1. Packages
  2. Amazon EKS
  3. API Docs
  4. VpcCni
Amazon EKS v2.7.3 published on Tuesday, Jul 2, 2024 by Pulumi

eks.VpcCni

Explore with Pulumi AI

eks logo
Amazon EKS v2.7.3 published on Tuesday, Jul 2, 2024 by Pulumi

    VpcCni manages the configuration of the Amazon VPC CNI plugin for Kubernetes by applying its YAML chart.

    Create VpcCni Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new VpcCni(name: string, args: VpcCniArgs, opts?: CustomResourceOptions);
    @overload
    def VpcCni(resource_name: str,
               args: VpcCniArgs,
               opts: Optional[ResourceOptions] = None)
    
    @overload
    def VpcCni(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               kubeconfig: Optional[Any] = None,
               external_snat: Optional[bool] = None,
               custom_network_config: Optional[bool] = None,
               init_image: Optional[str] = None,
               disable_tcp_early_demux: Optional[bool] = None,
               enable_ipv6: Optional[bool] = None,
               enable_pod_eni: Optional[bool] = None,
               enable_prefix_delegation: Optional[bool] = None,
               eni_config_label_def: Optional[str] = None,
               cni_custom_network_cfg: Optional[bool] = None,
               cni_configure_rpfilter: Optional[bool] = None,
               warm_prefix_target: Optional[int] = None,
               cni_external_snat: Optional[bool] = None,
               eni_mtu: Optional[int] = None,
               log_file: Optional[str] = None,
               log_level: Optional[str] = None,
               node_agent_image: Optional[str] = None,
               node_port_support: Optional[bool] = None,
               security_context_privileged: Optional[bool] = None,
               veth_prefix: Optional[str] = None,
               warm_eni_target: Optional[int] = None,
               warm_ip_target: Optional[int] = None,
               image: Optional[str] = None)
    func NewVpcCni(ctx *Context, name string, args VpcCniArgs, opts ...ResourceOption) (*VpcCni, error)
    public VpcCni(string name, VpcCniArgs args, CustomResourceOptions? opts = null)
    public VpcCni(String name, VpcCniArgs args)
    public VpcCni(String name, VpcCniArgs args, CustomResourceOptions options)
    
    type: eks:VpcCni
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args VpcCniArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args VpcCniArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args VpcCniArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args VpcCniArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args VpcCniArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var vpcCniResource = new Eks.VpcCni("vpcCniResource", new()
    {
        Kubeconfig = "any",
        ExternalSnat = false,
        CustomNetworkConfig = false,
        InitImage = "string",
        DisableTcpEarlyDemux = false,
        EnableIpv6 = false,
        EnablePodEni = false,
        EnablePrefixDelegation = false,
        EniConfigLabelDef = "string",
        CniCustomNetworkCfg = false,
        CniConfigureRpfilter = false,
        WarmPrefixTarget = 0,
        CniExternalSnat = false,
        EniMtu = 0,
        LogFile = "string",
        LogLevel = "string",
        NodeAgentImage = "string",
        NodePortSupport = false,
        SecurityContextPrivileged = false,
        VethPrefix = "string",
        WarmEniTarget = 0,
        WarmIpTarget = 0,
        Image = "string",
    });
    
    example, err := eks.NewVpcCni(ctx, "vpcCniResource", &eks.VpcCniArgs{
    	Kubeconfig:                pulumi.Any("any"),
    	ExternalSnat:              pulumi.Bool(false),
    	CustomNetworkConfig:       pulumi.Bool(false),
    	InitImage:                 pulumi.String("string"),
    	DisableTcpEarlyDemux:      pulumi.Bool(false),
    	EnableIpv6:                pulumi.Bool(false),
    	EnablePodEni:              pulumi.Bool(false),
    	EnablePrefixDelegation:    pulumi.Bool(false),
    	EniConfigLabelDef:         pulumi.String("string"),
    	CniCustomNetworkCfg:       pulumi.Bool(false),
    	CniConfigureRpfilter:      pulumi.Bool(false),
    	WarmPrefixTarget:          pulumi.Int(0),
    	CniExternalSnat:           pulumi.Bool(false),
    	EniMtu:                    pulumi.Int(0),
    	LogFile:                   pulumi.String("string"),
    	LogLevel:                  pulumi.String("string"),
    	NodeAgentImage:            pulumi.String("string"),
    	NodePortSupport:           pulumi.Bool(false),
    	SecurityContextPrivileged: pulumi.Bool(false),
    	VethPrefix:                pulumi.String("string"),
    	WarmEniTarget:             pulumi.Int(0),
    	WarmIpTarget:              pulumi.Int(0),
    	Image:                     pulumi.String("string"),
    })
    
