VPC Peering Operator

Manage VPC Peerings in Kubernetes

The VPC Peering operator for Kubernetes provides a way to natively define a vpc peering as a Kubernetes object and handles the lifecycle around the Peering and Routing for a VPC.

The premise of this operator is to serve as a self service tool to allow users running in a multi tenant cluster to manage peerings to other AWS VPC's for consumption of their resources.

CustomResourceDefinitions

The Operator acts on the following custom resource definitions (CRDs):

• VpcPeering, which defines a desired VPC Peering. The Operator Creates a VPC Peering request upon creation of a VpcPeering CRD. A configurable wait timeout is defined to wait for an accept from the peered account, when the peering becomes active the source VPCs route tables can then be managed automatically.

An example is shown in example/cr.yaml

Installation

The Nodes running the Operator require an IAM Instance profile to be associated with the following policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateRoute",
        "ec2:DeleteVpcPeeringConnection",
        "ec2:DeleteRoute",
        "ec2:CreateVpcPeeringConnection"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:vpc-peering-connection/*",
        "arn:aws:ec2:*:*:route-table/*",
        "arn:aws:ec2:*:*:vpc/*"
      ]
    },
    {
      "Sid": "VisualEditor1",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeRouteTables"
      ],
      "Resource": "*"
    }
  ]
}

Install the Operator inside a cluster by running the following command:

kubectl apply -f deploy/

Note: make sure to adapt the namespace in the ClusterRoleBinding if deploying in another namespace than the default namespace.

Create an instance of a VPC Peering CRD

Note: make sure to adapt the values of the CR defined in example/cr.yaml.

kubectl apply -f example/cr.yaml

Removal

To remove the operator, first delete any custom resources you created in each namespace (please note this will remove routes in routetables associated with the VPC and delete peering connections).

for n in $(kubectl get namespaces -o jsonpath={..metadata.name}); do
  kubectl delete --all --namespace=$n vpcpeering
done

After a couple of minutes you can go ahead and remove the operator itself.

kubectl delete -f bundle.yaml

Configuration

Configuration is built through environment variables currently defined in deploy/operator.yaml Below are the available configuration options