Skip to content
SPECIFICTION
Get listed

Amazon VPC CNI

github.com

WindowsLinuxSelf-hosted
Visit github.com
Spec score 7.6 #12 of 28 in Container Networking Software

Spec sheet

Purpose
Amazon VPC CNI is a Kubernetes networking plugin that uses Elastic Network Interfaces on AWS to provide pod networking.Read 5 Oct 2026 · github.com
Integrations
The repository documents use with Kubernetes, Amazon EKS managed add-ons, and a Helm chart.Read 5 Oct 2026 · github.com
Support
The project directs users to the EKS networking best-practices and troubleshooting guides, GitHub issues, and the Kubernetes Slack #aws-vpc-cni channel.Read 5 Oct 2026 · github.com
Audience and scope
The plugin is for Kubernetes clusters whose nodes run on AWS infrastructure; EKS documentation says it does not deploy to EKS Hybrid Nodes.Read 5 Oct 2026 · docs.aws.amazon.com
AWS integration
The plugin uses AWS Elastic Network Interfaces and requires IAM permissions for its AWS resource operations.Read 5 Oct 2026 · github.com
Capacity limits
The recommended kubelet max-pods setting depends on the instance type's ENI and IP address capacity.Read 5 Oct 2026 · github.com
Components
It includes a CNI plugin that wires up the host and pod network stack and an ipamd daemon that maintains a warm pool of IP addresses and assigns pod IPs.Read 5 Oct 2026 · github.com
How it works
Its CNI plugin wires up the host and pod network stacks, while the ipamd daemon manages a warm pool of IP addresses and assigns addresses to pods.Read 5 Oct 2026 · github.com
Installation
The project documents installation by applying its YAML manifest or by using the AWS-published Helm chart.Read 5 Oct 2026 · github.com
IP allocation
ipamd can maintain warm pools of ENIs, IP addresses, or delegated prefixes for pod assignment.Read 5 Oct 2026 · github.com
IP capacity
The number of pod IPs available depends on the network interfaces and address capacity of the instance type.Read 5 Oct 2026 · github.com
IPv6 limitation
IPv6 operation requires prefix delegation, and dual-stack mode is not supported.Read 5 Oct 2026 · github.com
Monitoring
ipamd publishes a Prometheus metrics endpoint on port 61678 by default, and the endpoint can be disabled through configuration.Read 5 Oct 2026 · github.com
Network policies
VPC CNI versions 1.14 and later support Kubernetes NetworkPolicy; the feature matrix lists support for both IPv4 and IPv6 modes.Read 5 Oct 2026 · github.com
Permissions
The plugin requires IAM policies to manage network resources, and AWS documents configuring its permissions with IAM Roles for Service Accounts.Read 5 Oct 2026 · docs.aws.amazon.com
Pod security groups
The plugin supports security groups for pods through branch network interfaces, with support limited to Nitro-based instances.Read 5 Oct 2026 · github.com
Privileged containers
The manifest runs aws-vpc-cni-init and aws-eks-nodeagent in privileged mode to set networking kernel parameters and attach BPF probes for network policy enforcement.Read 5 Oct 2026 · github.com
Privileges
The manifest runs the aws-vpc-cni-init and aws-eks-nodeagent containers in privileged mode for kernel network configuration and eBPF probe attachment.Read 5 Oct 2026 · github.com
Security operations
The repository directs people reporting potential security issues to AWS’s security reporting process rather than public GitHub issues.Read 5 Oct 2026 · github.com
VPC addresses
The plugin assigns pods private IPv4 or IPv6 addresses from the VPC.Read 5 Oct 2026 · docs.aws.amazon.com

Where Specifiction places it

Alternatives to Amazon VPC CNIAll alternatives →