search

aws-quickstart / cdk-eks-blueprints

AWS Quick Start Team
Apache License 2.0
449 stars 198 forks source link

[FEATURE] - Fully Private EKS Cluster #136

Open starchx opened 3 years ago

starchx commented 3 years ago

This one is commonly required in the financial industry. User may provide proxy server but with strict outbound filtering (e.g. block Github access, which means all the addons need to be hosted within private repos internally).

This requires us to use AWS service VPC endpoint as much as we can and only use proxy when the AWS services that do not support VPC Endpoint (such as EKS service API).

Related to this issue: https://github.com/aws-quickstart/quickstart-ssp-amazon-eks/issues/49

shapirov103 commented 2 years ago

@starchx can you specify where specifically private VPC endpoints are needed? Is it Velero for S3 access? Something else? Private cluster support with private repos is supported. I can add an example pattern with the proxy server for GitHub access for example.

starchx commented 2 years ago

Thanks @shapirov103 .

The use case is when the customer only allows outbound access via an internal managed proxy server, or no outbound internet access at all. That means the cluster creator lambda and kubectl lambda (from cdk-eks module) will need to be placed inside the customer's VPC.

EKS VPC endpoint support is on the roadmap (https://github.com/aws/containers-roadmap/issues/298), so outbound internet is still required via proxy.

For the blueprint, I think we can just add the proxy support, e.g. allow customers to specify their own proxy servers. We would need to pass that proxy to environment variables to both lambdas (https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-eks.Cluster.html#kubectlenvironment)

starchx commented 1 year ago

This feature may not be needed anymore, thanks to EKS Private Endpoint: https://github.com/aws/containers-roadmap/issues/298