    var vpcCniResource = new VpcCni("vpcCniResource", VpcCniArgs.builder()
        .kubeconfig("any")
        .externalSnat(false)
        .customNetworkConfig(false)
        .initImage("string")
        .disableTcpEarlyDemux(false)
        .enableIpv6(false)
        .enablePodEni(false)
        .enablePrefixDelegation(false)
        .eniConfigLabelDef("string")
        .cniCustomNetworkCfg(false)
        .cniConfigureRpfilter(false)
        .warmPrefixTarget(0)
        .cniExternalSnat(false)
        .eniMtu(0)
        .logFile("string")
        .logLevel("string")
        .nodeAgentImage("string")
        .nodePortSupport(false)
        .securityContextPrivileged(false)
        .vethPrefix("string")
        .warmEniTarget(0)
        .warmIpTarget(0)
        .image("string")
        .build());
    
    vpc_cni_resource = eks.VpcCni("vpcCniResource",
        kubeconfig="any",
        external_snat=False,
        custom_network_config=False,
        init_image="string",
        disable_tcp_early_demux=False,
        enable_ipv6=False,
        enable_pod_eni=False,
        enable_prefix_delegation=False,
        eni_config_label_def="string",
        cni_custom_network_cfg=False,
        cni_configure_rpfilter=False,
        warm_prefix_target=0,
        cni_external_snat=False,
        eni_mtu=0,
        log_file="string",
        log_level="string",
        node_agent_image="string",
        node_port_support=False,
        security_context_privileged=False,
        veth_prefix="string",
        warm_eni_target=0,
        warm_ip_target=0,
        image="string")
    
    const vpcCniResource = new eks.VpcCni("vpcCniResource", {
        kubeconfig: "any",
        externalSnat: false,
        customNetworkConfig: false,
        initImage: "string",
        disableTcpEarlyDemux: false,
        enableIpv6: false,
        enablePodEni: false,
        enablePrefixDelegation: false,
        eniConfigLabelDef: "string",
        cniCustomNetworkCfg: false,
        cniConfigureRpfilter: false,
        warmPrefixTarget: 0,
        cniExternalSnat: false,
        eniMtu: 0,
        logFile: "string",
        logLevel: "string",
        nodeAgentImage: "string",
        nodePortSupport: false,
        securityContextPrivileged: false,
        vethPrefix: "string",
        warmEniTarget: 0,
        warmIpTarget: 0,
        image: "string",
    });
    
    type: eks:VpcCni
    properties:
        cniConfigureRpfilter: false
        cniCustomNetworkCfg: false
        cniExternalSnat: false
        customNetworkConfig: false
        disableTcpEarlyDemux: false
        enableIpv6: false
        enablePodEni: false
        enablePrefixDelegation: false
        eniConfigLabelDef: string
        eniMtu: 0
        externalSnat: false
        image: string
        initImage: string
        kubeconfig: any
        logFile: string
        logLevel: string
        nodeAgentImage: string
        nodePortSupport: false
        securityContextPrivileged: false
        vethPrefix: string
        warmEniTarget: 0
        warmIpTarget: 0
        warmPrefixTarget: 0
    

    VpcCni Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The VpcCni resource accepts the following input properties:

