Amazon EKS now allows control plane egress through customer VPC
New feature routes Kubernetes API server outbound traffic to customer-controlled networks, focusing on data perimeter requirements and private environments.
AWS announced a new option for Amazon Elastic Kubernetes Service (EKS) that allows routing Kubernetes control plane outbound traffic through the customer's own Amazon VPC. According to the company, the functionality covers admission webhook calls, queries to OpenID Connect (OIDC) providers, and requests to aggregated API servers.
With the customer-routed egress mode, this traffic now follows paths defined within the VPC, including routing rules, security groups, and egress controls configured by the organization. The change primarily targets companies with compliance requirements, data perimeters, or private infrastructure that need to connect the control plane to internal services, such as OIDC providers and non-publicly exposed webhook servers.
According to AWS, the feature can be enabled on new or existing clusters by setting `controlPlaneEgressMode` to `CUSTOMER_ROUTED`. The company also notes that organizations can apply this configuration centrally using the IAM condition key `eks:controlPlaneEgressMode` within AWS Organizations Service Control Policies.
The functionality is available at no additional cost in all regions where Amazon EKS is offered, according to AWS. The service's technical documentation provides configuration details for control plane egress routing.
- Amazon EKS now supports customer-routed control plane egress · aws.amazon.com
What is the new Amazon EKS feature for control plane egress?
Amazon EKS now allows Kubernetes control plane outbound traffic to be routed through a customer's own Amazon VPC. This covers admission webhook calls, queries to OpenID Connect (OIDC) providers, and requests to aggregated API servers.
How do you enable customer-routed egress in Amazon EKS?
You can enable this feature on new or existing clusters by setting the configuration parameter `controlPlaneEgressMode` to `CUSTOMER_ROUTED`. It can also be applied centrally using the IAM condition key `eks:controlPlaneEgressMode` within AWS Organizations Service Control Policies.
Why would an organization use customer-routed egress for EKS?
This feature targets companies with compliance requirements, data perimeters, or private infrastructure. It allows them to apply their own VPC routing rules, security groups, and egress controls to connect the control plane to internal services like private OIDC providers and non-public webhook servers.