Update routes and sg rules within eks terraform script#5256
Open
LordAbhishek wants to merge 1 commit into
Open
Update routes and sg rules within eks terraform script#5256LordAbhishek wants to merge 1 commit into
LordAbhishek wants to merge 1 commit into
Conversation
LordAbhishek
added
pr/no-changelog
LordAbhishek
changed the title
LordAbhishek
added
backport/1.7.x
LordAbhishek
added
backport/2.0.x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Issue:
Terraform failed while creating Kubernetes StorageClasses with (workflow):
Get "http://localhost/apis/storage.k8s.io/v1/storageclasses/gp3": dial tcp 127.0.0.1:80: connect: connection refused.Root cause:
During refresh/apply, the Kubernetes provider can be evaluated before cluster access is fully established. When provider authentication or endpoint resolution is incomplete at that point, the provider may default to localhost, causing the connection refusal.
Fix:
Configured per-cluster Kubernetes providers with exec-based client authentication (
aws eks get-token) so Terraform obtains fresh EKS credentials at runtime and talks to the intended EKS API endpoint instead of falling back to localhost.2. Issue:
Currently vault_partitions_test is failing on EKS workflows.
Logs:
Root Cause:
The failure is caused by network segmentation between two peered VPCs used by
TestVault_Partitions.This test follows
Single Consul Datacenter Across Multiple Kubernetes Clustersarchitecture and runs Consul servers in one EKS cluster and Consul clients in another cluster. Client agent needs to establish Serf LAN gossip membership with external servers, which requires direct pod-to-pod reachability across clusters [flat network].Although VPC peering was enabled, routing allowed only public subnet paths. Because EKS worker nodes and pods run in private subnets, there was no private subnet route between the clusters. As a result, cross-cluster pod-to-pod traffic failed, Client agent Serf LAN membership updates timed out and removes consul server from the pool, and eventually client agents could not become healthy.
Please note: No mesh gateway is used in this test scenario and it is also a reason why only this test requires flat network.
Logs:
Fix:
I have added the routes for private subnet and security group accordingly.
Test:
I have tested it locally on EKS. Test is successfully passing after the change.