eksctl cluster creation can place control plane ENIs only in private subnets
Introduced 2026-10-02 · score 0.97
HOW TO USE IT
When creating a cluster whose control plane ENIs must use private subnets, set `vpc.controlPlaneOnPrivateSubnets: true` in the config and run `eksctl create cluster -f config.yaml`. Public subnets remain available for other cluster resources.
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
name: cluster
region: us-west-2
availabilityZones:
- us-west-2a
- us-west-2b
vpc:
controlPlaneOnPrivateSubnets: true
# Save as config.yaml, then run:
eksctl create cluster -f config.yamlWHY THIS HELPS
Create a cluster whose control plane cross-account ENIs must use private subnets while retaining public subnets for other cluster resources.
BEFORE THIS CHANGE
For an existing cluster, `eksctl utils update-cluster-vpc-config` can change control plane subnets by calling the EKS API directly; this leaves the CloudFormation stack out of sync. The new setting applies only at cluster creation.
REQUIREMENTS AND LIMITATIONS
- Version: v0.231.0
- vpc.controlPlaneOnPrivateSubnets: Set to `true` at cluster creation to pass only private subnets to the EKS API. Cannot be combined with `vpc.controlPlaneSubnetIDs`.
- eksctl create cluster -f <config.yaml> (required): Creates a cluster using the specified config file.
- Prerequisite: At least two private subnets across at least two availability zones are required.
- Prerequisite: Private subnets need a NAT gateway or relevant VPC endpoints so nodes can reach the API server.
- At least two private subnets across at least two availability zones are required.
- The field is rejected when combined with `vpc.controlPlaneSubnetIDs`.
- Public subnets are still created and used for NAT gateways, internet-facing load balancers, and any nodegroup that is not private; this setting does not make the cluster fully private.
FIRST-PARTY EVIDENCE
- https://github.com/eksctl-io/eksctl/releases/tag/v0.231.0
- https://github.com/eksctl-io/eksctl/pull/8793
- https://github.com/eksctl-io/eksctl/blob/v0.231.0/userdocs/src/usage/cluster-subnets-security-groups.md
- https://github.com/eksctl-io/eksctl/blob/v0.231.0/userdocs/src/usage/creating-and-managing-clusters.md
Check the installed version and the source before using it. Entry JSON