Do the arithmetic on the recommended layout before you inherit it.
A /16 is 2^16 addresses, or 65,536 [1]. A /20 is 2^12, or 4,096 [2], and AWS takes five out of every subnet for the network address, the VPC router, DNS, one reserved slot and broadcast [4], leaving 4,091 usable [3]. Three worker subnets at /20, one per availability zone, gives 12,273 usable addresses [4], and the /16 above them holds sixteen /20s in total [5].
That last figure is the whole EKS argument. Under the VPC CNI every pod can consume an ENI-backed IP, and the dev.to walkthrough calls IP exhaustion one of the most common EKS production incidents [9]. The 4,091 figure is a pod ceiling per zone, shared with rolling deployments that run old and new pods at once [8], not a node ceiling. For the /20 default to transfer to your cluster, steady-state pod count plus deploy surge has to sit under about four thousand per zone. If it does not, the fix is a wider prefix, and the prefix is the part you cannot revise once peering or Transit Gateway attachments exist [6].
The sizing rule has a rounding edge. Round the host requirement up to the next power of two and subtract the exponent from 32, so 300 hosts becomes 512, which is 2^9, which gives /23 [5]. The rule counts addresses, not usable ones. A /23 is 512 total and 507 after the reserves [6], so a requirement written as "512 hosts" is met on paper and five short in the subnet. Five addresses is not much of a shortfall until the person who wrote the requirement meant it.
Routing is where the "public subnet" abstraction misleads. A subnet is public because its route table carries 0.0.0.0/0 to an internet gateway, matched most-specific-first against an implicit local route for the full VPC CIDR that cannot be removed [11][12]. In Terraform, the table and the route do nothing to a subnet on their own; aws_route_table_association is what binds them and makes routing take effect [13]. The sample table in the walkthrough is tagged Name = "rtb-public" and Tier = "public" [22]. Those tags describe the subnet but do not route a single packet. A module that creates the table and skips the association leaves you a subnet that reads public in the console and behaves private on the wire.
Egress runs through two translations, not one [20]. For a private instance at 10.0.2.15 reaching a public registry:
1. The private route table sends 0.0.0.0/0 to the NAT gateway [19]. 2. The NAT gateway rewrites the source to its own Elastic IP and an ephemeral port [19]. 3. The NAT gateway's own public subnet route table sends the packet to the internet gateway [19]. 4. The internet gateway performs a separate 1:1 translation [19].
Step three is why the NAT gateway has to sit in a public subnet at all: it needs its own route to the IGW [21]. And because the public IP mapping lives at the gateway rather than on the ENI, `ip addr` on an instance never shows its public address [15]. That constraint matters for diagnosis, not as a curiosity: when you work the inbound checklist of public IP on the ENI, default route to the IGW, and security group plus NACL permitting the port [16], you cannot confirm the first item from inside the box. Any one of the three missing returns the same silent timeout with no pointer to the cause, which is why the walkthrough treats them as a single list rather than three troubleshooting paths [17].
