EKS Subnet Design (Multi-AZ)

EKS Subnet Design (Multi-AZ) An architecture diagram generated by Archify. Internet · Architecture component Internet Internet Gateway · VPC (10.0.0.0/16) Internet Gateway Public Subnet · 10.0.0.0/24 · ALB · VPC (10.0.0.0/16) › Availability Zone 1 (us-west-2a) Public Subnet 10.0.0.0/24 · ALB NAT Gateway 1 · Egress via IGW · VPC (10.0.0.0/16) › Availability Zone 1 (us-west-2a) NAT Gateway 1 Egress via IGW Private subnet · 10.0.2.0/22 · worker nodes · VPC (10.0.0.0/16) › Availability Zone 1 (us-west-2a) Private subnet 10.0.2.0/22 · worker nodes Public Subnet · 10.0.1.0/24 · ALB · VPC (10.0.0.0/16) › Availability Zone 2 (us-west-2b) Public Subnet 10.0.1.0/24 · ALB NAT Gateway 2 · Egress via IGW · VPC (10.0.0.0/16) › Availability Zone 2 (us-west-2b) NAT Gateway 2 Egress via IGW Private subnet · 10.0.6.0/22 · worker nodes · VPC (10.0.0.0/16) › Availability Zone 2 (us-west-2b) Private subnet 10.0.6.0/22 · worker nodes Inbound · outbound 0.0.0.0/0 0.0.0.0/0 VPC (10.0.0.0/16) Availability Zone 1 (us-west-2a) Availability Zone 2 (us-west-2b) Legend Backend Cloud External

Public Subnet

  • • Hosts public load balancers (ALB/NLB), NAT Gateways, and bastion hosts
  • • A /24 (256 IPs) is normally large enough
  • • Its route table sends 0.0.0.0/0 to the Internet Gateway

Private subnet

  • • Hosts EKS worker nodes, internal load balancers, and databases
  • • Because pods consume VPC IPs, size it at /22 (1,024 IPs) or larger
  • • Point 0.0.0.0/0 at the NAT Gateway in the same AZ

AZ spread

  • • Use at least two AZs (three preferred), each with a public/private subnet pair
  • • A NAT Gateway per AZ avoids cross-AZ charges and a single point of failure
  • • The sample allocation uses 10.0.0.0/19 and reserves 10.0.32.0/19 for growth