID Connect (OIDC) provider lookups, and aggregate API server requests. This feature enables organizations with data perimeter requirements, compliance mandates, or private network infrastructure to reach private OIDC providers and webhook servers accessible only within their VPC, and control how that traffic routes through their network.

What to do

• Set controlPlaneEgressMode to CUSTOMER_ROUTED when creating a new cluster or updating an existing cluster.
• Use the eks:controlPlaneEgressMode IAM condition key with AWS Organizations Service Control Policies to enforce this configuration organization-wide.

Customer-routed control plane egress is available at no additional cost in all AWS Regions where Amazon EKS is available. To learn more, see Configure control plane egress routing in the Amazon EKS User Guide.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.