How do I connect to a private Amazon EKS cluster endpoint from outside the Amazon VPC?

2 minute read

I want to connect to a private Amazon Elastic Kubernetes Service (Amazon EKS) cluster endpoint from outside the Amazon Virtual Private Cloud (Amazon VPC). For example, I want to connect a peered VPC to AWS Direct Connect.


Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

You can use a peered VPC to automatically resolve to the private Amazon EKS cluster endpoint.

Run the following command to check the connectivity between your local machine and the EKS endpoint:


Note: Make sure that your cluster API server endpoint is an HTTPS URL.

If you activate only private endpoint access, then Amazon EKS automatically advertises the endpoints' private IP addresses through the API server's public DNS name. If you configure your client through aws eks update-kubeconfig or eksctl, then the client uses the public DNS name to resolve and connect to private endpoints. The client automatically performs these actions through the peered VPC. For an example of this type of client, see Command line tool (kubectl) on the Kubernetes website.

For more information, see Accessing a private only API server.

AWS OFFICIALUpdated 5 months ago