☸️ CoreDNS and AWS VPC CNI in EKS

CoreDNS vs AWS VPC CNI in EKS: What Each Component Actually Does

When working with Amazon EKS, two important components help your Kubernetes cluster communicate properly: CoreDNS and AWS VPC CNI.

Both are part of the networking story, but they do very different jobs. CoreDNS helps pods find services by name, while AWS VPC CNI gives pods network connectivity using IP addresses from your AWS VPC.

In simple words:

  • CoreDNS answers: “What IP address belongs to this service name?”
  • AWS VPC CNI answers: “How does traffic reach that pod over the network?”

1. What is CoreDNS?

CoreDNS is the DNS server used inside Kubernetes. Its main job is to resolve Kubernetes service names into IP addresses.

For example, if one pod wants to call another service using a name like: 

user-service.default.svc.cluster.local

CoreDNS resolves that service name into the correct Kubernetes service IP.

What CoreDNS Does

  • Resolves Kubernetes service names
  • Supports pod-to-service communication
  • Helps with internal service discovery
  • Forwards external DNS queries to upstream DNS resolvers

Simple CoreDNS Flow

Pod → CoreDNS → Service IP → kube-proxy → Target Pod

Step by step:

  1. A pod sends a request using a Kubernetes service name.
  2. CoreDNS resolves the service name into a ClusterIP.
  3. Kubernetes routes the traffic to the correct backend pod.

Important Note About CoreDNS

CoreDNS is mainly used for internal cluster DNS resolution. If traffic comes from the internet through an ALB or Ingress, CoreDNS is usually not part of the first external request flow.

Example external flow: 

Internet → ALB → Ingress → Service → Pod

In this flow, the public request is handled by the ALB and Ingress first. CoreDNS becomes important when a pod inside the cluster needs to call another internal service by name.


2. What is AWS VPC CNI?

AWS VPC CNI is the networking plugin used by Amazon EKS. It is responsible for giving pods IP addresses from your AWS VPC subnets.

This is one of the key differences in EKS networking. In many Kubernetes environments, pod networking may use an overlay network. In EKS with AWS VPC CNI, pods receive real VPC IP addresses.

What AWS VPC CNI Does

  • Assigns IP addresses to pods
  • Uses AWS VPC subnets for pod networking
  • Connects pod traffic to AWS networking
  • Allows pod-to-pod communication through the VPC network
  • Uses Elastic Network Interfaces, also called ENIs, on worker nodes

Example pod IPs: 

Pod A IP: 10.0.1.25
Pod B IP: 10.0.2.18

These IPs come from the VPC subnet, not from a separate overlay network.

Simple AWS VPC CNI Flow

Pod → Node ENI → VPC network → Target Pod

The AWS VPC CNI allows pod traffic to move through AWS networking using real pod IPs.


3. How CoreDNS and AWS VPC CNI Work Together

CoreDNS and AWS VPC CNI work together during internal service communication.

Let us say order-service needs to call user-service. 

order-service Pod → CoreDNS → user-service IP → kube-proxy → VPC CNI network → user-service Pod

Step by step:

  1. The order-service pod sends a request using the user-service name.
  2. CoreDNS resolves the user-service name into a Kubernetes service IP.
  3. kube-proxy helps route the request to one of the backend pods.
  4. AWS VPC CNI handles the actual pod networking path through the VPC.
  5. The request reaches the target user-service pod.

4. Easy Difference to Remember

Component Main Purpose Simple Meaning
CoreDNS Resolves service names to IP addresses Finds where the service is
AWS VPC CNI Provides pod networking using VPC IPs Moves traffic through the network

5. Common Issues and Debugging

This is where understanding CoreDNS and AWS VPC CNI becomes very useful. Many EKS issues look like application issues, but the real problem may be DNS resolution or pod networking.

CoreDNS Issue Example

If CoreDNS is unhealthy or overloaded, pods may fail to resolve service names. You may see errors like: 

Temporary failure in name resolution
nslookup: connection timed out
no such host

Useful commands to check CoreDNS: 

kubectl get pods -n kube-system | grep coredns

kubectl logs -n kube-system -l k8s-app=kube-dns

kubectl describe deployment coredns -n kube-system

AWS VPC CNI Issue Example

If AWS VPC CNI has issues, pods may fail to get IP addresses or may not communicate correctly.

Common causes include:

  • Subnet IP exhaustion
  • ENI limits reached on worker nodes
  • aws-node DaemonSet problems
  • Security group or network ACL restrictions

Useful commands to check AWS VPC CNI: 

kubectl get pods -n kube-system | grep aws-node

kubectl logs -n kube-system -l k8s-app=aws-node

kubectl describe daemonset aws-node -n kube-system

Pod Pending Due to IP Issues

If a pod is stuck in Pending, one possible reason is that the node or subnet does not have enough available IP addresses.

