CNI and the IP-exhaustion trap

CNI and the IP-exhaustion trapwhere EKS networking bites

The AWS VPC CNI gives every pod a real VPC IP from the subnet's range, which makes pod networking native and fast. The cost is that a dense node with many pods consumes many subnet IPs and instances cap how many IPs they can attach by type. Run out of subnet IPs and new pods sit Pending with no obvious error in the app logs - the failure is in the network layer, not the workload.

• Size private subnets for peak pods-per-node times node count, then add headroom for rollouts that double pod count briefly.
• Watch for Pending pods with FailedCreatePodSandbox or IP-allocation events - that's CNI exhaustion, not a scheduling bug.
• Consider prefix delegation on the VPC CNI to pack more pod IPs per node or carve a secondary CIDR for pods specifically.