External SNAT support for Windows

[tzifudzi]

Description

What problem are you trying to solve? When launching Windows nodes with Karpenter, there's an absence of a straightforward method to specify CIDR blocks that should be exempt from source network address translation. While a command-line argument exists for the bootstrap script, because the Windows bootstrap script invokation is Karpenter managed, it is not possible to specify the command line argument.

• See https://docs.aws.amazon.com/eks/latest/userguide/external-snat.html for more

How important is this feature to you? The feature is important for use cases involving peered VPCs whereby IPs within peered VPCs have the capability to to access the pod IPs.

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[tzifudzi]

This change will be not be implemented within Karpenter, issue is only added here for tracking. The fix will be applied in the Windows bootstrap to extend it to accept an environment variable that can be set with custom userdata. Will share more information regarding the environment variable name and examples of how to use it at a later time within the next few weeks.

[tzifudzi]

This issue can now be closed as the EKS Windows powershell bootstrap script now accepts an environment variable for External SNAT CIDRs which can be set with custom user data. This is available in the latest EKS Windows Optimizd AMIs, that is, version 1.28-2023.10.19 and later.

Example of setting the external SNAT CIDRs:

apiVersion: karpenter.k8s.aws/v1alpha1
kind: AWSNodeTemplate
...
spec:
  userData: |
    [System.Environment]::SetEnvironmentVariable('EXCLUDED_SNAT_CIDRS', '192.168.40.0/24', 'Machine')
...

This has already been updated in AWS EKS Windows Documentation, and I am happy to add documentation to Karpenter too if necessary.