Check the pod events: 

kubectl describe pod <pod-name> -n <namespace>

Look for messages related to IP assignment or CNI failures.


6. Real Production Example

In real production environments, you may see application errors like: 

context deadline exceeded

This usually means the request did not complete before the timeout. The root cause could be at the application level, but it can also be related to infrastructure issues.

In an EKS environment, this type of error may be connected to:

  • Slow DNS resolution from CoreDNS
  • Network path issues between pods
  • Pod or service endpoint problems
  • AWS VPC CNI networking issues
  • Target service being overloaded or unavailable

That is why it is important to check both DNS and networking while debugging EKS service communication issues.


7. Quick Troubleshooting Table

Problem Possible Area What to Check
Service name does not resolve CoreDNS CoreDNS pods and logs
Pod cannot connect to another pod VPC CNI / Network aws-node logs, security groups, routes
Pod stuck in Pending VPC CNI / IP capacity Pod events, subnet IP availability
context deadline exceeded DNS / Network / App CoreDNS logs, service endpoints, target pod health

8. Frequently Asked Questions

Does CoreDNS handle external traffic?

No. CoreDNS mainly handles DNS resolution inside the Kubernetes cluster. For external traffic, components like ALB, Ingress, services, and pods are usually involved first.

Does AWS VPC CNI assign real VPC IPs to pods?

Yes. In Amazon EKS, AWS VPC CNI assigns pod IP addresses from your AWS VPC subnets.

Can CoreDNS cause application timeouts?

Yes, sometimes. If DNS resolution is slow or failing, an application may not be able to reach another service in time. But timeout errors can also come from application performance, service overload, network issues, or target pod problems.

Can AWS VPC CNI cause pods to stay Pending?

Yes. If there are not enough available IP addresses in the subnet, or if ENI limits are reached, new pods may fail to get IP addresses and remain Pending.


9. Final Thought

If you are learning Amazon EKS, understanding CoreDNS and AWS VPC CNI is a great starting point.

CoreDNS helps pods find services by name. AWS VPC CNI helps pods communicate over the AWS network.

Together, they make internal communication inside EKS possible. When debugging EKS issues, always remember to check both:

  • DNS resolution through CoreDNS
  • Pod networking through AWS VPC CNI

Many production issues that look like application failures can actually be DNS or networking problems underneath.

Popular posts from this blog

☁️ AWS Global Accelerator (GA) + Route 53

🟧☁️ AWS + 🌍 Global Accelerator (GA) + 🌐 Route 53 what they are and how they work together (especially for ALB/EKS). ☁️ AWS = Cloud platform 🌍 GA = Fast global routing + static IPs 🌐 Route 53 = DNS ☁️ What is AWS? AWS (Amazon Web Services) is Amazon’s cloud platform where you run servers, containers, databases, networking, DNS, monitoring, and more. EC2 (servers), EKS (Kubernetes), RDS (databases) ALB/NLB (load balancers), S3 (storage), Route 53 (DNS) What is AWS Global Accelerator? Global Accelerator (GA) improves availability and performance by routing users through AWS’s private global network to the nearest healthy endpoint . Key idea: Users hit GA (static Anycast IPs). GA picks the best Region/endpoint automatically. Static Anycast IPs (2 fixed IP addresse...
Read more

🐳 Docker Filesystem Internals (AdvancEd)

Docker Filesystem Internals (Advanced) This post is for readers who already understand Docker basics and want to learn how Docker manages files internally. If you are new to Docker, read the beginner guide first. Containers Do NOT Have Their Own Disk A common misunderstanding is that Docker containers have their own disk. In reality: Containers do not have a separate physical filesystem. Docker creates a filesystem view using layers stored on the host machine. This layered filesystem is implemented using a Union Filesystem , most commonly OverlayFS on Linux. Docker Images Are Read-Only Layers A Docker image is made up of multiple read-only layers. Each instruction in a Dockerfile creates a new layer. FROM python:3.11 RUN pip install flask COPY app.py . This results in layers lik...
Read more

Understanding RabbitMQ Classic Mirrored Queues and Quorum Queues

Image
💚💚 💚 Understanding RabbitMQ Classic Mirrored Queues and Quorum  Queues 💚💚 💚   I understood RabbitMQ only after I understood why Classic Mirrored Queues were replaced . When I first started learning RabbitMQ, I kept hearing: Classic Queues Classic Mirrored Queues Quorum Queues Raft Consensus Everyone said:  "Use Quorum Queues." But I couldn't understand why. To understand Quorum Queues , I first had to understand how Classic Mirrored Queues worked.
Read more

