Freedom251 › Container Networking Software

Amazon VPC CNI

Paid LinuxSelf-hostedWindows

What Amazon VPC CNI is

Amazon VPC CNI is an open-source networking plugin for Kubernetes clusters running on AWS infrastructure. It gives pods private IPv4 or IPv6 addresses from the VPC through Elastic Network Interfaces (ENIs). Its CNI plugin connects the host and pod network stacks, while the ipamd daemon manages a warm pool and assigns pod addresses. That pool can contain ENIs, individual IP addresses, or delegated prefixes.

The number of pod addresses available depends on the network interface and address capacity of the instance type, which also informs the recommended kubelet max-pods setting. Installation is documented through a YAML manifest or an AWS-published Helm chart, with use documented for Kubernetes and Amazon EKS managed add-ons. Versions 1.14 and later support Kubernetes NetworkPolicy in IPv4 and IPv6 modes. Pod security groups use branch network interfaces and require Nitro-based instances. IPv6 operation requires prefix delegation, and dual-stack mode is not supported. The plugin requires IAM policies to manage AWS network resources; AWS documents configuring permissions with IAM Roles for Service Accounts. Its manifest runs two containers in privileged mode for kernel network configuration and eBPF probe attachment. An optional Prometheus metrics endpoint is available on port 61678 by default.

Who it suits

Amazon VPC CNI suits teams operating Kubernetes clusters on AWS that need pods to use private VPC addresses. It is relevant to EKS users who want documented managed add-on integration, NetworkPolicy support, or pod security groups on Nitro-based instances.

What it does well

Open-source Kubernetes networking plugin for AWS clusters.
Assigns private IPv4 or IPv6 addresses from the VPC.
Warm pools can hold ENIs, IP addresses, or delegated prefixes.
NetworkPolicy support is available in versions 1.14 and later.
Documents YAML manifest and AWS Helm chart installation.
Publishes Prometheus metrics on port 61678 by default.

What to know first

Pod IP capacity depends on the instance type's network capacity.
IPv6 requires prefix delegation, and dual-stack mode is unsupported.
Pod security groups are limited to Nitro-based instances.
The manifest runs two containers in privileged mode.

Limits

Pod IP capacity depends on the instance type's ENI and address capacity, and the recommended kubelet max-pods setting depends on that capacity. IPv6 requires prefix delegation, dual-stack mode is unsupported, and pod security groups are limited to Nitro-based instances.

Getting started

Open the project website at https://github.com/aws/amazon-vpc-cni-k8s.
Choose the documented YAML manifest or AWS-published Helm chart installation route.
Configure the IAM policies needed to manage AWS network resources.
Apply the manifest or use the Helm chart in the Kubernetes cluster.

Verdict

Choose Amazon VPC CNI for Kubernetes clusters on AWS that need pod networking through VPC addresses and ENIs. Its documented NetworkPolicy and EKS integrations may suit those environments. Look elsewhere if you require dual-stack networking or need pod security groups on non-Nitro instances.

Questions

Is Amazon VPC CNI free?

Yes. It is listed as free and open source.

Which platforms does it support?

The listed platforms are Linux, Windows, and self-hosted. Its documented scope includes Kubernetes clusters on AWS and Amazon EKS.

How can it be installed?

The project documents applying a YAML manifest or using the AWS-published Helm chart.

Does it support Kubernetes NetworkPolicy?

Versions 1.14 and later support Kubernetes NetworkPolicy in IPv4 and IPv6 modes.

Does it support IPv6 and dual-stack mode?

IPv6 operation requires prefix delegation. Dual-stack mode is not supported.

What permissions and privileges does it need?

It requires IAM policies to manage network resources. The manifest runs aws-vpc-cni-init and aws-eks-nodeagent in privileged mode for kernel network configuration and eBPF probe attachment.

Facts from Amazon VPC CNI's own pages

Audience and scope: The plugin is for Kubernetes clusters whose nodes run on AWS infrastructure; EKS documentation says it does not deploy to EKS Hybrid Nodes. · docs.aws.amazon.com, 5 Oct 2026
AWS integration: The plugin uses AWS Elastic Network Interfaces and requires IAM permissions for its AWS resource operations. · github.com, 5 Oct 2026
Capacity limits: The recommended kubelet max-pods setting depends on the instance type's ENI and IP address capacity. · github.com, 5 Oct 2026
Components: It includes a CNI plugin that wires up the host and pod network stack and an ipamd daemon that maintains a warm pool of IP addresses and assigns pod IPs. · github.com, 5 Oct 2026
How it works: Its CNI plugin wires up the host and pod network stacks, while the ipamd daemon manages a warm pool of IP addresses and assigns addresses to pods. · github.com, 5 Oct 2026
Installation: The project documents installation by applying its YAML manifest or by using the AWS-published Helm chart. · github.com, 5 Oct 2026
Integrations: The repository documents use with Kubernetes, Amazon EKS managed add-ons, and a Helm chart. · github.com, 5 Oct 2026
IP allocation: ipamd can maintain warm pools of ENIs, IP addresses, or delegated prefixes for pod assignment. · github.com, 5 Oct 2026
IP capacity: The number of pod IPs available depends on the network interfaces and address capacity of the instance type. · github.com, 5 Oct 2026
IPv6 limitation: IPv6 operation requires prefix delegation, and dual-stack mode is not supported. · github.com, 5 Oct 2026
Monitoring: ipamd publishes a Prometheus metrics endpoint on port 61678 by default, and the endpoint can be disabled through configuration. · github.com, 5 Oct 2026
Network policies: VPC CNI versions 1.14 and later support Kubernetes NetworkPolicy; the feature matrix lists support for both IPv4 and IPv6 modes. · github.com, 5 Oct 2026
Permissions: The plugin requires IAM policies to manage network resources, and AWS documents configuring its permissions with IAM Roles for Service Accounts. · docs.aws.amazon.com, 5 Oct 2026
Pod security groups: The plugin supports security groups for pods through branch network interfaces, with support limited to Nitro-based instances. · github.com, 5 Oct 2026
Privileged containers: The manifest runs aws-vpc-cni-init and aws-eks-nodeagent in privileged mode to set networking kernel parameters and attach BPF probes for network policy enforcement. · github.com, 5 Oct 2026
Privileges: The manifest runs the aws-vpc-cni-init and aws-eks-nodeagent containers in privileged mode for kernel network configuration and eBPF probe attachment. · github.com, 5 Oct 2026
Purpose: Amazon VPC CNI is a Kubernetes networking plugin that uses Elastic Network Interfaces on AWS to provide pod networking. · github.com, 5 Oct 2026
Security operations: The repository directs people reporting potential security issues to AWS’s security reporting process rather than public GitHub issues. · github.com, 5 Oct 2026
Support: The project directs users to the EKS networking best-practices and troubleshooting guides, GitHub issues, and the Kubernetes Slack #aws-vpc-cni channel. · github.com, 5 Oct 2026
VPC addresses: The plugin assigns pods private IPv4 or IPv6 addresses from the VPC. · docs.aws.amazon.com, 5 Oct 2026

Where Amazon VPC CNI stands on Freedom251

Container Networking Software#24 of 28