pulumi-eks 3.9.0a1742626547__py3-none-any.whl → 4.2.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. pulumi_eks/__init__.py +1 -0
  2. pulumi_eks/_enums.py +16 -7
  3. pulumi_eks/_inputs.py +491 -490
  4. pulumi_eks/_utilities.py +8 -4
  5. pulumi_eks/addon.py +51 -49
  6. pulumi_eks/cluster.py +346 -304
  7. pulumi_eks/cluster_creation_role_provider.py +12 -10
  8. pulumi_eks/managed_node_group.py +162 -160
  9. pulumi_eks/node_group.py +221 -219
  10. pulumi_eks/node_group_security_group.py +16 -14
  11. pulumi_eks/node_group_v2.py +234 -232
  12. pulumi_eks/outputs.py +148 -147
  13. pulumi_eks/provider.py +2 -0
  14. pulumi_eks/pulumi-plugin.json +1 -1
  15. pulumi_eks/vpc_cni_addon.py +170 -168
  16. {pulumi_eks-3.9.0a1742626547.dist-info → pulumi_eks-4.2.0.dist-info}/METADATA +4 -4
  17. pulumi_eks-4.2.0.dist-info/RECORD +20 -0
  18. {pulumi_eks-3.9.0a1742626547.dist-info → pulumi_eks-4.2.0.dist-info}/WHEEL +1 -1
  19. pulumi_eks-3.9.0a1742626547.dist-info/RECORD +0 -20
  20. {pulumi_eks-3.9.0a1742626547.dist-info → pulumi_eks-4.2.0.dist-info}/top_level.txt +0 -0
pulumi_eks/vpc_cni_addon.py CHANGED
@@ -2,6 +2,7 @@
2
2
  # *** WARNING: this file was generated by pulumi-gen-eks. ***
3
3
  # *** Do not edit by hand unless you're certain you know what you are doing! ***
4
4
 
5
+ import builtins
5
6
  import copy
6
7
  import warnings
7
8
  import sys
@@ -20,90 +21,90 @@ __all__ = ['VpcCniAddonArgs', 'VpcCniAddon']
20
21
  @pulumi.input_type
21
22
  class VpcCniAddonArgs:
22
23
  def __init__(__self__, *,
23
- cluster_name: pulumi.Input[str],
24
- addon_version: Optional[pulumi.Input[str]] = None,
25
- cluster_version: Optional[pulumi.Input[str]] = None,
26
- cni_configure_rpfilter: Optional[pulumi.Input[bool]] = None,
27
- cni_custom_network_cfg: Optional[pulumi.Input[bool]] = None,
28
- cni_external_snat: Optional[pulumi.Input[bool]] = None,
24
+ cluster_name: pulumi.Input[builtins.str],
25
+ addon_version: Optional[pulumi.Input[builtins.str]] = None,
26
+ cluster_version: Optional[pulumi.Input[builtins.str]] = None,
27
+ cni_configure_rpfilter: Optional[pulumi.Input[builtins.bool]] = None,
28
+ cni_custom_network_cfg: Optional[pulumi.Input[builtins.bool]] = None,
29
+ cni_external_snat: Optional[pulumi.Input[builtins.bool]] = None,
29
30
  configuration_values: Optional[pulumi.Input[Mapping[str, Any]]] = None,
30
- custom_network_config: Optional[pulumi.Input[bool]] = None,
31
- disable_tcp_early_demux: Optional[pulumi.Input[bool]] = None,
32
- enable_network_policy: Optional[pulumi.Input[bool]] = None,
33
- enable_pod_eni: Optional[pulumi.Input[bool]] = None,
34
- enable_prefix_delegation: Optional[pulumi.Input[bool]] = None,
35
- eni_config_label_def: Optional[pulumi.Input[str]] = None,
36
- eni_mtu: Optional[pulumi.Input[int]] = None,
37
- external_snat: Optional[pulumi.Input[bool]] = None,
38
- log_file: Optional[pulumi.Input[str]] = None,
39
- log_level: Optional[pulumi.Input[str]] = None,
40
- node_port_support: Optional[pulumi.Input[bool]] = None,
31
+ custom_network_config: Optional[pulumi.Input[builtins.bool]] = None,
32
+ disable_tcp_early_demux: Optional[pulumi.Input[builtins.bool]] = None,
33
+ enable_network_policy: Optional[pulumi.Input[builtins.bool]] = None,
34
+ enable_pod_eni: Optional[pulumi.Input[builtins.bool]] = None,
35
+ enable_prefix_delegation: Optional[pulumi.Input[builtins.bool]] = None,
36
+ eni_config_label_def: Optional[pulumi.Input[builtins.str]] = None,
37
+ eni_mtu: Optional[pulumi.Input[builtins.int]] = None,
38
+ external_snat: Optional[pulumi.Input[builtins.bool]] = None,
39
+ log_file: Optional[pulumi.Input[builtins.str]] = None,
40
+ log_level: Optional[pulumi.Input[builtins.str]] = None,
41
+ node_port_support: Optional[pulumi.Input[builtins.bool]] = None,
41
42
  resolve_conflicts_on_create: Optional['ResolveConflictsOnCreate'] = None,
42
43
  resolve_conflicts_on_update: Optional['ResolveConflictsOnUpdate'] = None,
43
- security_context_privileged: Optional[pulumi.Input[bool]] = None,
44
- service_account_role_arn: Optional[pulumi.Input[str]] = None,
45
- tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]] = None,
46
- veth_prefix: Optional[pulumi.Input[str]] = None,
47
- warm_eni_target: Optional[pulumi.Input[int]] = None,
48
- warm_ip_target: Optional[pulumi.Input[int]] = None,
49
- warm_prefix_target: Optional[pulumi.Input[int]] = None):
44
+ security_context_privileged: Optional[pulumi.Input[builtins.bool]] = None,
45
+ service_account_role_arn: Optional[pulumi.Input[builtins.str]] = None,
46
+ tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]]] = None,
47
+ veth_prefix: Optional[pulumi.Input[builtins.str]] = None,
48
+ warm_eni_target: Optional[pulumi.Input[builtins.int]] = None,
49
+ warm_ip_target: Optional[pulumi.Input[builtins.int]] = None,
50
+ warm_prefix_target: Optional[pulumi.Input[builtins.int]] = None):
50
51
  """
51
52
  The set of arguments for constructing a VpcCniAddon resource.
52
- :param pulumi.Input[str] cluster_name: The name of the EKS cluster.
53
- :param pulumi.Input[str] addon_version: The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
54
- :param pulumi.Input[str] cluster_version: The Kubernetes version of the cluster. This is used to determine the addon version to use if `addonVersion` is not specified.
55
- :param pulumi.Input[bool] cni_configure_rpfilter: Specifies whether ipamd should configure rp filter for primary interface. Default is `false`.
56
- :param pulumi.Input[bool] cni_custom_network_cfg: Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is `false`
57
- :param pulumi.Input[bool] cni_external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is `false`
53
+ :param pulumi.Input[builtins.str] cluster_name: The name of the EKS cluster.
54
+ :param pulumi.Input[builtins.str] addon_version: The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
55
+ :param pulumi.Input[builtins.str] cluster_version: The Kubernetes version of the cluster. This is used to determine the addon version to use if `addonVersion` is not specified.
56
+ :param pulumi.Input[builtins.bool] cni_configure_rpfilter: Specifies whether ipamd should configure rp filter for primary interface. Default is `false`.
57
+ :param pulumi.Input[builtins.bool] cni_custom_network_cfg: Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is `false`
58
+ :param pulumi.Input[builtins.bool] cni_external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is `false`
58
59
  :param pulumi.Input[Mapping[str, Any]] configuration_values: Custom configuration values for the vpc-cni addon. This object must match the schema derived from [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html).
59
- :param pulumi.Input[bool] custom_network_config: Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's `resourcesVpcConfig`.
60
+ :param pulumi.Input[builtins.bool] custom_network_config: Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's `resourcesVpcConfig`.
60
61
 
61
62
  Defaults to false.
62
- :param pulumi.Input[bool] disable_tcp_early_demux: Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
63
- :param pulumi.Input[bool] enable_network_policy: Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.
63
+ :param pulumi.Input[builtins.bool] disable_tcp_early_demux: Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
64
+ :param pulumi.Input[builtins.bool] enable_network_policy: Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.
64
65
 
65
66
  See for more information: [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/).
66
- :param pulumi.Input[bool] enable_pod_eni: Specifies whether to allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. Default is `false`. If using liveness and readiness probes, you will also need to disable TCP early demux.
67
- :param pulumi.Input[bool] enable_prefix_delegation: IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
68
- :param pulumi.Input[str] eni_config_label_def: Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone
67
+ :param pulumi.Input[builtins.bool] enable_pod_eni: Specifies whether to allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. Default is `false`. If using liveness and readiness probes, you will also need to disable TCP early demux.
68
+ :param pulumi.Input[builtins.bool] enable_prefix_delegation: IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
69
+ :param pulumi.Input[builtins.str] eni_config_label_def: Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone
69
70
  Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
70
71
 
71
72
  Defaults to the official AWS CNI image in ECR.
72
- :param pulumi.Input[int] eni_mtu: Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
73
+ :param pulumi.Input[builtins.int] eni_mtu: Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
73
74
 
74
75
  Defaults to 9001.
75
- :param pulumi.Input[bool] external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
76
+ :param pulumi.Input[builtins.bool] external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
76
77
 
