SNATing for pod IP space to be done only when leaving a private network

[k10a]

Pods in a VPC can talk to:

1. Internet
2. Pods or Instances in another VPC that is connected with a VPC peering connection.
3. Instances or pods in other AWS accounts, but the VPCs involved are part of the same network space and are reachable to each other eg: using architecture like transit-vpc
4. Resources on prem directly reachable using a private IP space using aws components like Direct Connect Gateway.

SNATing should not be done in cases 2-4.
What IP space should involve NATing should be configurable instead of defaulting to VPC CIDR

amazon-vpc-cni-k8s/pkg/networkutils/network.go

Line 99 in eb8fc86

natCmd := []string{"!", "-d", vpcCIDR.String(), "-m", "comment", "--comment", "AWS, SNAT",

[incognick]

Is this being addressed? Currently in the EKS preview I cannot access Pods through a VPC peering connection that are assigned secondary IPs.

[liwenwu-amazon]

this should be addressed by PR #81

[incognick]

@liwenwu-amazon This is still an issue. I have updated to the latest CNI Will use the environment var - AWS_VPC_K8S_CNI_EXTERNALSNAT