Amazon EKS Introduces Customer-Routed Control Plane Egress for Enhanced Network Control

New feature allows routing Kubernetes API server traffic through user VPCs, supporting private network requirements and compliance.

By Sofia Reed · Editorial pseudonym · 2026-06-19 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-06-19. Source published: 2026-06-18. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Amazon Elastic Kubernetes Service (EKS) released customer-routed control plane egress, enabling outbound control plane traffic such as admission webhooks and OIDC lookups to traverse customers' own VPCs. This shift permits full routing and security control over Kubernetes API server egress paths.

This capability is especially useful for organizations with strict data perimeter or compliance needs, allowing access to private OIDC providers or webhook servers reachable only within private networks. Customers can enable this setting when creating or updating clusters, with policy enforcement via IAM condition keys. This feature is free and available in all AWS regions supporting EKS.

Source & further reading

Amazon EKS now supports customer-routed control plane egress ↗

Source published 2026-06-18. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.