Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

wrong node_security_group_recommended_rules when VPC is dual stack and EKS is ipv4 #3300

Open
magzim21 opened this issue Feb 14, 2025 · 0 comments

Comments

@magzim21
Copy link

magzim21 commented Feb 14, 2025

https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/node_groups.tf#L182

    egress_all = {
      description      = "Allow all egress"
      protocol         = "-1"
      from_port        = 0
      to_port          = 0
      type             = "egress"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = var.cluster_ip_family == "ipv6" ? ["::/0"] : null        # Problem here
    }

ipv6_cidr_blocks = ["::/0"] should be at all times because it is safe and without it cluster BREAKs.
After long trobleshooting of my edge case when cluster was broken after I disabled VPC endpoints, systems within EKS preferred ipv6 during DNS resolution and timed out before fallback to ipv4.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant