Skip to content

wrong node_security_group_recommended_rules when VPC is dual stack and EKS is ipv4 #3300

Closed as not planned
@magzim21

Description

@magzim21

https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/node_groups.tf#L182

    egress_all = {
      description      = "Allow all egress"
      protocol         = "-1"
      from_port        = 0
      to_port          = 0
      type             = "egress"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = var.cluster_ip_family == "ipv6" ? ["::/0"] : null        # Problem here
    }

ipv6_cidr_blocks = ["::/0"] should be at all times because it is safe and without it cluster BREAKs.
After long trobleshooting of my edge case when cluster was broken after I disabled VPC endpoints, systems within EKS preferred ipv6 during DNS resolution and timed out before fallback to ipv4.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions