eks-cross-region-nodes

eks-cross-region-nodes is a powerful set of tools designed to facilitate the integration of EC2 worker nodes located in satellite Virtual Private Clouds (VPCs) across different regions into an Amazon Elastic Kubernetes Service (EKS) cluster. This project not only supports cross-region connectivity but extends functionality for cross-account scenarios, making it versatile for complex AWS environments.

Key Features

• Cross-Account Support: The implementation allows satellite nodes to exist in separate AWS accounts while being part of the same EKS cluster. The cross-account nodes utilize a dedicated aws-node-satellite-<acct>-<region> DaemonSet without Pod Identity dependency. This ensures smoother communication and operation across different Amazon accounts.

• Node Management Tools: The project includes two primary components, xrn-install and xrnctl, which handle the installation and configuration of satellite nodes effectively.

Components Overview

xrn-install

This component manages the bootstrap process, installing a satellite EC2 instance into an EKS cluster. Key functionalities include:

• Subcommands:
  • init: Handles the discovery of cluster configurations and executes preflight checks followed by the initialization of the node.
  • patch: Allows for only patching operations without the full initialization process, suitable for cross-account cases.
  • preflight and discover options help ensure the environment is ready for integration with EKS.

Usage Examples:

# To initialize a same-account / cross-region node
xrn-install init --cluster-name my-cluster --cluster-region us-east-2

# To patch a cross-account node from a kubelet ExecStartPre drop-in
xrn-install patch --cluster-name my-cluster --cluster-region us-east-2 \  
  --cluster-account-role-arn arn:aws:iam::<cluster-acct>:role/XrnSatelliteNodeRole

xrnctl

The xrnctl command-line tool serves as a cluster administrator's interface, allowing management of satellite nodes. Important capabilities include:

• setup-iam: Automatically creates the necessary IAM roles and instance profiles for satellite nodes.
• add-satellite: Registers new satellites while managing associated configurations, ensuring network configurations align properly.
• remove-satellite: Deregisters satellites safely, confirming no active nodes remain registered.
• verify: Checks for drift in configurations, ensuring that the node settings remain consistent with expectations.

Usage Examples:

# To register a satellite in the same account / cross-region
xrnctl add-satellite \  
  --cluster-name main --cluster-region us-east-2 \  
  --vpc-id vpc-09c3d15c27ab543c5 --satellite-region eu-west-1

# To list all registered satellites
xrnctl list-satellites --cluster-name main --cluster-region us-east-2

Requirements

• Go 1.25 or later
• AWS SDK v2
• Compatibility with k8s.io/client-go for cluster operations
• Optimized for AL2023 EKS images verifying adherence to AWS deployment standards.

Documentation

For detailed user instructions, architectural overviews, and further guidance, the following documents are available:

• User Guide
• Architecture Reference

This project aims to optimize EKS cluster operations, facilitating the management of multi-region deployments and enhancing overall efficiency in hybrid cloud environments.