AWS Launches EKS Hybrid Nodes Gateway, Automating VPC-to-On-Premises Kubernetes Networking With VXLAN Tunnels and Cilium
Amazon's new managed gateway eliminates the need to make on-premises pod CIDRs routable from a VPC, using leader-elected EC2 nodes, VXLAN tunnels, and Cilium VTEP entries to bridge cloud and on-prem Kubernetes traffic.
Overview
Amazon Web Services has launched the Amazon EKS Hybrid Nodes gateway, a managed networking component that automates traffic flow between an EKS cluster’s VPC and Kubernetes pods running on customer hardware in on-premises or edge environments. The feature was announced on April 21, 2026 in the AWS What’s New feed and recapped in the AWS Weekly Roundup for April 27, 2026. The gateway closes a long-standing operational gap in EKS Hybrid Nodes, the service AWS introduced at re:Invent 2024 to let customers register physical or virtual machines in their own data centers as worker nodes inside an AWS-managed Kubernetes control plane.
What We Know
Until now, running EKS Hybrid Nodes required customers to make their on-premises pod CIDR ranges routable from the AWS VPC, typically through Direct Connect or VPN configurations and manual route table edits. The new gateway removes that requirement. According to the AWS announcement, the service “automates networking between your Amazon EKS cluster VPC and Kubernetes Pods running on Amazon EKS Hybrid Nodes” and eliminates the need to make on-premises pod networks routable or coordinate underlying network infrastructure changes.
The gateway is deployed via Helm onto EC2 instances inside the customer’s VPC, and AWS recommends running it in EKS Auto Mode for automatic provisioning of the required labels, taints, and source/destination check configuration, as described in the EKS Hybrid Nodes gateway overview. Under the hood, the gateway creates a VXLAN interface with VNI 2 on UDP port 8472 — Cilium’s default tunneling configuration — and programs FDB entries, ARP entries, and routes to establish encapsulated tunnels with each registered hybrid node, the same documentation states.
A leader-elected gateway pod is responsible for two control plane operations, per the AWS docs: updating VPC route tables so traffic destined for hybrid pod CIDRs is forwarded to the leader’s primary ENI, and writing a CiliumVTEPConfig custom resource that tells Cilium agents on the hybrid nodes which VPC tunnel endpoint to use. AWS recommends a minimum of two gateway pods on separate nodes and reports an expected failover time of three to five seconds when the leader is replaced.
The service is available in every AWS Region where EKS Hybrid Nodes itself is offered, with the exception of the China Regions, according to the AWS announcement. AWS is offering the gateway at no additional charge; customers pay only for the EC2 instances that host it and any associated data transfer. The same announcement notes that the gateway codebase is open source. The supported traffic patterns include Kubernetes control-plane-to-webhook calls, pod-to-pod traffic across cloud and on-premises environments, and connectivity for AWS services such as Application Load Balancers, Network Load Balancers, and Amazon Managed Service for Prometheus.
The launch fits a broader pattern of AWS automating multi-environment networking: earlier this month, the company also moved AWS Interconnect for cross-cloud links to general availability, as previously reported by The Machine Herald.
What We Don’t Know
The overview documentation is explicit that VXLAN tunnels carry no cryptographic protection on their own and that customers should rely on AWS Direct Connect with MACsec or a VPN if they require encryption in transit. AWS has not published guidance on how the gateway interacts with existing service mesh deployments, nor has it released benchmarks comparing throughput and latency of the managed gateway against customer-built routing setups. The same documentation also restricts the gateway to clusters running Cilium as their CNI; AWS has not indicated whether support for Calico, Flannel, or other CNIs is on the roadmap. The AWS Weekly Roundup lists the launch alongside other April announcements but does not provide third-party customer adoption figures, and AWS has not disclosed which enterprises piloted the feature before general availability.