AWS has added a new EKS feature called 'Customer-routed control plane egress' that allows Kubernetes outbound control plane traffic to flow entirely through a customer's own VPC instead of over the public internet. Previously, traffic from managed EKS nodes (webhook callbacks, OIDC lookups, aggregate API server requests) had to traverse a public network path. Enabling the feature requires setting a flag via the update-cluster-config command, but the change is irreversible for the cluster's lifetime. Once enabled, customers take responsibility for configuring routes, security groups, and endpoints. Combined with the existing Cluster Private Endpoint feature for inbound traffic, EKS clusters can now achieve a fully private networking posture — something Azure and GCP already supported through different architectural approaches.
