aws / aws/containers-roadmap

[EKS] [Feature Request]: Allow Cluster In VPC Peer To Access API Server Private Endpoint When Public/Private Endpoint Is Enabled And Public Endpoint Is Restricted By CIDR

Open
#2,003 0 comments 13 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

This request has been submitted on behalf of a customer.

The customer has an EKS cluster in eu-west-2 (cluster A) and also one with the same name in eu-central-1 (cluster B.) Nodes are in private subnets. The cluster's API Servers are set to public/private endpoint access and are restricting access to the public endpoint based on CIDR blocks. The clusters are connected via a VPC Peering connection.

The customer is unable to deploy manifests to or access cluster B from cluster A as access to cluster B's API Server is blocked. This is because calls to cluster B's API Server from cluster A go to the public DNS address/endpoint of cluster A's API Server and not the private endpoint, even though the clusters are connected via the VPC Peering connection. This causes the connection to be blocked by the CIDR restrictions.

Customer's VPCs have:

- **enableDnsHostnames** and **enableDnsSuppor**t set to **true**

- DHCP Options Sets have **AmazonProvidedDNS**

- VPC Peering connection allows DNS resolution from cluster A's VPC.

**Which service(s) is this request for?**

EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Access cluster B's API Server privately. The customer is prohibited from removing the public endpoint CIDR restrictions from the clusters.

**Are you currently working around this issue?**

No workarounds

**Additional context**

N/A

**Attachments**

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.