    Kubeconfig object
    The kubeconfig to use when setting the VPC CNI options.
    CniConfigureRpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    CniCustomNetworkCfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    CniExternalSnat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    CustomNetworkConfig bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    DisableTcpEarlyDemux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    EnableIpv6 bool
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    EnablePodEni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    EnablePrefixDelegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    EniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    EniMtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    ExternalSnat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    Image string

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    InitImage string

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    LogFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    LogLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    NodeAgentImage string

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    NodePortSupport bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    SecurityContextPrivileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    VethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    WarmEniTarget int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    WarmIpTarget int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    WarmPrefixTarget int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    Kubeconfig interface{}
    The kubeconfig to use when setting the VPC CNI options.
    CniConfigureRpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    CniCustomNetworkCfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    CniExternalSnat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    CustomNetworkConfig bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    DisableTcpEarlyDemux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    EnableIpv6 bool
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    EnablePodEni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    EnablePrefixDelegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    EniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    EniMtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    ExternalSnat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    Image string

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    InitImage string

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    LogFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    LogLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    NodeAgentImage string

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    NodePortSupport bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    SecurityContextPrivileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    VethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    WarmEniTarget int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    WarmIpTarget int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    WarmPrefixTarget int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    kubeconfig Object
    The kubeconfig to use when setting the VPC CNI options.
    cniConfigureRpfilter Boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg Boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat Boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    customNetworkConfig Boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux Boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableIpv6 Boolean
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    enablePodEni Boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation Boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef String

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu Integer

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat Boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    image String

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    initImage String

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    logFile String

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel String

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodeAgentImage String

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    nodePortSupport Boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    securityContextPrivileged Boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    vethPrefix String

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget Integer

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget Integer
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget Integer
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    kubeconfig any
    The kubeconfig to use when setting the VPC CNI options.
    cniConfigureRpfilter boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    customNetworkConfig boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableIpv6 boolean
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    enablePodEni boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu number

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    image string

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    initImage string

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    logFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodeAgentImage string

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    nodePortSupport boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    securityContextPrivileged boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    vethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget number

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget number
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget number
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    kubeconfig Any
    The kubeconfig to use when setting the VPC CNI options.
    cni_configure_rpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cni_custom_network_cfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cni_external_snat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    custom_network_config bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disable_tcp_early_demux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enable_ipv6 bool
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    enable_pod_eni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enable_prefix_delegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eni_config_label_def str

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eni_mtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    external_snat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    image str

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    init_image str

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    log_file str

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    log_level str

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    node_agent_image str

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    node_port_support bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    security_context_privileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    veth_prefix str

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warm_eni_target int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warm_ip_target int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warm_prefix_target int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    kubeconfig Any
    The kubeconfig to use when setting the VPC CNI options.
    cniConfigureRpfilter Boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg Boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat Boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    customNetworkConfig Boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux Boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableIpv6 Boolean
    VPC CNI can operate in either IPv4 or IPv6 mode. Setting ENABLE_IPv6 to true. will configure it in IPv6 mode. IPv6 is only supported in Prefix Delegation mode, so ENABLE_PREFIX_DELEGATION needs to set to true if VPC CNI is configured to operate in IPv6 mode. Prefix delegation is only supported on nitro instances.
    enablePodEni Boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation Boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef String

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu Number

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat Boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    image String

    Specifies the aws-node container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI image in ECR.

    initImage String

    Specifies the init container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI init container image in ECR.

    logFile String

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel String

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodeAgentImage String

    Specifies the aws-eks-nodeagent container image to use in the AWS CNI cluster DaemonSet.

    Defaults to the official AWS CNI nodeagent image in ECR.

    nodePortSupport Boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    securityContextPrivileged Boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    vethPrefix String

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget Number

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget Number
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget Number
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md

    Outputs

    All input properties are implicitly available as output properties. Additionally, the VpcCni resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Package Details

    Repository
    Amazon EKS pulumi/pulumi-eks
    License
    Apache-2.0
    eks logo
    Amazon EKS v2.7.3 published on Tuesday, Jul 2, 2024 by Pulumi