🐳 Docker Tutorial for Beginners: Step-by-Step with a Simple Example

Docker Explained Using a Very Simple App (Beginner Friendly) Goal: Build a tiny Python app, run it normally, then run the same app using Docker, and understand why Docker helps. Step 1: Create a Very Small Python App Create a file named app.py : print("Hello I am running inside Docker!") Step 2: Run the App WITHOUT Docker Run this on your machine: python app.py Common real-life problems: Python not installed, wrong Python version, missing dependencies, different OS behavior this is where the “works on my machine” issue starts. Step 3: Introduce Docker Instead of relying on your system, Docker lets you package the runtime (Python) together with your app. We’ll do that using a Dockerfile . Step 4: Create a Dockerfile Create a file named Dockerfile (no extension): FROM python:3.11 WORKDIR /app COPY app.py . CMD ["py...
Read more

☸️What’s Inside EKS? A Beginner’s Guide to Its Core Components

Image
 EKS (Elastic Kubernetes Service) EKS is a managed service by AWS that runs Kubernetes for you. It takes care of setting up and managing the Kubernetes control plane so you can focus on running your applications. Kubernetes  Kubernetes is an open-source system for automating the deployment, scaling, and management of containerized applications. It helps run apps reliably across a cluster of machines, automatically handling scheduling, scaling, updates, and recovery. Pod A Pod is the smallest unit in Kubernetes. It can hold one or more containers that share the same network and storage. All containers in a pod are scheduled and managed together. Container A Container is a lightweight, standalone package that includes everything an app needs to run — code, runtime, libraries, and dependencies. It ensures the app runs the same no matter where it’s deployed. 👀1 pod can have multiple containers but 1 container cannot belongs to multiple pods.
Read more

☸️ Kubernetes Taints and Tolerations(with Node Affinity)

Kubernetes Taints and Tolerations(with Node Affinity + EKS Upgrade Context) Kubernetes scheduling is the process of deciding which node runs a given Pod . This page explains how Kubernetes keeps Pods away from “inappropriate” nodes using taints (node-side restrictions) and tolerations (pod-side permissions), and how that relates to node affinity (pod-side attraction). 1) Core idea: attraction vs repulsion Node affinity (attraction) Node affinity is a property of Pods that attracts them to a set of nodes. You can express it as: Hard requirement (must match), or Preference (nice to have). Taints (repulsion) Taints are the opposite of node affinity. They allow a node to repel a set of Pods. Tolerations (permission) Tolerations are applied to Pods. A toleration allows the scheduler to schedule Pods onto nodes with matching taints. Important...
Read more

AWS Load Balancer Controller Upgrade Guide: v2.x to v3.3

Image
AWS Load Balancer Controller Upgrade Guide: v2.x to v3.3 What is AWS Load Balancer Controller? AWS Load Balancer Controller is a Kubernetes controller that integrates Amazon EKS with AWS Elastic Load Balancing services. It watches Kubernetes resources and automatically creates or updates AWS load balancing resources based on the desired state defined inside the cluster. Instead of manually creating load balancers, listeners, target groups, and security group rules in AWS, teams can define Kubernetes resources such as Ingresses and Services. The controller then reconciles those resources with AWS. What Does It Manage? AWS Load Balancer Controller commonly manages: Application Load Balancers (ALB) Network Load Balancers (NLB) Listeners and listener rules Target groups Target registration and deregistration Security group rules Ingress resources TargetGroupBinding resources Beca...
Read more

🐳 Build a Tiny Flask Web App in Docker (with Ports)

docker run -p 8080:5000 flask-hello Then open in your browser: http://localhost:8080 Step 6: Stop the container Press Ctrl + C in the terminal. Quick Troubleshooting Browser says “This site can’t be reached”: Make sure the container is running and you used the -p port mapping. Flask runs but not accessible: Confirm Flask is running with host="0.0.0.0" inside Docker (not 127.0.0.1 ). Port already in use: Try using a different host port, for example: docker run -p 9090:5000 flask-hello Next Post Ideas Docker image layers and caching (explained simply) Docker volumes : keeping data after a container stops Running the same container in Kubernetes (Pod basics)
Read more

☁️ Amazon S3 Explained: More Than Just Object Storage

Amazon S3 Explained: More Than Just Object Storage When people hear Amazon S3 , they usually think it is only used to store files like images, logs, backups, or documents. That is true, but S3 has grown into much more than simple object storage. Today, S3 can be used for object storage, file-like access, immutable backups, lifecycle management, static websites, event-driven workflows, analytics, and data lake storage. In this post, let us understand what S3 is and how it is used in real-world AWS environments. 1. What is Amazon S3? Amazon S3 stands for Simple Storage Service . It is mainly an object storage service . In S3, data is stored as objects inside buckets. Bucket → Object Each object usually contains: The actual data Metadata A unique object key Example: Bucket name: my-app-logs Object key: logs/2026/app.log Even though this looks like a folder path, S3 does not work like a traditional filesystem internally. The folder-like str...
Read more