{
  "slug": "eksctl-cluster-creation-can-place-control-plane-enis-only-in-private-subnets-a0213c52e511",
  "title": "eksctl cluster creation can place control plane ENIs only in private subnets",
  "tools": [
    "eksctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-02T21:14:49.000Z",
  "announced_at": "2026-10-02T21:14:49.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating a cluster whose control plane ENIs must use private subnets, set `vpc.controlPlaneOnPrivateSubnets: true` in the config and run `eksctl create cluster -f config.yaml`. Public subnets remain available for other cluster resources.",
    "examples": [
      "apiVersion: eksctl.io/v1alpha5\nkind: ClusterConfig\nmetadata:\n  name: cluster\n  region: us-west-2\navailabilityZones:\n  - us-west-2a\n  - us-west-2b\nvpc:\n  controlPlaneOnPrivateSubnets: true\n\n# Save as config.yaml, then run:\neksctl create cluster -f config.yaml"
    ],
    "gotchas": [
      "Version: v0.231.0",
      "vpc.controlPlaneOnPrivateSubnets: Set to `true` at cluster creation to pass only private subnets to the EKS API. Cannot be combined with `vpc.controlPlaneSubnetIDs`.",
      "eksctl create cluster -f <config.yaml> (required): Creates a cluster using the specified config file.",
      "Prerequisite: At least two private subnets across at least two availability zones are required.",
      "Prerequisite: Private subnets need a NAT gateway or relevant VPC endpoints so nodes can reach the API server.",
      "At least two private subnets across at least two availability zones are required.",
      "The field is rejected when combined with `vpc.controlPlaneSubnetIDs`.",
      "Public subnets are still created and used for NAT gateways, internet-facing load balancers, and any nodegroup that is not private; this setting does not make the cluster fully private."
    ]
  },
  "why_it_matters": "Create a cluster whose control plane cross-account ENIs must use private subnets while retaining public subnets for other cluster resources.",
  "before": "For an existing cluster, `eksctl utils update-cluster-vpc-config` can change control plane subnets by calling the EKS API directly; this leaves the CloudFormation stack out of sync. The new setting applies only at cluster creation.",
  "sources": [
    "https://github.com/eksctl-io/eksctl/releases/tag/v0.231.0",
    "https://github.com/eksctl-io/eksctl/pull/8793",
    "https://github.com/eksctl-io/eksctl/blob/v0.231.0/userdocs/src/usage/cluster-subnets-security-groups.md",
    "https://github.com/eksctl-io/eksctl/blob/v0.231.0/userdocs/src/usage/creating-and-managing-clusters.md"
  ],
  "rank": 0.97037,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-99b1a15fa4b6a56c-2:gate",
    "evidence_hash": "e332263df2ddf1d8ddf3298909846e1aa9548e57737916a93b9b52556552c6cb"
  },
  "review": {
    "draft_hash": "b9aeb608e2a4a48bbd2dfa5900e43a5f27b0a353fbc5a85a40ab1cab55691617",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.76 (>= 0.6 needed)."
  }
}