TL;DR The symptom: pods stuck in ContainerCreating, a managed node group failing with InsufficientFreeAddresses, or a cluster update refusing because a subnet has fewer than 6 free addresses. The cause is the same: the subnet was sized for nodes and the Amazon VPC CNI consumes addresses per pod and per ENI. The …

TL;DR A /24 is 256 addresses, 254 hosts in a textbook, and 251 on AWS and Azure or 252 on Google Cloud. Every cloud reserves addresses in every subnet: AWS and Azure the first four and the last (5), Google Cloud the first two and the last two (4). Subtract that number, not 2, from the block size. The table you came …

TL;DR The tool: Kubernetes IP Calculator. Pick EKS, GKE or AKS, the instance type or pods per node, the node count and the zones; get max pods per node, the addresses every node takes, the subnet per zone and the pod and service ranges. Free, one HTML file, nothing leaves your browser. EKS numbers that matter: an …

TL;DR Overlap means one of three things: the ranges are identical (10.0.0.0/16 and 10.0.0.0/16), one contains the other (10.0.0.0/16 contains 10.0.128.0/17), or they are both inside a bigger block you treat as one (10.1.0.0/16 and 10.2.0.0/16 do not overlap; 10.0.0.0/15 contains both 10.0.0.0/16 and 10.1.0.0/16). What …

TL;DR Five tools, one network: 10.0.0.0/16, public and private tiers, several Availability Zones, tested in my browser on 2026-10-19. All five run client-side and all five subtract AWS's five reserved addresses (251 usable per /24). Visual Subnet Calculator is the best tool for exploring an address space: split and …

Part-13 connected VPCs with a Transit Gateway: one hub per region, route tables you write yourself, and peering between regions you also write yourself. This Part-25 is what AWS built on top of that idea: AWS Cloud WAN, where you describe the network you want in one policy document (which regions, which segments, who …

TL;DR What you build: four servers (lb-1, app-1, app-2, db-1), four roles (common, postgres, app, nginx_lb), two playbooks (site.yml from zero, deploy.yml for every new version), a Flask API with a /health endpoint, PostgreSQL with its password in Ansible Vault, and a GitHub Actions workflow that deploys on push. …

Part-22 kept traffic inside AWS with PrivateLink. This Part-23 is about the opposite direction: users on the public internet, anywhere in the world, reaching an application that runs in more than one region - and reaching the closest healthy copy through one fixed pair of IP addresses. I build it the way I did in the …

Introduction The number one reason people give up on learning Ansible is not Ansible. It is the lab. "I need three servers", "I don't have a cloud account", "my free tier expired", "the IPs changed again". So for my Ansible course I built a lab that runs entirely on your laptop, …

Disclosure - this post and the video are sponsored by Teleport. The architecture, the code and the opinions are entirely my own - I built and ran everything shown here myself, and the parts that broke are in here too. 👉 Want to build this yourself? Start with Teleport's agentic identity and access control page (the …