With no internet path, give nodes private routes to the AWS services they need.

Private subnets reach AWS APIs through VPC endpoints (PrivateLink) or NAT. Endpoints are cheaper and safer at scale.

Needed by nodes and Pods	Endpoint
Pull images	ECR API + ECR DKR interface endpoints, S3 gateway endpoint for layers
Pod Identity and IRSA credentials	STS endpoint (and the EKS Auth endpoint for Pod Identity)
CNI and Karpenter calls	EC2 interface endpoint
Logs and metrics	CloudWatch Logs and Monitoring endpoints
Node access and parameters	SSM, SSM Messages, EC2 Messages endpoints
Secrets	Secrets Manager endpoint

NAT gateway alternative

Simple, but per-GB charges add up for image pulls and chatty services. Endpoints keep traffic on the AWS network.

Endpoint policies

Restrict which buckets, repositories or accounts an endpoint can reach for an extra data-exfiltration guard.

Private DNS

Enable private DNS on interface endpoints so SDKs resolve the normal service names to private IPs.

Test image pulls first

A private cluster that cannot reach ECR looks like nodes stuck NotReady or ImagePullBackOff.

Private clusters: endpoints, egress and DNS

A private cluster has no direct internet path, either by design or policy. Nodes and Pods still need AWS APIs: ECR to pull images (plus S3, where layers are stored), STS for credentials, EC2 for the CNI and Karpenter, CloudWatch for logs and metrics, SSM for node access, Secrets Manager for secrets. In a private VPC these are reached through VPC endpoints powered by AWS PrivateLink, or through a NAT gateway.

Interface endpoints have an hourly cost per AZ but avoid NAT data-processing charges, which can be significant for image pulls and busy services. Gateway endpoints for S3 are free and should always be present. Endpoint policies add a further control by limiting what the endpoint can access, and private DNS makes SDKs use the endpoints transparently.

Troubleshooting pattern: nodes that never join, or Pods in ImagePullBackOff in a new private cluster, almost always mean a missing endpoint or security group rule. Check the endpoint security groups allow HTTPS from node subnets. Pod Identity adds the EKS Auth endpoint to the list. The exact set of required endpoints is documented in the EKS private cluster requirements, so use that list as a checklist.

Reveal the four cards for NAT, endpoint policy, DNS and testing. The theme is the same as in Module 1's endpoint access slide: tight exposure means you must supply the plumbing yourself.