View a markdown version of this page

Expose Microservices in a Hybrid Scenario Using Amazon EKS - Expose Microservices Using Amazon EKS
Expose Microservices in a Hybrid Scenario Using Amazon EKSFurther readingDiagram history

Expose Microservices in a Hybrid Scenario Using Amazon EKS

Publication date: February 22, 2022 (Diagram history)

This architecture shows how to expose Amazon Elastic Kubernetes Service microservices hosted in private subnets to the internet and on-premises networks. The AWS Load Balancer Controller manages Elastic Load Balancers (ELBs) for Kubernetes services and ingresses.

Expose Microservices in a Hybrid Scenario Using Amazon EKS

Architecture diagram showing Amazon EKS microservices exposed through public and private load balancers in a VPC with public and private subnets.

The following steps describe the inbound external flow:

  1. Amazon Route 53 resolves incoming requests to the public ELB deployed by the AWS Load Balancer Controller.

  2. The ELBs forward traffic to applications. You can choose between two modes: instance mode (traffic sent to a worker node, then the service redirects traffic to the pod) or IP mode (traffic directed to the IP of the pod directly). See cluster networking details for more information.

The following steps describe the inbound internal flow:

  1. Amazon Route 53 resolves incoming requests to the private ELB deployed by the AWS Load Balancer Controller using a private hosted zone.

  2. The ELBs forward traffic to applications in instance mode or IP mode.

The following steps describe the outbound external flow:

  1. When a pod in a private subnet initiates an outbound request to the internet, the private route table forwards traffic to the NAT gateway (NGW).

  2. The public route table forwards traffic from the NGW to the internet gateway (IGW).

The following steps describe the outbound internal flow:

  1. A pod in a private subnet initiates an outbound request to the on-premises network. The private route table forwards traffic to the virtual private gateway (VGW).

  2. Traffic reaches the on-premises network over the VPN or AWS Direct Connect connection.

Note

You can use ingress controllers such as the NGINX ingress controller as an alternative to the AWS Load Balancer Controller. If you use AWS Fargate for Amazon EKS, you only have pod ENIs in the private subnets and must use ELBs with IP mode.

Further reading

For additional information, refer to the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

February 22, 2022

Initial publication

Reference architecture diagram first published.

February 22, 2022

Initial publication

Reference architecture diagram first published.

February 22, 2022

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.