77
78
  Defaults to false.
78
- :param pulumi.Input[str] log_file: Specifies the file path used for logs.
79
+ :param pulumi.Input[builtins.str] log_file: Specifies the file path used for logs.
79
80
 
80
81
  Defaults to "stdout" to emit Pod logs for `kubectl logs`.
81
- :param pulumi.Input[str] log_level: Specifies the log level used for logs.
82
+ :param pulumi.Input[builtins.str] log_level: Specifies the log level used for logs.
82
83
 
83
84
  Defaults to "DEBUG"
84
85
  Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
85
- :param pulumi.Input[bool] node_port_support: Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
86
+ :param pulumi.Input[builtins.bool] node_port_support: Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
86
87
 
87
88
  Defaults to true.
88
89
  :param 'ResolveConflictsOnCreate' resolve_conflicts_on_create: How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are `NONE` and `OVERWRITE`. For more details see the [CreateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html) API Docs.
89
90
  :param 'ResolveConflictsOnUpdate' resolve_conflicts_on_update: How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are `NONE`, `OVERWRITE`, and `PRESERVE`. For more details see the [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
90
- :param pulumi.Input[bool] security_context_privileged: Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
91
- :param pulumi.Input[str] service_account_role_arn: The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.
91
+ :param pulumi.Input[builtins.bool] security_context_privileged: Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
92
+ :param pulumi.Input[builtins.str] service_account_role_arn: The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.
92
93
 
93
94
  For more information, see [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) in the Amazon EKS User Guide.
94
95
 
95
96
  Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see [Enabling IAM roles for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) in the Amazon EKS User Guide.
96
- :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]] tags: Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
97
- :param pulumi.Input[str] veth_prefix: Specifies the veth prefix used to generate the host-side veth device name for the CNI.
97
+ :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]] tags: Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
98
+ :param pulumi.Input[builtins.str] veth_prefix: Specifies the veth prefix used to generate the host-side veth device name for the CNI.
98
99
 
99
100
  The prefix can be at most 4 characters long.
100
101
 
101
102
  Defaults to "eni".
102
- :param pulumi.Input[int] warm_eni_target: Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
103
+ :param pulumi.Input[builtins.int] warm_eni_target: Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
103
104
 
104
105
  Defaults to 1.
105
- :param pulumi.Input[int] warm_ip_target: Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
106
- :param pulumi.Input[int] warm_prefix_target: WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
106
+ :param pulumi.Input[builtins.int] warm_ip_target: Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
107
+ :param pulumi.Input[builtins.int] warm_prefix_target: WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
107
108
  """
108
109
  pulumi.set(__self__, "cluster_name", cluster_name)
109
110
  if addon_version is not None:
@@ -165,74 +166,74 @@ class VpcCniAddonArgs:
165
166
 
166
167
  @property
167
168
  @pulumi.getter(name="clusterName")
168
- def cluster_name(self) -> pulumi.Input[str]:
169
+ def cluster_name(self) -> pulumi.Input[builtins.str]:
169
170
  """
170
171
  The name of the EKS cluster.
171
172
  """
172
173
  return pulumi.get(self, "cluster_name")
173
174
 
174
175
  @cluster_name.setter
175
- def cluster_name(self, value: pulumi.Input[str]):
176
+ def cluster_name(self, value: pulumi.Input[builtins.str]):
176
177
  pulumi.set(self, "cluster_name", value)
177
178
 
178
179
  @property
179
180
  @pulumi.getter(name="addonVersion")
180
- def addon_version(self) -> Optional[pulumi.Input[str]]:
181
+ def addon_version(self) -> Optional[pulumi.Input[builtins.str]]:
181
182
  """
182
183
  The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
183
184
  """
184
185
  return pulumi.get(self, "addon_version")
185
186
 
186
187
  @addon_version.setter
187
- def addon_version(self, value: Optional[pulumi.Input[str]]):
188
+ def addon_version(self, value: Optional[pulumi.Input[builtins.str]]):
188
189
  pulumi.set(self, "addon_version", value)
189
190
 
190
191
  @property
191
192
  @pulumi.getter(name="clusterVersion")
192
- def cluster_version(self) -> Optional[pulumi.Input[str]]:
193
+ def cluster_version(self) -> Optional[pulumi.Input[builtins.str]]:
193
194
  """
194
195
  The Kubernetes version of the cluster. This is used to determine the addon version to use if `addonVersion` is not specified.
195
196
  """
196
197
  return pulumi.get(self, "cluster_version")
197
198
 
198
199
  @cluster_version.setter
199
- def cluster_version(self, value: Optional[pulumi.Input[str]]):
200
+ def cluster_version(self, value: Optional[pulumi.Input[builtins.str]]):
200
201
  pulumi.set(self, "cluster_version", value)
201
202
 
