Private
ROUTE T
ABLE (Public subnets)
vpc
local
0.0.0.0/0
Internet gateway
A
vailability Zone A
A
vailability Zone B
Public Subnet B
Public Subnet A
Private Subnet A
Private Subnet B
igw
vgw
cgw
VPN
Network Load Balancer (NLB)
nat
nat
worker
nodes
worker
nodes
On-prem k8s
cluster
ROUTE T
ABLE (Private subnets); proprogate=true
vpc
local
0.0.0.0/0
NA
T gateway
external access IPs (*)
Internet gateway
Calico Enterprise conﬁguration
Remote cluster conﬁguration for the on-prem cluster
No IP pool conﬁguration. SNAT performed by NAT gw
No BGP mesh and no BGP conﬁguration
Calico Enterprise conﬁguration
Remote cluster conﬁguration for the AWS cluster
IP pool conﬁgured for on-prem cluster
IP pool conﬁgured for AWS (if using SNAT)
Use appropriate BGP topology (e.g. peering with cgw as RR)
Security Group (worker nodes)
Add rules according to A
WS docs for VPN peering
Add rules to allow trafﬁc from the peered networks
Network Load Balancer rules are added automatically