EKS Terraform Infrastructure

The project rebuilds an EKS foundation as Terraform-managed infrastructure so networking, IAM, cluster configuration, node capacity and add-ons can be reviewed and reproduced through a consistent workflow.

The design also explores how private workers can operate without public IPv4 addresses or a default NAT Gateway dependency.

• VPC moduleOwns subnets, routes, IPv6 behavior, egress-only internet access and AWS service endpoints.
• EKS moduleOwns the cluster, IAM integration, OIDC, node capacity, access configuration and foundational add-ons.
• Remote stateKeeps infrastructure state outside the local workspace and separates parallel environment work.
• CI workflowProduces an explicit plan before apply so infrastructure changes are visible before execution.

Private worker nodes

Worker nodes are placed in private subnets and do not depend on public IPv4 addresses. Public subnets remain available for internet-facing load balancers where required.

IPv6-primary egress

An egress-only internet gateway allows outbound IPv6 connections without accepting unsolicited inbound traffic. This reduces reliance on NAT for general internet egress.

AWS service access

S3 uses a gateway endpoint, while required AWS APIs use interface endpoints. The design treats endpoint access as an explicit dependency for private nodes and IRSA-enabled workloads.

1. Remote state foundationPrepare isolated state storage and locking before applying the cluster infrastructure.
2. VPC and subnetsCreate public load-balancer subnets, private worker subnets, routing and IPv6 egress.
3. AWS endpointsProvide private access to the AWS services required by nodes and controllers.
4. EKS control plane and identityCreate the cluster, OIDC integration, IAM roles and access mappings.
5. Capacity and add-onsAttach worker capacity and deploy dependencies such as EBS CSI with the required identity configuration.
6. Platform handoffExpose outputs and access required by the platform-tools layer.

• Three-AZ layoutThree public and three private subnets distribute load-balancer and worker responsibilities across available zones.
• Private service pathOne S3 gateway endpoint and six interface endpoints provide explicit AWS API access without a NAT Gateway.
• Runtime verificationDocumented checks confirmed four Ready nodes with IPv6 addresses, IPv6 pod networking, DNS resolution and outbound IPv6 connectivity.
• Plan verificationA Terraform plan exposed a DNS64 regression before apply, preventing a change that would have broken IPv6 pod networking.

The resulting foundation is structured for repeatable provisioning and safer review. It supports private workloads, Kubernetes add-ons and the later operational tooling required by Karpenter, ingress, observability and GitOps.