Fix eks terraform script

[LordAbhishek]

Existing Issue:
Currently eks workflows are failing at infrastructure provisioning in cloud nightly main tests.
Failing Workflow: https://github.com/hashicorp/consul-k8s-workflows/actions/runs/22421960130/job/64921986795

Run # # On eks, we're setting the github run id instead of build URL because label values
╷
│ Error: Unsupported argument
│ 
│   on .terraform/modules/vpc/main.tf line 1030, in resource "aws_eip" "nat":
│ 1030:   vpc = true
│ 
│ An argument named "vpc" is not expected here.
╵
Error: Process completed with exit code 1.

Fix eks terraform script

• removed depricated versions, updated them with latest supported version.
• added storage class for consul servers pvcs

Workflow with updated/fixed terraform script:
https://github.com/hashicorp/consul-k8s-workflows/actions/runs/22436582955/job/64968467657
(terraform apply step is successfully completed).

[LordAbhishek]

Please let me know if this change needs changelog file.
I have added it by mistake and just want to confirm before removing it.

[anandmukul93]

Direct Private Subnet Communication - By adding private subnet peering routes, you're enabling a direct path between worker nodes across VPCs that wouldn't exist in production if you're only using public subnet access.

Consul Mesh Behavior Divergence - In production, if Consul is configured to work through public subnet endpoints (NAT gateways, load balancers), the mesh would:

Route through public subnets
Potentially use different network paths
Have different latency/failure characteristics
Testing Gap - Your test environment would validate:

✅ Direct private-to-private node communication
✅ Public subnet routes (also present)
❌ But NOT the actual production traffic pattern
What This Means:

• Tests might pass because nodes can communicate via the "shortcut" private subnet route
• But in production, if private peering isn't allowed, the same tests could fail
• You're not validating the actual network path traffic will take

[LordAbhishek]

removed private subnet route.

[anandmukul93]

Same here see below comment on private subnet peering access. it doesnt simulate the general use case consul is built for in production.

[LordAbhishek]

updated it as well.