I have an eks cluster integrated on VPC which I am trying to access through eks api. My client runs on bedrock agentcore. Currently the access is enabled by peering eks and agentcore VPCs and creating private DNS zone with A record which contains cluster FQDN pointing to private ips of the EC2 instances hosting eks control plane.
The main issue of this approach is that AWS can move eks control plane from one EC2 instance to another from time to time. In such a case, the record needs to be updated.
I am looking for more stable solution so there is no need to update A record every time control plane been moved.

解决方案

Do not hardcode the EKS control plane ENI IPs. Those are AWS-managed and will change.

When private endpoint access is enabled, EKS creates an AWS-managed Route 53 private hosted zone containing the control plane endpoint records. The issue is that this PHZ is only visible inside the EKS VPC.

For cross-VPC access, use Route 53 Resolver:

Create an Inbound Resolver Endpoint in the EKS VPC.

Create an Outbound Resolver Endpoint in the AgentCore VPC.

Create a Resolver forwarding rule for:

*.eks.amazonaws.com

forwarding to the inbound endpoint IPs.
Associate the rule with the AgentCore VPC.

Now DNS resolution happens through the EKS VPC resolver, which sees the AWS-managed PHZ. When AWS rotates the control plane ENIs, the DNS record updates automatically.

Remove the custom A record。