What Is the Process of Configuring EKS Using a Bastion Host in TypeScript

Introduction

In this guide, we will walk through the process of configuring an Amazon Elastic Kubernetes Service (EKS) cluster using a bastion host. The key services involved in this setup are Amazon EKS for the Kubernetes cluster and an EC2 instance for the bastion host. The bastion host will be used to securely access the EKS cluster.

Step-by-Step Explanation

Step 1: Set Up the VPC

1. Create a new VPC with the necessary subnets, route tables, and internet gateway.
2. Ensure that you have both public and private subnets.
3. Configure the necessary security groups for the VPC.

Step 2: Create the Bastion Host

1. Launch an EC2 instance in one of the public subnets to act as the bastion host.
2. Configure the security group for the bastion host to allow SSH access from your IP address.
3. Install necessary tools on the bastion host, such as kubectl and aws-iam-authenticator.

Step 3: Set Up the EKS Cluster

1. Create an EKS cluster in the private subnets of your VPC.
2. Configure the security group for the EKS cluster to allow communication with the worker nodes.
3. Create node groups for the EKS cluster.

Step 4: Configure Access to the EKS Cluster

1. SSH into the bastion host.
2. Use kubectl and aws-iam-authenticator to configure access to the EKS cluster from the bastion host.
3. Verify that you can access the EKS cluster by running kubectl get nodes.

Conclusion

By following these steps, you have successfully set up an EKS cluster with a bastion host for secure access. This configuration ensures that your EKS cluster is not directly exposed to the internet, enhancing security.

Full Code Example

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

// Step 1: Set Up the VPC
const vpc = new aws.ec2.Vpc("vpc", {
    cidrBlock: "10.0.0.0/16",
});

const publicSubnet = new aws.ec2.Subnet("publicSubnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.1.0/24",
    mapPublicIpOnLaunch: true,
});

const privateSubnet = new aws.ec2.Subnet("privateSubnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.2.0/24",
});

const internetGateway = new aws.ec2.InternetGateway("internetGateway", {
    vpcId: vpc.id,
});

const routeTable = new aws.ec2.RouteTable("routeTable", {
    vpcId: vpc.id,
    routes: [{
        cidrBlock: "0.0.0.0/0",
        gatewayId: internetGateway.id,
    }],
});

new aws.ec2.RouteTableAssociation("publicRouteTableAssociation", {
    subnetId: publicSubnet.id,
    routeTableId: routeTable.id,
});

const securityGroup = new aws.ec2.SecurityGroup("securityGroup", {
    vpcId: vpc.id,
    ingress: [{
        protocol: "tcp",
        fromPort: 22,
        toPort: 22,
        cidrBlocks: ["0.0.0.0/0"],
    }],
    egress: [{
        protocol: "-1",
        fromPort: 0,
        toPort: 0,
        cidrBlocks: ["0.0.0.0/0"],
    }],
});

// Step 2: Create the Bastion Host
const bastionHost = new aws.ec2.Instance("bastionHost", {
    instanceType: "t2.micro",
    ami: "ami-0c55b159cbfafe1f0", // Amazon Linux 2 AMI
    subnetId: publicSubnet.id,
    securityGroups: [securityGroup.name],
    userData: \`#!/bin/bash
    yum update -y
    yum install -y kubectl aws-iam-authenticator
    \`,
});

// Step 3: Set Up the EKS Cluster
const eksCluster = new eks.Cluster("eksCluster", {
    vpcId: vpc.id,
    publicSubnetIds: [publicSubnet.id],
    privateSubnetIds: [privateSubnet.id],
    instanceType: "t2.medium",
    desiredCapacity: 2,
    minSize: 1,
    maxSize: 3,
});

// Step 4: Export Outputs
export const vpcId = vpc.id;
export const bastionHostPublicIp = bastionHost.publicIp;
export const eksClusterName = eksCluster.eksCluster.name;