eks

func GetClusterRole ¶

func GetClusterRole(e aws.Environment, name string) (*awsIam.Role, error)

func GetNodeRole ¶

func GetNodeRole(e aws.Environment, name string) (*awsIam.Role, error)

func GetNodesVersion ¶ added in v0.76.0

func GetNodesVersion(amiType string, kubernetesVersion string) (string, error)

func NewAL2023LinuxARMNodeGroup ¶

func NewAL2023LinuxARMNodeGroup(e aws.Environment, cluster *eks.Cluster, nodeRole *awsIam.Role, noInternetSG *awsEc2.SecurityGroup, opts ...pulumi.ResourceOption) (*eks.ManagedNodeGroup, error)

func NewAL2023LinuxNodeGroup ¶

func NewAL2023LinuxNodeGroup(e aws.Environment, cluster *eks.Cluster, nodeRole *awsIam.Role, noInternetSG *awsEc2.SecurityGroup, opts ...pulumi.ResourceOption) (*eks.ManagedNodeGroup, error)

func NewBottlerocketNodeGroup ¶

func NewBottlerocketNodeGroup(e aws.Environment, cluster *eks.Cluster, nodeRole *awsIam.Role, noInternetSG *awsEc2.SecurityGroup, opts ...pulumi.ResourceOption) (*eks.ManagedNodeGroup, error)

NewBottlerocketNodeGroup creates a Bottlerocket node group. Without a no-internet security group, EKS manages the node group's security groups (allow-all egress). With one, the nodes get a minimal launch template carrying only our security groups, so no EKS-managed allow-all security group is attached.

func NewENIConfigs ¶

func NewENIConfigs(e aws.Environment, subnets []aws.DDInfraEKSPodSubnets, securityGroups pulumi.StringArray, opts ...pulumi.ResourceOption) (*yaml.ConfigGroup, error)

NewENIConfigs creates ENIConfig CRDs to allow usage of custom networkwing for EKS pods when using AWS VPC CNI Plugin (default). https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html ENI = Elastic Network Interface (basically, a virtual network card)

func NewGPULinuxNodeGroup ¶ added in v0.76.0

func NewGPULinuxNodeGroup(e aws.Environment, cluster *eks.Cluster, nodeRole *awsIam.Role, noInternetSG *awsEc2.SecurityGroup, instanceType string, opts ...pulumi.ResourceOption) (*eks.ManagedNodeGroup, error)

NewGPULinuxNodeGroup creates a GPU-enabled Linux node group using Amazon Linux 2023 with NVIDIA GPU support. The node group uses the AL2023_x86_64_NVIDIA AMI which has pre-installed NVIDIA drivers. Note: AL2_x86_64_GPU is only supported for Kubernetes 1.32 or earlier, so we use AL2023_x86_64_NVIDIA for K8s 1.33+.

func NewNoInternetNodeSG ¶ added in v0.85.0

func NewNoInternetNodeSG(e aws.Environment, cluster *eks.Cluster, opts ...pulumi.ResourceOption) (*awsEc2.SecurityGroup, error)

NewNoInternetNodeSG creates a security group for EKS nodes whose egress is restricted to the VPC CIDR, so that nodes cannot reach the internet. It replaces the account's default security groups (which allow all egress) in the node groups' launch templates.

Ingress replicates what attaching the EKS-managed cluster security group used to provide (which EKS does not attach to nodes when the launch template specifies security groups): control-plane to kubelet traffic, plus all traffic within the node group.

It must only be used together with a launch template: when a node group does not use a custom launch template, EKS attaches its own security groups with allow-all egress to the nodes, which would defeat the restriction.

func NewWindowsNodeGroup ¶

func NewWindowsNodeGroup(e aws.Environment, cluster *eks.Cluster, nodeRole *awsIam.Role, noInternetSG *awsEc2.SecurityGroup, opts ...pulumi.ResourceOption) (*eks.ManagedNodeGroup, error)

NewWindowsNodeGroup creates a Windows node group. Without a no-internet security group, EKS manages the node group's security groups (allow-all egress). With one, the nodes get a minimal launch template carrying only our security groups, so no EKS-managed allow-all security group is attached.