pulumi-eks
pulumi-eks copied to clipboard
If no VPC id passed into cluster, then try to deduce it
Problem description
If you don't pass in a VPC id to an EKS Cluster but do pass in public and private subnet ids then it fails to be created because security groups aren't in the correct VPC. (presumably, it's using the default VPC)
Errors & Logs
Error message: Security group(s) [sg-{id}] are not in the same VPC as the subnets. Please specify a security group that is associated with the VPC: vpc-{id}.
Reproducing the issue
import * as awsx from "@pulumi/awsx";
import * as eks from "@pulumi/eks";
const vpc = new awsx.ec2.Vpc("vpc", {
subnets: [{type: "private"}, {type: "public"}],
numberOfAvailabilityZones: 2
});
const cluster = new eks.Cluster("cluster", {
version: "1.18",
publicSubnetIds: vpc.publicSubnetIds,
privateSubnetIds: vpc.privateSubnetIds,
enabledClusterLogTypes: ["api", "audit", "authenticator", "controllerManager", "scheduler"],
createOidcProvider: true,
skipDefaultNodeGroup: true,
})
Suggestions for a fix
If the subnets are specified and they're in the same VPC, then assume that's the VPC the security groups and indeed the cluster should be in.
Happy to discuss further, but if this is a "we shouldn't do this" feel free to just close it
Similar to https://github.com/pulumi/pulumi-awsx/pull/819