The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.
By default every pod in a Kubernetes cluster can reach every other pod and anything on the network. Network policies change that, and on EKS the VPC CNI enforces them itself, without installing Calico or Cilium.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Admin-tier cluster policies, lowest priority number first. A Deny ends evaluation; an Allow accepts; a Pass hands the decision to namespace policies.
Namespace NetworkPolicies, which can only be more restrictive than what the Admin tier allowed or passed.
Baseline-tier cluster policies: defaults that namespace policies may override.
Anything still unmatched is denied.
An Admin-tier Deny protecting sensitive namespaces from every other namespace.
A Baseline-tier default: deny ingress from other namespaces, allow DNS and the cluster's ingress controller.
Per-namespace policies, owned by each team, for the traffic their services actually need.
An allow rule for the instance metadata service only for pods that still use the node role; pods on Pod Identity or IRSA don't need it.
Policies apply on EC2 Linux nodes only, not on Fargate or Windows nodes.
At most 24 port-and-protocol combinations per CIDR across all policies; selectors that resolve to the same CIDR all count.
Enforcement is optimized for pods owned by a controller (Deployment, StatefulSet, Job). Standalone pods may not be enforced reliably.
A Service's port must match the container port.
Only the primary interface is covered: chained plugins such as Multus and IPv4 egress from IPv6 pods aren't.
Replacing another policy engine: remove it first, then replace the nodes it ran on, since leftover rules can remain.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS Running Out of IP Addresses: Prefix Delegation, Custom Networking or IPv6
With the VPC CNI every pod takes a real VPC address, so a /24 subnet runs out long before the nodes do. Three fixes: prefix delegation (more pods per node, faster launches), custom networking on a secondary CIDR, or an IPv6 cluster. What each solves, what it costs in complexity, and the migration traps.
Read
EKS Multi-Tenancy: Namespaces, Node Pools or a Cluster per Tenant
Three levels of isolation for teams or customers sharing EKS: namespaces with quotas and network policies, dedicated node pools, or a cluster each. What each actually isolates (containers share a kernel), what it costs (from nothing to $73 a month per cluster plus duplicated add-ons), and how to choose per tenant rather than per platform.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.