Strictly speaking yes, but there are limitations depending on what you do - you can't, for example, do route53 or ACM API's via private link (private-CA does, b

Strictly speaking yes, but there are limitations depending on what you do - you can't, for example, do route53 or ACM API's via private link (private-CA does, but not the general purpose CA) - so things like external-dns and the ACK ALB+Certificate configuration can't work via auto discovery without NAT or being on a public instance. But EKS by itself, you can absolutely do with private subnets and private link API's.