<p>I'm using a managed <a href="https://aws.amazon.com/de/eks/" rel="nofollow noreferrer">AWS EKS</a> Kubernetes cluster. For the worker nodes I have setup a node group within the EKS cluster with 2 worker nodes</p>

<p><a href="https://i.stack.imgur.com/HlCIW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HlCIW.png" alt="Node Group"></a></p>

<p>These worker nodes get a public IP assigned automatically by EKS:</p>

<pre><code>$ kubectl get nodes -o wide
NAME                                          STATUS   ROLES    AGE   VERSION              INTERNAL-IP   EXTERNAL-IP     OS-IMAGE         KERNEL-VERSION                  CONTAINER-RUNTIME
ip-10-0-0-129.eu-central-1.compute.internal   Ready    &lt;none&gt;   6d    v1.14.7-eks-1861c5   10.0.0.129    1.2.3.4         Amazon Linux 2   4.14.146-119.123.amzn2.x86_64   docker://18.6.1
ip-10-0-1-218.eu-central-1.compute.internal   Ready    &lt;none&gt;   6d    v1.14.7-eks-1861c5   10.0.1.218    5.6.7.8         Amazon Linux 2   4.14.146-119.123.amzn2.x86_64   docker://18.6.1
</code></pre>

<p>For this example let's assume that the values assigned automatically by AWS are <code>1.2.3.4</code> and <code>5.6.7.8</code>.</p>

<p>When running a command from inside a pod running on the first node I can also see that this is the IP address with which external requests are being made:</p>

<pre><code>$ curl 'https://api.ipify.org'
1.2.3.4
</code></pre>

<p>The issue that I'm facing now is that I would like to configure this IP address. Let's assume I have a service that I use from within the pod that I'm not in control of and that requires whitelisting via IP address.</p>

<p>I haven't found any way to specify a range of IP addresses to the node group (or the subnets setup for the VPC in which the cluster is located) from which AWS will pick an IP address.</p>

<p>Is there any other way to configure the worker nodes to use fixed IP addresses?</p>

Christian Seifert
<p>Currently it is not possible to associate Elastic IPs with instances running as part of EKS node group. However, I will provide you with a much better alternative that should be used over your setup which is essentially all public.</p>

<p>Firstly, run your worker nodes or node groups inside private subnets. This will give you the ability to route out to internet through a static ip.</p>

<p>To achieve static ip that you can whitelist on a desired service is by using NAT Gateway. <a href="https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/" rel="nofollow noreferrer">Setup instructions</a>. NAT gateway will be associated with an elastic IP which won't be changing. </p>

<p>Since you are running EKS, don't forget to modify aws-vpc-cni configuration with <code>AWS_VPC_K8S_CNI_EXTERNALSNAT = true</code>. This is essential for pods to correctly work and route out to internet. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. For this your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. <a href="https://github.com/aws/amazon-vpc-cni-k8s" rel="nofollow noreferrer">more info on aws-vpc-cni</a></p>
