Docs
Packageseks.VpcCni
Explore with Pulumi AI
VpcCni manages the configuration of the Amazon VPC CNI plugin for Kubernetes by applying its YAML chart.
Create VpcCni Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new VpcCni(name: string, args: VpcCniArgs, opts?: CustomResourceOptions);@overload
def VpcCni(resource_name: str,
args: VpcCniArgs,
opts: Optional[ResourceOptions] = None)
@overload
def VpcCni(resource_name: str,
opts: Optional[ResourceOptions] = None,
kubeconfig: Optional[Any] = None,
external_snat: Optional[bool] = None,
custom_network_config: Optional[bool] = None,
init_image: Optional[str] = None,
disable_tcp_early_demux: Optional[bool] = None,
enable_ipv6: Optional[bool] = None,
enable_pod_eni: Optional[bool] = None,
enable_prefix_delegation: Optional[bool] = None,
eni_config_label_def: Optional[str] = None,
cni_custom_network_cfg: Optional[bool] = None,
cni_configure_rpfilter: Optional[bool] = None,
warm_prefix_target: Optional[int] = None,
cni_external_snat: Optional[bool] = None,
eni_mtu: Optional[int] = None,
log_file: Optional[str] = None,
log_level: Optional[str] = None,
node_agent_image: Optional[str] = None,
node_port_support: Optional[bool] = None,
security_context_privileged: Optional[bool] = None,
veth_prefix: Optional[str] = None,
warm_eni_target: Optional[int] = None,
warm_ip_target: Optional[int] = None,
image: Optional[str] = None)func NewVpcCni(ctx *Context, name string, args VpcCniArgs, opts ...ResourceOption) (*VpcCni, error)public VpcCni(string name, VpcCniArgs args, CustomResourceOptions? opts = null)
public VpcCni(String name, VpcCniArgs args)
public VpcCni(String name, VpcCniArgs args, CustomResourceOptions options)
type: eks:VpcCni
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args VpcCniArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args VpcCniArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args VpcCniArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args VpcCniArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args VpcCniArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Example
The following reference example uses placeholder values for all input properties.
var vpcCniResource = new Eks.VpcCni("vpcCniResource", new()
{
Kubeconfig = "any",
ExternalSnat = false,
CustomNetworkConfig = false,
InitImage = "string",
DisableTcpEarlyDemux = false,
EnableIpv6 = false,
EnablePodEni = false,
EnablePrefixDelegation = false,
EniConfigLabelDef = "string",
CniCustomNetworkCfg = false,
CniConfigureRpfilter = false,
WarmPrefixTarget = 0,
CniExternalSnat = false,
EniMtu = 0,
LogFile = "string",
LogLevel = "string",
NodeAgentImage = "string",
NodePortSupport = false,
SecurityContextPrivileged = false,
VethPrefix = "string",
WarmEniTarget = 0,
WarmIpTarget = 0,
Image = "string",
});
example, err := eks.NewVpcCni(ctx, "vpcCniResource", &eks.VpcCniArgs{
Kubeconfig: pulumi.Any("any"),
ExternalSnat: pulumi.Bool(false),
CustomNetworkConfig: pulumi.Bool(false),
InitImage: pulumi.String("string"),
DisableTcpEarlyDemux: pulumi.Bool(false),
EnableIpv6: pulumi.Bool(false),
EnablePodEni: pulumi.Bool(false),
EnablePrefixDelegation: pulumi.Bool(false),
EniConfigLabelDef: pulumi.String("string"),
CniCustomNetworkCfg: pulumi.Bool(false),
CniConfigureRpfilter: pulumi.Bool(false),
WarmPrefixTarget: pulumi.Int(0),
CniExternalSnat: pulumi.Bool(false),
EniMtu: pulumi.Int(0),
LogFile: pulumi.String("string"),
LogLevel: pulumi.String("string"),
NodeAgentImage: pulumi.String("string"),
NodePortSupport: pulumi.Bool(false),
SecurityContextPrivileged: pulumi.Bool(false),
VethPrefix: pulumi.String("string"),
WarmEniTarget: pulumi.Int(0),
WarmIpTarget: pulumi.Int(0),
Image: pulumi.String("string"),
})
var vpcCniResource = new VpcCni("vpcCniResource", VpcCniArgs.builder()
.kubeconfig("any")
.externalSnat(false)
.customNetworkConfig(false)
.initImage("string")
.disableTcpEarlyDemux(false)
.enableIpv6(false)
.enablePodEni(false)
.enablePrefixDelegation(false)
.eniConfigLabelDef("string")
.cniCustomNetworkCfg(false)
.cniConfigureRpfilter(false)
.warmPrefixTarget(0)
.cniExternalSnat(false)
.eniMtu(0)
.logFile("string")
.logLevel("string")
.nodeAgentImage("string")
.nodePortSupport(false)
.securityContextPrivileged(false)
.vethPrefix("string")
.warmEniTarget(0)
.warmIpTarget(0)
.image("string")
.build());
vpc_cni_resource = eks.VpcCni("vpcCniResource",
kubeconfig="any",
external_snat=False,
custom_network_config=False,
init_image="string",
disable_tcp_early_demux=False,
enable_ipv6=False,
enable_pod_eni=False,
enable_prefix_delegation=False,
eni_config_label_def="string",
cni_custom_network_cfg=False,
cni_configure_rpfilter=False,
warm_prefix_target=0,
cni_external_snat=False,
eni_mtu=0,
log_file="string",
log_level="string",
node_agent_image="string",
node_port_support=False,
