This chapter demonstrates the endpoint "hybrid" access cluster scenario. We will deploy a hybrid EKS cluster and illustrate how both private and public endpoints can coexist in the same cluster. We will show how you can restrict access to internal and external services or users in the same cluster. The endpoint hybrid access cluster makes it possible to access the Kubernetes API server from both AWS private and the public networks depending on your needs. The hybrid approach is beneficial when you have a good mix of external and internal access requirements, for example, when your security requirements mandate private endpoint access, but you have an external service such as Jenkins CI/CD pipeline that must access the cluster over the public Internet. You cannot implement this scenario in the endpoint private access cluster if there is no private network connectivity between the external service and the cluster. The only straightforward solution in such scenarios is to configure a public endpoint access for the external services or users while maintaining the private endpoint for internal services or users.