Hybrid nodes on Amazon EKS give you a fully managed cloud control plane while letting you run workloads on your own on-premises hardware. At ORF.at we run exactly this setup in production, EKS connected with On-Prem and Cilium running in VXLAN.
This session puts the spotlight on the one problem that actually kills the whole architecture: admission webhooks become completely unreachable for the control plane the second you enable Cilium VXLAN. Crossplane brings dozens of webhooks. Kyverno multiplies it. We show the failures, explain why it happens, and demonstrate the routing layer that makes the hybrid cluster stable in real production.
Furthermore, we are going to compare the Hybrid Node architecture with other options and why we decided to go this way.