Cluster API server endpoint - Amazon EKS (original) (raw)
This topic helps you to enable private access for your Amazon EKS cluster’s Kubernetes API server endpoint and limit, or completely disable, public access from the internet.
When you create a new cluster, Amazon EKS creates an endpoint for the managed Kubernetes API server that you use to communicate with your cluster (using Kubernetes management tools such as kubectl). By default, this API server endpoint is public to the internet, and access to the API server is secured using a combination of AWS Identity and Access Management (IAM) and native Kubernetes Role Based Access Control (RBAC). This endpoint is known as the cluster public endpoint. Also there is a cluster private endpoint. For more information about the cluster private endpoint, see the following section Cluster private endpoint.
IPv6 cluster endpoint format
EKS creates a unique dual-stack endpoint in the following format for new IPv6 clusters that are made after October 2024. An IPv6 cluster is a cluster that you select IPv6 in the IP family (ipFamily) setting of the cluster.
AWS
EKS cluster public/private endpoint:eks-cluster.`region`.api.aws
AWS GovCloud (US)
EKS cluster public/private endpoint:eks-cluster.`region`.api.aws
Amazon Web Services in China
EKS cluster public/private endpoint:eks-cluster.`region`.api.amazonwebservices.com.cn
IPv4 cluster endpoint format
EKS creates a unique endpoint in the following format for each cluster that select IPv4 in the IP family (ipFamily) setting of the cluster:
AWS
EKS cluster public/private endpointeks-cluster.`region`.eks.amazonaws.com
AWS GovCloud (US)
EKS cluster public/private endpointeks-cluster.`region`.eks.amazonaws.com
Amazon Web Services in China
EKS cluster public/private endpointeks-cluster.`region`.amazonwebservices.com.cn
Note
Before October 2024, IPv6 clusters used this endpoint format also. For those clusters, both the public endpoint and the private endpoint have only IPv4 addresses resolve from this endpoint.
Cluster private endpoint
You can enable private access to the Kubernetes API server so that all communication between your nodes and the API server stays within your VPC. You can limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server.
Note
Because this endpoint is for the Kubernetes API server and not a traditional AWS PrivateLink endpoint for communicating with an AWS API, it doesn’t appear as an endpoint in the Amazon VPC console.
When you enable endpoint private access for your cluster, Amazon EKS creates a Route 53 private hosted zone on your behalf and associates it with your cluster’s VPC. This private hosted zone is managed by Amazon EKS, and it doesn’t appear in your account’s Route 53 resources. In order for the private hosted zone to properly route traffic to your API server, your VPC must have enableDnsHostnames and enableDnsSupport set to true, and the DHCP options set for your VPC must include AmazonProvidedDNS in its domain name servers list. For more information, see Updating DNS support for your VPC in the Amazon VPC User Guide.
You can define your API server endpoint access requirements when you create a new cluster, and you can update the API server endpoint access for a cluster at any time.
Modifying cluster endpoint access
Use the procedures in this section to modify the endpoint access for an existing cluster. The following table shows the supported API server endpoint access combinations and their associated behavior.