security_context_privileged=False,
veth_prefix="string",
warm_eni_target=0,
warm_ip_target=0,
image="string")
const vpcCniResource = new eks.VpcCni("vpcCniResource", {
kubeconfig: "any",
externalSnat: false,
customNetworkConfig: false,
initImage: "string",
disableTcpEarlyDemux: false,
enableIpv6: false,
enablePodEni: false,
enablePrefixDelegation: false,
eniConfigLabelDef: "string",
cniCustomNetworkCfg: false,
cniConfigureRpfilter: false,
warmPrefixTarget: 0,
cniExternalSnat: false,
eniMtu: 0,
logFile: "string",
logLevel: "string",
nodeAgentImage: "string",
nodePortSupport: false,
securityContextPrivileged: false,
vethPrefix: "string",
warmEniTarget: 0,
warmIpTarget: 0,
image: "string",
});
type: eks:VpcCni
properties:
cniConfigureRpfilter: false
cniCustomNetworkCfg: false
cniExternalSnat: false
customNetworkConfig: false
disableTcpEarlyDemux: false
enableIpv6: false
enablePodEni: false
enablePrefixDelegation: false
eniConfigLabelDef: string
eniMtu: 0
externalSnat: false
image: string
initImage: string
kubeconfig: any
logFile: string
logLevel: string
nodeAgentImage: string
nodePortSupport: false
securityContextPrivileged: false
vethPrefix: string
warmEniTarget: 0
warmIpTarget: 0
warmPrefixTarget: 0
VpcCni Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The VpcCni resource accepts the following input properties:
- Kubeconfig object
- The kubeconfig to use when setting the VPC CNI options.
- Cni
Configure boolRpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - Cni
Custom boolNetwork Cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - Cni
External boolSnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - Custom
Network boolConfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- Disable
Tcp boolEarly Demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- Enable
Ipv6 bool - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- Enable
Pod boolEni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - Enable
Prefix boolDelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- Eni
Config stringLabel Def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- Eni
Mtu int Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- External
Snat bool Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- Image string
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- Init
Image string Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- Log
File string Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- Log
Level string Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- Node
Agent stringImage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- Node
Port boolSupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- Security
Context boolPrivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- Veth
Prefix string Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- Warm
Eni intTarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- Warm
Ip intTarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- Warm
Prefix intTarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
- Kubeconfig interface{}
- The kubeconfig to use when setting the VPC CNI options.
- Cni
Configure boolRpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - Cni
Custom boolNetwork Cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - Cni
External boolSnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - Custom
Network boolConfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- Disable
Tcp boolEarly Demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- Enable
Ipv6 bool - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- Enable
Pod boolEni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - Enable
Prefix boolDelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- Eni
Config stringLabel Def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- Eni
Mtu int Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- External
Snat bool Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- Image string
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- Init
Image string Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- Log
File string Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- Log
Level string Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- Node
Agent stringImage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- Node
Port boolSupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- Security
Context boolPrivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- Veth
Prefix string Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- Warm
Eni intTarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- Warm
Ip intTarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- Warm
Prefix intTarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
- kubeconfig Object
- The kubeconfig to use when setting the VPC CNI options.
