title: Migrate Pods from different EC2 hosts
body: <p>I am new to AWS, Kubernetes, EKS, and AppMesh, but had done DevOps in previous roles.</p>
  <p>I am taking over some K8 cluster which used EKS and found that we set up NAT gateway which helps redirect egress traffic outbound as a single IP (we need that for whitelisting as 3rd-party external service require it).  Pods hosted in a private subnet works fine.</p>
  <p>But I found that Pods which hosted on public subnet just skip the NAT gateway, it uses the Public DNS (IPv4) IP address for outbound calls, which don't work for us as it does not use the single NAT gateway.</p>
  <p>So I have a few questions:</p>
  <ol>
  <li>How do we migrate Pods from Public subnet Hosts to Private subnets Hosts?</li>
  <li>Should we use <code>nodeSelector</code>, <code>Node affinity</code>? Do labelings on the Nodes work?</li>
  <li>I am not sure why we have Nodes in a public subnet, but we followed this guide: <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.html</a></li>
  <li>If we do choose to be on fully private subnets, can we make an exception for such mapping that we allow some Pods to have HTTP endpoints to be exposed for ingress traffic, while still on private subnets?</li>
  <li>What do you recommend us to handle when a Pod/Container needs to use NAT gateway for egress traffic, but then exposing HTTP endpoints for ingress traffic?</li>
  </ol>
  <p><a href="https://i.stack.imgur.com/b6EJX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/b6EJX.png" alt="" /></a></p>
  <p>Note that currently, our EKS is by default set to all public, should we move to Public and private mode?</p>
  <p><a href="https://i.stack.imgur.com/HcqW7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HcqW7.png" alt="" /></a></p>
  <p>Thanks for all the answers in advance!.</p>