Skip to content

Commit 310aa57

Browse files
vchintalvchintal
authored
chore: Clean up of the README (#1705)
1 parent 8824d86 commit 310aa57

File tree

3 files changed

+93
-46
lines changed

3 files changed

+93
-46
lines changed

‎examples/privatelink-access/README.md‎

Lines changed: 79 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
This example demonstrates how to access a private EKS cluster using AWS PrivateLink.
44

5-
Refer to the [documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html) for further details on `AWS PrivateLink`.
5+
Refer to the [documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html)
6+
for further details on `AWS PrivateLink`.
67

78
## Prerequisites:
89

@@ -14,7 +15,9 @@ Ensure that you have the following tools installed locally:
1415

1516
## Deploy
1617

17-
To provision this example, first deploy the Lambda function that responds to `CreateNetworkInterface` API calls. This needs to exist before the cluster is created so that it can respond to the ENIs created by the EKS control plane:
18+
To provision this example, first deploy the Lambda function that responds to
19+
`CreateNetworkInterface` API calls. This needs to exist before the cluster is
20+
created so that it can respond to the ENIs created by the EKS control plane:
1821

1922
```sh
2023
terraform init
@@ -35,62 +38,98 @@ Enter `yes` at command prompt to apply
3538

3639
### Network Connectivity
3740

38-
1. An output `ssm_test` has been provided to aid in quickly testing the connectivity from the client EC2 instance to the private EKS cluster via AWS Privatelink. Copy the output value and paste it into your terminal to execute and check the connectivity. If configured correctly, the value returned should be `ok`.
41+
An output `ssm_test` has been provided to aid in quickly testing the
42+
connectivity from the client EC2 instance to the private EKS cluster via AWS
43+
PrivateLink. Copy the output value and paste it into your terminal to execute
44+
and check the connectivity. If configured correctly, the value returned should
45+
be `ok`.
3946

4047
```sh
41-
COMMAND_ID=$(aws ssm send-command --region us-west-2 --document-name "AWS-RunShellScript" \
42-
--parameters 'commands=["curl -ks https://0218D48323E3E7D404D98659F1D097DD.gr7.us-west-2.eks.amazonaws.com/readyz"]' \
43-
--targets "Key=instanceids,Values=i-0280cf604085f4a44" --query 'Command.CommandId' --output text)
44-
45-
aws ssm get-command-invocation --region us-west-2 --command-id $COMMAND_ID --instance-id i-0280cf604085f4a44 --query 'StandardOutputContent' --output text
48+
COMMAND="curl -ks https://9A85B21811733524E3ABCDFEA8714642.gr7.us-west-2.eks.amazonaws.com/readyz"
49+
50+
COMMAND_ID=$(aws ssm send-command --region us-west-2 \
51+
--document-name "AWS-RunShellScript" \
52+
--parameters "commands=[$COMMAND]" \
53+
--targets "Key=instanceids,Values=i-0a45eff73ba408575" \
54+
--query 'Command.CommandId' \
55+
--output text)
56+
57+
aws ssm get-command-invocation --region us-west-2 \
58+
--command-id $COMMAND_ID \
59+
--instance-id i-0a45eff73ba408575 \
60+
--query 'StandardOutputContent' \
61+
--output text
4662
```
4763

4864
### Cluster Access
4965

50-
To test access to the cluster, you will need to execute Kubernetes API calls from within the private network to access the cluster. An EC2 instance has been deployed to simulate this scenario, where the EC2 is deployed into a "client" VPC. However, since the EKS cluster was created with your local IAM identity, the `aws-auth` ConfigMap will only have your local identity that is permitted to access the cluster. Since cluster's API endpoint is private, we cannot use Terraform to reach it to additional entries to the ConfigMap; we can only access the cluster from within the private network of the cluster's VPC or from the client VPC using AWS PrivateLink access.
66+
To test access to the cluster, you will need to execute Kubernetes API calls
67+
from within the private network to access the cluster. An EC2 instance has been
68+
deployed into a "client" VPC to simulate this scenario. However, since the EKS
69+
cluster was created with your local IAM identity, the `aws-auth` ConfigMap will
70+
only have your local identity that is permitted to access the cluster. Since
71+
cluster's API endpoint is private, we cannot use Terraform to reach it to
72+
add additional entries to the ConfigMap; we can only access the cluster from
73+
within the private network of the cluster's VPC or from the client VPC using AWS
74+
PrivateLink access.
5175

52-
:warning: The "client" EC2 instance provided and copying of AWS credentials to that instance are merely for demonstration purposes only. Please consider alternate methods of network access such as AWS Client VPN to provide more secure access.
76+
> :warning: The "client" EC2 instance provided and copying of AWS credentials to
77+
that instance are merely for demonstration purposes only. Please consider
78+