- cni
Configure BooleanRpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - cni
Custom BooleanNetwork Cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - cni
External BooleanSnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - custom
Network BooleanConfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- disable
Tcp BooleanEarly Demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- enable
Ipv6 Boolean - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- enable
Pod BooleanEni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - enable
Prefix BooleanDelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- eni
Config StringLabel Def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- eni
Mtu Integer Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- external
Snat Boolean Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- image String
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- init
Image String Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- log
File String Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- log
Level String Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- node
Agent StringImage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- node
Port BooleanSupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- security
Context BooleanPrivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- veth
Prefix String Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- warm
Eni IntegerTarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- warm
Ip IntegerTarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- warm
Prefix IntegerTarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
- kubeconfig any
- The kubeconfig to use when setting the VPC CNI options.
- cni
Configure booleanRpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - cni
Custom booleanNetwork Cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - cni
External booleanSnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - custom
Network booleanConfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- disable
Tcp booleanEarly Demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- enable
Ipv6 boolean - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- enable
Pod booleanEni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - enable
Prefix booleanDelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- eni
Config stringLabel Def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- eni
Mtu number Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- external
Snat boolean Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- image string
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- init
Image string Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- log
File string Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- log
Level string Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- node
Agent stringImage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- node
Port booleanSupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- security
Context booleanPrivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- veth
Prefix string Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- warm
Eni numberTarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- warm
Ip numberTarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- warm
Prefix numberTarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
- kubeconfig Any
- The kubeconfig to use when setting the VPC CNI options.
- cni_
configure_ boolrpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - cni_
custom_ boolnetwork_ cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - cni_
external_ boolsnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - custom_
network_ boolconfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- disable_
tcp_ boolearly_ demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- enable_
ipv6 bool - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- enable_
pod_ booleni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - enable_
prefix_ booldelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- eni_
config_ strlabel_ def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- eni_
mtu int Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- external_
snat bool Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- image str
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- init_
image str Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- log_
file str Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- log_
level str Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- node_
agent_ strimage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- node_
port_ boolsupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- security_
context_ boolprivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- veth_
prefix str Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- warm_
eni_ inttarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- warm_
ip_ inttarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- warm_
prefix_ inttarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
- kubeconfig Any
- The kubeconfig to use when setting the VPC CNI options.
- cni
Configure BooleanRpfilter - Specifies whether ipamd should configure rp filter for primary interface. Default is
false. - cni
Custom BooleanNetwork Cfg - Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is
false - cni
External BooleanSnat - Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is
false - custom
Network BooleanConfig Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's
resourcesVpcConfig.Defaults to false.
- disable
Tcp BooleanEarly Demux - Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
- enable
Ipv6 Boolean - VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
- enable
Pod BooleanEni - Specifies whether to allow IPAMD to add the
vpc.amazonaws.com/has-trunk-attachedlabel to the node if the instance has capacity to attach an additional ENI. Default isfalse. If using liveness and readiness probes, you will also need to disable TCP early demux. - enable
Prefix BooleanDelegation - IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
- eni
Config StringLabel Def Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
Defaults to the official AWS CNI image in ECR.
- eni
Mtu Number Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
Defaults to 9001.
- external
Snat Boolean Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
Defaults to false.
- image String
Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI image in ECR.
- init
Image String Specifies the init container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI init container image in ECR.
- log
File String Specifies the file path used for logs.
Defaults to "stdout" to emit Pod logs for
kubectl logs.- log
Level String Specifies the log level used for logs.
Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
- node
Agent StringImage Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.
Defaults to the official AWS CNI nodeagent image in ECR.
- node
Port BooleanSupport Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
Defaults to true.
- security
Context BooleanPrivileged - Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
- veth
Prefix String Specifies the veth prefix used to generate the host-side veth device name for the CNI.
The prefix can be at most 4 characters long.
Defaults to "eni".
- warm
Eni NumberTarget Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
Defaults to 1.
- warm
Ip NumberTarget - Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
- warm
Prefix NumberTarget - WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
Outputs
All input properties are implicitly available as output properties. Additionally, the VpcCni resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Package Details
- Repository
- Amazon EKS pulumi/pulumi-eks
- License
- Apache-2.0