Why two ENIs by default in EKS?

Question

When I create an EKS cluster I see that worker nodes have two ENIs, eth0 and eth1.

Does EKS require two ENIs for its functionality ? Or two ENIs are added to provide more IPs for the pods (using default AWS CNI) ?

Answer 1

By default EKS uses aws-vpc-cni-k8s to allocate IP addresses for pods. The default settings for the CNI plugin is WARM_ENI_TARGET=1 which will ensure you have an additional ENI available for future assignment. Your addresses will be assigned to the first ENI until the max IPs per ENI for the instance type is exhausted, then allocations will come from the second ENI. Once an IP address is assigned to the second ENI a third ENI will be allocated according to the WARM_ENI_TARGET setting. It will continue to allocate additional ENIs as you use addresses until you reach the maximum number of ENIs for the instance type.

Answer 2

The other reason for the second ENI is so that you can you can use secondary CIDRS attached to your VPC. This allowed specific IP planning with a set of IP addresses just for the PODS. When a t3.small gets 11 IPs and a M5.2xlarge gets 58 IPs, you have to plan the subnets.

Review the docs: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html