privateCluster: enable for private subnets to be created and restrict public subnets

You're correct. When creating an Amazon Elastic Kubernetes Service (EKS) cluster using eksctl, you can specify the privateCluster option to create a private cluster with private subnets and restrict the creation of public subnets and an Internet Gateway (IGW).

To create a private EKS cluster with eksctl, you need to include the privateCluster option and set it to enable in your cluster configuration file or command-line arguments. This will ensure that the cluster is created with private subnets, and no public subnets or IGW will be created.

Here's an example of how you can create a private EKS cluster using eksctl:

# cluster.yaml
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: my-private-cluster
  region: us-west-2

privateCluster:
  enabled: true

# Other cluster configuration options...

In this example, the privateCluster.enabled option is set to true, which instructs eksctl to create a private cluster with private subnets only. No public subnets or IGW will be created.

It's important to note that when creating a private cluster, you'll need to ensure that your worker nodes and other resources within the cluster have access to the necessary AWS services and resources required for the cluster to function correctly. This can be achieved by using AWS PrivateLink or VPC Endpoints, which provide secure and scalable connectivity to AWS services from within your VPC.

Additionally, you'll need to configure appropriate network access and security controls to allow communication between your on-premises or external resources and the private EKS cluster, such as using a VPN or AWS Direct Connect connection.

By following the eksctl documentation and examples, you can configure your private EKS cluster according to your specific requirements and ensure that it meets your security and networking needs.

However, See this example cluster yaml file : https://github.com/eksctl-io/eksctl/blob/main/examples/02-custom-vpc-cidr-no-nodes.yaml - This creates a cluster with public is false, but it creates a VPC with Internet gateway.

Go through several of this example yaml files in github, you would get better understanding of various options you can use while creating the cluster using eksctl - https://github.com/eksctl-io/eksctl/tree/main/examples