<p>I've just successfully followed <a href="https://docs.aws.amazon.com/en_us/eks/latest/userguide/getting-started.html" rel="nofollow noreferrer">AWS EKS Getting Started Guide</a>, and now I have operational Kubernetes cluster of 3 worker nodes.</p>

<p>Worker node EC2 instances have auto-assigned public IPs:</p>

<pre><code>IPv4 Public IP: 18.197.201.199
Private IPs: 192.168.180.57, 192.168.148.90
Secondary private IPs: 192.168.170.137, 192.168.180.185, 192.168.161.170, 192.168.133.109, 192.168.182.189, 192.168.189.234, 192.168.166.204, 192.168.156.144, 192.168.133.148, 192.168.179.151
</code></pre>

<p>In order to connect to private off-AWS resources, firewall rules require node public IPs be from specific pool of Elastic IPs. (More specifically, worker nodes must access private Docker registry behind the corporate firewall, which white-lists several AWS Elastic IPs.) The simplest seems to override auto-assigned public node IPs with pre-defined Elastic IPs; however AWS allows to associate Elastic IP only with a specific private IP.</p>

<p>How do I proceed to replace auto-assigned public IPs with Elastic IPs?</p>

<p>Remember that nodes can come and go. </p>

<p>You wouldn't want a specific node in your cluster configured to an Elastic IP that was cleared for your off-AWS resource(s).</p>

<p>Instead you would have a NAT Gateway assigned an Elastic IP and cluster node(s) in a private subnet that use that NAT Gateway for outbound communication.</p>

<p>This configuration is described beginning on page 85 of this pdf.
<a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf</a></p>
