Conversation
* removed depricated versions, updated them with latest supported version. * added storage class for consul servers pvcs
LordAbhishek
added
backport/1.7.x
|
Please let me know if this change needs changelog file. |
| route_table_id = [module.vpc[0].public_route_table_ids[0], module.vpc[0].private_route_table_ids[0]][count.index] | ||
| # Add routes to all route tables in VPC 0 to route traffic to VPC 1 through the peering connection. | ||
| resource "aws_route" "peering_private_0" { | ||
| count = var.cluster_count > 1 ? length(module.vpc[0].private_route_table_ids) : 0 |
There was a problem hiding this comment.
Direct Private Subnet Communication - By adding private subnet peering routes, you're enabling a direct path between worker nodes across VPCs that wouldn't exist in production if you're only using public subnet access.
Consul Mesh Behavior Divergence - In production, if Consul is configured to work through public subnet endpoints (NAT gateways, load balancers), the mesh would:
Route through public subnets
Potentially use different network paths
Have different latency/failure characteristics
Testing Gap - Your test environment would validate:
✅ Direct private-to-private node communication
✅ Public subnet routes (also present)
❌ But NOT the actual production traffic pattern
What This Means:
- Tests might pass because nodes can communicate via the "shortcut" private subnet route
- But in production, if private peering isn't allowed, the same tests could fail
- You're not validating the actual network path traffic will take
There was a problem hiding this comment.
removed private subnet route.
| # Each EKS cluster needs to allow ingress traffic from the other VPC. | ||
| resource "aws_security_group_rule" "allowingressfrom1-0" { | ||
| count = var.cluster_count > 1 ? 1 : 0 | ||
| count = var.cluster_count > 1 ? length(module.vpc[1].private_subnets_cidr_blocks) : 0 |
There was a problem hiding this comment.
Same here see below comment on private subnet peering access. it doesnt simulate the general use case consul is built for in production.
There was a problem hiding this comment.
updated it as well.
2 participants
Existing Issue:
Currently eks workflows are failing at infrastructure provisioning in cloud nightly main tests.
Failing Workflow: https://github.com/hashicorp/consul-k8s-workflows/actions/runs/22421960130/job/64921986795
Fix eks terraform script
Workflow with updated/fixed terraform script:
https://github.com/hashicorp/consul-k8s-workflows/actions/runs/22436582955/job/64968467657
(terraform apply step is successfully completed).