https://pulumi.com
Join Slack
This message was deleted.
# kubernetes
s
This message was deleted.
p
I am, although I'm still at the trying to get a cluster up and running stage.
👍 1
I haven't used eks.NodeGroup yet but will probably do so shortly.
b
I was able to get eks.Cluster working with an eks.ManagedNodeGroup, but that doesn't have input for security groups
p
I have been adding rules to security groups to allow EFS access and some other things. I created the cluster first and then did this:
Copy code
// Need to be able to access the EFS (NFS) ports from the node sg and cluster sg
const nodeEFS = new aws.ec2.SecurityGroupRule("nodeEFS", {
	type: "ingress",
	fromPort: 2049,
	toPort: 2049,
	protocol: "tcp",
	securityGroupId: endp.ids[0],
	sourceSecurityGroupId: sg.id,
	description: `Allow the ${nam} k8s cluster access to the EFS drive in the endpoints sg`,
});
so sg.Id is the security group I used in the 
clusterSecurityGroup
in the new eks.Cluster
and 
endp.ids[0]
is the result of Looking up security groups tagged with 'endpoints' in the current vpc
Copy code
const clusterEFS = new aws.ec2.SecurityGroupRule("clusterEFS", {
	type: "ingress",
	fromPort: 2049,
	toPort: 2049,
	protocol: "tcp",
	securityGroupId: endp.ids[0],
	sourceSecurityGroupId: cluster.nodeSecurityGroup.id,
	description: `Allow the ${nam} k8s cluster access to the EFS drive in the endpoints sg`,
});
This is pretty much the same thing, but here cluster.nodeSecurityGroup.id is the id of the node security group created by the 
new eks.Cluster
hth
b
Ahhh....filtering by endpoints in vpc though? What if you have multiple clusters?
p
I don't 😜
but you could use better tagging than I have
or if you use pulumi to create all the endpoints and endpoint security groups, you could also get the right sg with Stack References
but in my case the endpoint sg already exists (hand-crafted) so I just tagged it so I could find it with a bit of code like:
Copy code
const endp = pulumi.output(aws.ec2.getSecurityGroups({
        tags: { 
                Job: "Endpoints",
        },
        filters: [
                {
                        name: "vpc-id",
                        values: [vpcid],
                },
        ],
}));
👍 1
b
I have multiple clusters with multiple `eks.NodeGroup`s in each, if you're still looking for pointers. It works pretty well, with some caveats around 
desiredCapacity
overriding what's set by the cluster autoscaler.
b
That's awesome thanks! How are you setting the cluster argument of the 
eks.NodeGroup
?
b
Basically like:
Copy code
const clusterOutput = new eks.Cluster(...);
clusterOutput.apply((cluster) => {
  new eks.NodeGroup(
    "group-name",
    {
      cluster,
      ...
    });
});
Unwrap the 
pulumi.Output<eks.Cluster>
via the 
apply
method.
b
Hmm, I was passing in cluster.core. I'll try this out, thanks!
👍🏻 1
22 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by