Skip to content

Commit c52ae39

Browse files
moko-poimoko-poi
committed
feat: Add support for AWS Regional NAT Gateway
1 parent ea774f5 commit c52ae39

11 files changed

+745
-22
lines changed

‎api/v1beta1/zz_generated.conversion.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/network_types.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,16 @@ const (
4848
ZoneTypeLocalZone ZoneType = "local-zone"
4949
// ZoneTypeWavelengthZone defines the AWS zone type in Wavelength infrastructure.
5050
ZoneTypeWavelengthZone ZoneType = "wavelength-zone"
51+
52+
// NATGatewayAvailabilityModeZonal creates one NAT Gateway per Availability Zone.
53+
NATGatewayAvailabilityModeZonal NATGatewayAvailabilityMode = "Zonal"
54+
// NATGatewayAvailabilityModeRegional creates a single regional NAT Gateway.
55+
NATGatewayAvailabilityModeRegional NATGatewayAvailabilityMode = "Regional"
5156
)
5257

58+
// NATGatewayAvailabilityMode defines the availability mode for NAT Gateways.
59+
type NATGatewayAvailabilityMode string
60+
5361
// NetworkStatus encapsulates AWS networking resources.
5462
type NetworkStatus struct {
5563
// SecurityGroups is a map from the role/kind of the security group to its unique name, if any.
@@ -501,6 +509,28 @@ type VPCSpec struct {
501509
// +kubebuilder:default=PreferPrivate
502510
// +kubebuilder:validation:Enum=PreferPrivate;PreferPublic
503511
SubnetSchema *SubnetSchemaType `json:"subnetSchema,omitempty"`
512+
513+
// NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
514+
// Valid values are "zonal" and "regional".
515+
//
516+
// Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
517+
// Each private subnet routes traffic through the NAT Gateway in its own AZ.
518+
//
519+
// Regional: Creates a single NAT Gateway that automatically expands and contracts across
520+
// all Availability Zones based on workload presence. Does not require public subnets.
521+
// Provides automatic high availability with simplified setup and enhanced security.
522+
//
523+
// Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
524+
// and are recommended for new deployments unless private connectivity is required.
525+
//
526+
// Note: Regional NAT Gateways are available in all commercial AWS Regions except
527+
// AWS GovCloud (US) and China Regions.
528+
//
529+
// Defaults to Zonal for backward compatibility.
530+
// +optional
531+
// +kubebuilder:default=Zonal
532+
// +kubebuilder:validation:Enum=Zonal;Regional
533+
NATGatewayAvailabilityMode *NATGatewayAvailabilityMode `json:"natGatewayAvailabilityMode,omitempty"`
504534
}
505535

506536
// String returns a string representation of the VPC.
@@ -539,6 +569,19 @@ func (v *VPCSpec) GetPublicIpv4Pool() *string {
539569
return nil
540570
}
541571

572+
// IsRegionalNATGateway returns true if the NAT Gateway availability mode is Regional.
573+
func (v *VPCSpec) IsRegionalNATGateway() bool {
574+
return v.NATGatewayAvailabilityMode != nil && *v.NATGatewayAvailabilityMode == NATGatewayAvailabilityModeRegional
575+
}
576+
577+
// GetNATGatewayAvailabilityMode returns the NAT Gateway availability mode, defaulting to Zonal.
578+
func (v *VPCSpec) GetNATGatewayAvailabilityMode() NATGatewayAvailabilityMode {
579+
if v.NATGatewayAvailabilityMode == nil {
580+
return NATGatewayAvailabilityModeZonal
581+
}
582+
return *v.NATGatewayAvailabilityMode
583+
}
584+
542585
// SubnetSpec configures an AWS Subnet.
543586
type SubnetSpec struct {
544587
// ID defines a unique identifier to reference this resource.

