Advanced Networking: Prefix Delegation

The Pod Density Problem

EC2 instances have hard limits on how many ENIs they can attach and how many IPs each ENI can hold. These limits are determined by the instance type and are fixed by AWS.

For example, a t3.medium supports:
- 3 ENIs × 6 IPs per ENI = 18 total IPs
- Minus 1 IP per ENI for the node itself = 15 usable pod IPs

So even if your t3.medium has plenty of CPU and RAM to run 50 small pods, you can only schedule 15 pods before the CNI plugin runs out of IPs to assign. The remaining pods sit in Pending state with the event: 0/1 nodes are available: 1 Insufficient pods.

The Solution: Prefix Delegation

Instead of assigning individual IPs to ENI slots, the VPC CNI plugin can assign an entire /28 CIDR block (a "prefix") to each slot.

• Standard mode: 1 ENI slot → 1 IP → 1 pod
• Prefix Delegation mode: 1 ENI slot → 1 /28 prefix → 16 IPs → up to 16 pods

The math for the same t3.medium:
- 3 ENIs × 6 slots × 16 IPs = 288 potential pod IPs

Now you can fill the node with pods until you exhaust CPU or memory — which is the correct constraint to hit.

Enabling Prefix Delegation

Enabling it is a single environment variable flip on the aws-node DaemonSet — no redeploy, no new CRD, just setting ENABLE_PREFIX_DELEGATION=true.

You also need to set the maximum pods per node. EKS provides a formula and a helper script, but the key point is that after enabling prefix delegation, you must update the --max-pods flag on the kubelet to match the new capacity.

Important caveat: Prefix Delegation requires that your subnets have contiguous /28 blocks available. Heavily fragmented subnets (many small allocations scattered throughout) may not have room for /28 prefixes even if individual IPs are available. This is another reason to plan subnet sizing carefully upfront.