With the VPC CNI every pod takes a real VPC address, so a /24 subnet runs out long before the nodes do. Three fixes: prefix delegation (more pods per node, faster launches), custom networking on a secondary CIDR, or an IPv6 cluster. What each solves, what it costs in complexity, and the migration traps.
The VPC CNI gives each pod an address from the VPC, which is why pods are reachable from anything in the network without overlays. It is also why clusters run out: each node needs addresses for its pods, each instance type caps how many interfaces and addresses it can hold, and small subnets fill up. The symptoms are pods stuck Pending with free CPU and memory, and slow scale-ups.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Max pods per node defaults to 110 with prefix delegation, and mixed instance types in a managed node group take the smallest value.
Moving existing nodes from individual addresses to prefixes in place leaves nodes advertising inconsistent capacity: create new node groups and drain the old ones.
After enabling prefixes, the VPC CNI can't be downgraded below 1.9.0 without removing all nodes.
With security groups for pods in standard mode, traffic leaving the VPC uses the node's security groups, not the pod's.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS Network Policies With the VPC CNI: Default Deny, Admin Policies, and the Limits to Know
The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.
Read
An EKS Reference Architecture for 2026, With Diagrams: The Small-Team Version and the Regulated Version
What a production EKS setup looks like in 2026, layer by layer: edge, entry, cluster, platform add-ons, data, security and observability. A lean version for a small team on Auto Mode, and a regulated version with separate node pools, network policies and audit logging, with the choices behind each box.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.