Amazon EKS now supports Amazon PrivateLink for the cluster OIDC endpoint
Amazon Elastic Kubernetes Service (Amazon EKS) now supports Amazon PrivateLink for the cluster OIDC discovery and JWKS endpoint. You can now reach the endpoint used by IAM roles for service accounts (IRSA) privately from your VPC without requiring internet egress.
Each EKS cluster publishes public signing keys at its OIDC endpoint for IRSA. With Amazon PrivateLink for the cluster OIDC endpoint, tools running inside your VPC, such as eksctl, Terraform, or custom token validators, can now reach the OIDC discovery document and JWKS privately by creating an interface VPC endpoint for the com.amazonaws.<region>.oidc-eks service. This enables IRSA setup and token validation in VPCs without internet egress and ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS.
Amazon PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard Amazon PrivateLink pricing in the Amazon Web Services China (Beijing) Region, operated by Sinnet, and the Amazon Web Services China (Ningxia) Region, operated by NWCD. To learn more, see Access the cluster OIDC endpoint using Amazon PrivateLink in the Amazon EKS User Guide.