alternate methods of network access such as AWS Client VPN to provide more
79+
secure access.
5380

54-
Perform the following steps to access the cluster with `kubectl` from the provided "client" EC2 instance.
81+
Perform the following steps to access the cluster with `kubectl` from the
82+
provided "client" EC2 instance.
5583

56-
1. Execute the command below on your local machine to get temporary credentials that will be used on the "client" EC2 instance:
84+
1. Execute the command below on your local machine to get temporary credentials
85+
that will be used on the "client" EC2 instance:
5786

58-
```sh
59-
aws sts get-session-token --duration-seconds 3600 --output yaml
60-
```
87+
```sh
88+
aws sts get-session-token --duration-seconds 3600 --output yaml
89+
```
6190

62-
2. Start a new SSM session on the "client" EC2 instance using the provided `ssm_start_session` output value. Your terminal will now be connected to the "client" EC2 instance.
91+
2. Start a new SSM session on the "client" EC2 instance using the provided
92+
`ssm_start_session` output value. Copy the output value and paste it into your
93+
terminal to execute. Your terminal will now be connected to the "client" EC2
94+
instance.
6395

64-
```sh
65-
ssm_start_session = "aws ssm start-session --region us-west-2 --target i-0280cf604085f4a44"
66-
```
96+
```sh
97+
aws ssm start-session --region us-west-2 --target i-0280cf604085f4a44
98+
```
6799

68-
3. Once logged in, export the following environment variables from the output of step 1. Note - the session credentials are only valid for 1 hour; you can adjust the session duration in the command provided in step 1:
100+
3. Once logged in, export the following environment variables from the output
101+
of step #1:
69102

70-
```sh
71-
export AWS_ACCESS_KEY_ID=XXXX
72-
export AWS_SECRET_ACCESS_KEY=YYYY
73-
export AWS_SESSION_TOKEN=ZZZZ
74-
```
103+
> :exclamation: The session credentials are only valid for 1 hour; you can
104+
adjust the session duration in the command provided in step #1
75105

76-
4. Update the local `~/.kube/config` file to enable access to the cluster:
106+
```sh
107+
export AWS_ACCESS_KEY_ID=XXXX
108+
export AWS_SECRET_ACCESS_KEY=YYYY
109+
export AWS_SESSION_TOKEN=ZZZZ
110+
```
77111

78-
```sh
79-
aws eks update-kubeconfig --region us-west-2 --name privatelink-access
80-
```
112+
4. Run the following command to update the local `~/.kube/config` file to enable
113+
access to the cluster:
81114

82-
5. Test access by listing the pods running on the clsuter:
115+
```sh
116+
aws eks update-kubeconfig --region us-west-2 --name privatelink-access
117+
```
118+
119+
5. Test access by listing the pods running on the cluster:
120+
121+
```sh
122+
kubectl get pods -A
123+
```
124+
125+
The test succeeded if you see an output like the one shown below:
126+
127+
NAMESPACE NAME READY STATUS RESTARTS AGE
128+
kube-system aws-node-4f8g8 1/1 Running 0 1m
129+
kube-system coredns-6ff9c46cd8-59sqp 1/1 Running 0 1m
130+
kube-system coredns-6ff9c46cd8-svnpb 1/1 Running 0 2m
131+
kube-system kube-proxy-mm2zc 1/1 Running 0 1m
83132

84-
```sh
85-
sh-4.2$ kubectl get pods -A
86-
87-
# Output
88-
NAMESPACE NAME READY STATUS RESTARTS AGE
89-
kube-system aws-node-4f8g8 1/1 Running 0 1m
90-
kube-system coredns-6ff9c46cd8-59sqp 1/1 Running 0 1m
91-
kube-system coredns-6ff9c46cd8-svnpb 1/1 Running 0 2m
92-
kube-system kube-proxy-mm2zc 1/1 Running 0 1m
93-
```
94133

95134
## Destroy
96135

‎examples/privatelink-access/outputs.tf‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,21 @@ output "ssm_start_session" {
44
}
55

66
output "ssm_test" {
7-
description = "SSM start session command to connect to remote host created"
7+
description = "SSM commands to test connectivity from client EC2 instance to the private EKS cluster"
88
value = <<-EOT
9-
COMMAND_ID=$(aws ssm send-command --region ${local.region} --document-name "AWS-RunShellScript" \
10-
--parameters 'commands=["curl -ks ${module.eks.cluster_endpoint}/readyz"]' \
11-
--targets "Key=instanceids,Values=${module.client_ec2_instance.id}" --query 'Command.CommandId' --output text)
9+
COMMAND="curl -ks ${module.eks.cluster_endpoint}/readyz"
10+
11+
COMMAND_ID=$(aws ssm send-command --region ${local.region} \
12+
--document-name "AWS-RunShellScript" \
13+
--parameters "commands=[$COMMAND]" \
14+
--targets "Key=instanceids,Values=${module.client_ec2_instance.id}" \
15+
--query 'Command.CommandId' \
16+
--output text)
1217
13-
aws ssm get-command-invocation --region ${local.region} --command-id $COMMAND_ID --instance-id ${module.client_ec2_instance.id} --query 'StandardOutputContent' --output text
18+
aws ssm get-command-invocation --region ${local.region} \
19+
--command-id $COMMAND_ID \
20+
--instance-id ${module.client_ec2_instance.id} \
21+
--query 'StandardOutputContent' \
22+
--output text
1423
EOT
1524
}

‎examples/privatelink-access/variables.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-

0 commit comments

Comments
 (0)