| Endpoint public access | Endpoint private access | Behavior |
|---|---|---|
| Enabled | Disabled | This is the default behavior for new Amazon EKS clusters. Kubernetes API requests that originate from within your cluster’s VPC (such as node to control plane communication) leave the VPC but not Amazon’s network. Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint. If you limit access to specific CIDR blocks, then it is recommended that you also enable the private endpoint, or ensure that the CIDR blocks that you specify include the addresses that nodes and Fargate Pods (if you use them) access the public endpoint from. |
| Enabled | Enabled | Kubernetes API requests within your cluster’s VPC (such as node to control plane communication) use the private VPC endpoint. Your cluster API server is accessible from the internet. You can, optionally, limit the CIDR blocks that can access the public endpoint. If you are using hybrid nodes with your Amazon EKS cluster, it is not recommended to have both Public and Private cluster endpoint access enabled. Because your hybrid nodes are running outside of your VPC, they will resolve the cluster endpoint to the public IP addresses. It is recommended to use either Public or Private cluster endpoint access for clusters with hybrid nodes. |
| Disabled | Enabled | All traffic to your cluster API server must come from within your cluster’s VPC or a connected network. There is no public access to your API server from the internet. Any kubectl commands must come from within the VPC or a connected network. For connectivity options, see Accessing a private only API server. The cluster’s API server endpoint is resolved by public DNS servers to a private IP address from the VPC. In the past, the endpoint could only be resolved from within the VPC. If your endpoint does not resolve to a private IP address within the VPC for an existing cluster, you can: Enable public access and then disable it again. You only need to do so once for a cluster and the endpoint will resolve to a private IP address from that point forward. Update your cluster. |
CIDR blocks in the public endpoint (IPv6 cluster)
You can add IPv6 and IPv4 CIDR blocks to the public endpoint of an IPv6 cluster, because the public endpoint is dual-stack. This only applies to new clusters with the ipFamily set to IPv6 that you made in October 2024 or later. You can identify these clusters by the new endpoint domain name api.aws.
CIDR blocks in the public endpoint (IPv4 cluster)
You can add IPv4 CIDR blocks to the public endpoint of an IPv4 cluster. You can’t add IPv6 CIDR blocks to the public endpoint of an IPv4 cluster. If you try, EKS returns the following error message: The following CIDRs are invalid in publicAccessCidrs
CIDR blocks in the public endpoint (IPv6 cluster made before October 2024)
You can add IPv4 CIDR blocks to the public endpoint of the old IPv6 clusters that you made before October 2024. You can identify these clusters by the eks.amazonaws.com endpoint. You can’t add IPv6 CIDR blocks to the public endpoint of these old IPv6 clusters that you made before October 2024. If you try, EKS returns the following error message: The following CIDRs are invalid in publicAccessCidrs
Accessing a private only API server
If you have disabled public access for your cluster’s Kubernetes API server endpoint, you can only access the API server from within your VPC or a connected network. Here are a few possible ways to access the Kubernetes API server endpoint:
Connected network
Connect your network to the VPC with an AWS transit gateway or other connectivity option and then use a computer in the connected network. You must ensure that your Amazon EKS control plane security group contains rules to allow ingress traffic on port 443 from your connected network.
Amazon EC2 bastion host
You can launch an Amazon EC2 instance into a public subnet in your cluster’s VPC and then log in via SSH into that instance to run kubectl commands. For more information, see Linux bastion hosts on AWS. You must ensure that your Amazon EKS control plane security group contains rules to allow ingress traffic on port 443 from your bastion host. For more information, see View Amazon EKS security group requirements for clusters.
When you configure kubectl for your bastion host, be sure to use AWS credentials that are already mapped to your cluster’s RBAC configuration, or add the IAM principal that your bastion will use to the RBAC configuration before you remove endpoint public access. For more information, see Grant IAM users and roles access to Kubernetes APIs and Unauthorized or access denied (kubectl).
AWS Cloud9 IDE
AWS Cloud9 is a cloud-based integrated development environment (IDE) that lets you write, run, and debug your code with just a browser. You can create an AWS Cloud9 IDE in your cluster’s VPC and use the IDE to communicate with your cluster. For more information, see Creating an environment in AWS Cloud9. You must ensure that your Amazon EKS control plane security group contains rules to allow ingress traffic on port 443 from your IDE security group. For more information, see View Amazon EKS security group requirements for clusters.
When you configure kubectl for your AWS Cloud9 IDE, be sure to use AWS credentials that are already mapped to your cluster’s RBAC configuration, or add the IAM principal that your IDE will use to the RBAC configuration before you remove endpoint public access. For more information, see Grant IAM users and roles access to Kubernetes APIs and Unauthorized or access denied (kubectl).