‎api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -827,6 +827,30 @@ spec:
827827
Mutually exclusive with IPAMPool.
828828
type: string
829829
type: object
830+
natGatewayAvailabilityMode:
831+
default: Zonal
832+
description: |-
833+
NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
834+
Valid values are "zonal" and "regional".
835+
836+
Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
837+
Each private subnet routes traffic through the NAT Gateway in its own AZ.
838+
839+
Regional: Creates a single NAT Gateway that automatically expands and contracts across
840+
all Availability Zones based on workload presence. Does not require public subnets.
841+
Provides automatic high availability with simplified setup and enhanced security.
842+
843+
Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
844+
and are recommended for new deployments unless private connectivity is required.
845+
846+
Note: Regional NAT Gateways are available in all commercial AWS Regions except
847+
AWS GovCloud (US) and China Regions.
848+
849+
Defaults to Zonal for backward compatibility.
850+
enum:
851+
- Zonal
852+
- Regional
853+
type: string
830854
privateDnsHostnameTypeOnLaunch:
831855
description: |-
832856
PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.
@@ -3062,6 +3086,30 @@ spec:
30623086
Mutually exclusive with IPAMPool.
30633087
type: string
30643088
type: object
3089+
natGatewayAvailabilityMode:
3090+
default: Zonal
3091+
description: |-
3092+
NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
3093+
Valid values are "zonal" and "regional".
3094+
3095+
Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
3096+
Each private subnet routes traffic through the NAT Gateway in its own AZ.
3097+
3098+
Regional: Creates a single NAT Gateway that automatically expands and contracts across
3099+
all Availability Zones based on workload presence. Does not require public subnets.
3100+
Provides automatic high availability with simplified setup and enhanced security.
3101+
3102+
Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
3103+
and are recommended for new deployments unless private connectivity is required.
3104+
3105+
Note: Regional NAT Gateways are available in all commercial AWS Regions except
3106+
AWS GovCloud (US) and China Regions.
3107+
3108+
Defaults to Zonal for backward compatibility.
3109+
enum:
3110+
- Zonal
3111+
- Regional
3112+
type: string
30653113
privateDnsHostnameTypeOnLaunch:
30663114
description: |-
30673115
PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanetemplates.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -850,6 +850,30 @@ spec:
850850
Mutually exclusive with IPAMPool.
851851
type: string
852852
type: object
853+
natGatewayAvailabilityMode:
854+
default: Zonal
855+
description: |-
856+
NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
857+
Valid values are "zonal" and "regional".
858+
859+
Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
860+
Each private subnet routes traffic through the NAT Gateway in its own AZ.
861+
862+
Regional: Creates a single NAT Gateway that automatically expands and contracts across
863+
all Availability Zones based on workload presence. Does not require public subnets.
864+
Provides automatic high availability with simplified setup and enhanced security.
865+
866+
Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
867+
and are recommended for new deployments unless private connectivity is required.
868+
869+
Note: Regional NAT Gateways are available in all commercial AWS Regions except
870+
AWS GovCloud (US) and China Regions.
871+
872+
Defaults to Zonal for backward compatibility.
873+
enum:
874+
- Zonal
875+
- Regional
876+
type: string
853877
privateDnsHostnameTypeOnLaunch:
854878
description: |-
855879
PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1774,6 +1774,30 @@ spec:
17741774
Mutually exclusive with IPAMPool.
17751775
type: string
17761776
type: object
1777+
natGatewayAvailabilityMode:
1778+
default: Zonal
1779+
description: |-
1780+
NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
1781+
Valid values are "zonal" and "regional".
1782+
1783+
Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
1784+
Each private subnet routes traffic through the NAT Gateway in its own AZ.
1785+
1786+
Regional: Creates a single NAT Gateway that automatically expands and contracts across
1787+
all Availability Zones based on workload presence. Does not require public subnets.
1788+
Provides automatic high availability with simplified setup and enhanced security.
1789+
1790+
Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
1791+
and are recommended for new deployments unless private connectivity is required.
1792+
1793+
Note: Regional NAT Gateways are available in all commercial AWS Regions except
1794+
AWS GovCloud (US) and China Regions.
1795+
1796+
Defaults to Zonal for backward compatibility.
1797+
enum:
1798+
- Zonal
1799+
- Regional
1800+
type: string
17771801
privateDnsHostnameTypeOnLaunch:
17781802
description: |-
17791803
PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1363,6 +1363,30 @@ spec:
13631363
Mutually exclusive with IPAMPool.
13641364
type: string
13651365
type: object
1366+
natGatewayAvailabilityMode:
1367+
default: Zonal
1368+
description: |-
1369+
NATGatewayAvailabilityMode specifies the availability mode for NAT Gateways in this VPC.
1370+
Valid values are "zonal" and "regional".
1371+
1372+
Zonal (default): Creates one NAT Gateway per Availability Zone in public subnets.
1373+
Each private subnet routes traffic through the NAT Gateway in its own AZ.
1374+
1375+
Regional: Creates a single NAT Gateway that automatically expands and contracts across
1376+
all Availability Zones based on workload presence. Does not require public subnets.
1377+
Provides automatic high availability with simplified setup and enhanced security.
1378+
1379+
Regional NAT Gateways support up to 32 IP addresses per AZ (vs 8 for zonal)
1380+
and are recommended for new deployments unless private connectivity is required.
1381+
1382+
Note: Regional NAT Gateways are available in all commercial AWS Regions except
1383+
AWS GovCloud (US) and China Regions.
1384+
1385+
Defaults to Zonal for backward compatibility.
1386+
enum:
1387+
- Zonal
1388+
- Regional
1389+
type: string
13661390
privateDnsHostnameTypeOnLaunch:
13671391
description: |-
13681392
PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.

‎go.mod‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,14 @@ require (
1010
github.com/apparentlymart/go-cidr v1.1.0
1111
github.com/aws/amazon-vpc-cni-k8s v1.15.5
1212
github.com/aws/aws-lambda-go v1.41.0
13-
github.com/aws/aws-sdk-go-v2 v1.39.2
13+
github.com/aws/aws-sdk-go-v2 v1.40.1
1414
github.com/aws/aws-sdk-go-v2/config v1.31.12
1515
github.com/aws/aws-sdk-go-v2/credentials v1.18.16
1616
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.12
1717
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.4
1818
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.52.0
1919
github.com/aws/aws-sdk-go-v2/service/configservice v1.56.0
20-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.233.0
20+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.275.1
2121
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.36.0
2222
github.com/aws/aws-sdk-go-v2/service/efs v1.39.0
2323
github.com/aws/aws-sdk-go-v2/service/eks v1.64.0
@@ -29,7 +29,7 @@ require (
2929
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.28.6
3030
github.com/aws/aws-sdk-go-v2/service/ssm v1.59.1
3131
github.com/aws/aws-sdk-go-v2/service/sts v1.38.6
32-
github.com/aws/smithy-go v1.23.0
32+
github.com/aws/smithy-go v1.24.0
3333
github.com/awslabs/goformation/v4 v4.19.5
3434
github.com/blang/semver v3.5.1+incompatible
3535
github.com/coreos/ignition v0.35.0
@@ -115,15 +115,15 @@ require (
115115
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
116116
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
117117
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 // indirect
118-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect
119-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect
118+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.15 // indirect
119+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.15 // indirect
120120
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
121121
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.9 // indirect
122122
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.50.0
123123
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.39.3
124-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
124+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
125125
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.0 // indirect
126-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect
126+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.15 // indirect
127127
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.9 // indirect
128128
github.com/aws/aws-sdk-go-v2/service/organizations v1.27.3 // indirect
129129
github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.4

0 commit comments

Comments
 (0)