202
203
  @property
203
204
  @pulumi.getter(name="cniConfigureRpfilter")
204
- def cni_configure_rpfilter(self) -> Optional[pulumi.Input[bool]]:
205
+ def cni_configure_rpfilter(self) -> Optional[pulumi.Input[builtins.bool]]:
205
206
  """
206
207
  Specifies whether ipamd should configure rp filter for primary interface. Default is `false`.
207
208
  """
208
209
  return pulumi.get(self, "cni_configure_rpfilter")
209
210
 
210
211
  @cni_configure_rpfilter.setter
211
- def cni_configure_rpfilter(self, value: Optional[pulumi.Input[bool]]):
212
+ def cni_configure_rpfilter(self, value: Optional[pulumi.Input[builtins.bool]]):
212
213
  pulumi.set(self, "cni_configure_rpfilter", value)
213
214
 
214
215
  @property
215
216
  @pulumi.getter(name="cniCustomNetworkCfg")
216
- def cni_custom_network_cfg(self) -> Optional[pulumi.Input[bool]]:
217
+ def cni_custom_network_cfg(self) -> Optional[pulumi.Input[builtins.bool]]:
217
218
  """
218
219
  Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is `false`
219
220
  """
220
221
  return pulumi.get(self, "cni_custom_network_cfg")
221
222
 
222
223
  @cni_custom_network_cfg.setter
223
- def cni_custom_network_cfg(self, value: Optional[pulumi.Input[bool]]):
224
+ def cni_custom_network_cfg(self, value: Optional[pulumi.Input[builtins.bool]]):
224
225
  pulumi.set(self, "cni_custom_network_cfg", value)
225
226
 
226
227
  @property
227
228
  @pulumi.getter(name="cniExternalSnat")
228
- def cni_external_snat(self) -> Optional[pulumi.Input[bool]]:
229
+ def cni_external_snat(self) -> Optional[pulumi.Input[builtins.bool]]:
229
230
  """
230
231
  Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is `false`
231
232
  """
232
233
  return pulumi.get(self, "cni_external_snat")
233
234
 
234
235
  @cni_external_snat.setter
235
- def cni_external_snat(self, value: Optional[pulumi.Input[bool]]):
236
+ def cni_external_snat(self, value: Optional[pulumi.Input[builtins.bool]]):
236
237
  pulumi.set(self, "cni_external_snat", value)
237
238
 
238
239
  @property
@@ -249,7 +250,7 @@ class VpcCniAddonArgs:
249
250
 
250
251
  @property
251
252
  @pulumi.getter(name="customNetworkConfig")
252
- def custom_network_config(self) -> Optional[pulumi.Input[bool]]:
253
+ def custom_network_config(self) -> Optional[pulumi.Input[builtins.bool]]:
253
254
  """
254
255
  Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's `resourcesVpcConfig`.
255
256
 
@@ -258,24 +259,24 @@ class VpcCniAddonArgs:
258
259
  return pulumi.get(self, "custom_network_config")
259
260
 
260
261
  @custom_network_config.setter
261
- def custom_network_config(self, value: Optional[pulumi.Input[bool]]):
262
+ def custom_network_config(self, value: Optional[pulumi.Input[builtins.bool]]):
262
263
  pulumi.set(self, "custom_network_config", value)
263
264
 
264
265
  @property
265
266
  @pulumi.getter(name="disableTcpEarlyDemux")
266
- def disable_tcp_early_demux(self) -> Optional[pulumi.Input[bool]]:
267
+ def disable_tcp_early_demux(self) -> Optional[pulumi.Input[builtins.bool]]:
267
268
  """
268
269
  Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
269
270
  """
270
271
  return pulumi.get(self, "disable_tcp_early_demux")
271
272
 
272
273
  @disable_tcp_early_demux.setter
273
- def disable_tcp_early_demux(self, value: Optional[pulumi.Input[bool]]):
274
+ def disable_tcp_early_demux(self, value: Optional[pulumi.Input[builtins.bool]]):
274
275
  pulumi.set(self, "disable_tcp_early_demux", value)
275
276
 
276
277
  @property
277
278
  @pulumi.getter(name="enableNetworkPolicy")
278
- def enable_network_policy(self) -> Optional[pulumi.Input[bool]]:
279
+ def enable_network_policy(self) -> Optional[pulumi.Input[builtins.bool]]:
279
280
  """
280
281
  Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.
281
282
 
@@ -284,36 +285,36 @@ class VpcCniAddonArgs:
284
285
  return pulumi.get(self, "enable_network_policy")
285
286
 
286
287
  @enable_network_policy.setter
287
- def enable_network_policy(self, value: Optional[pulumi.Input[bool]]):
288
+ def enable_network_policy(self, value: Optional[pulumi.Input[builtins.bool]]):
288
289
  pulumi.set(self, "enable_network_policy", value)
289
290
 
290
291
  @property
291
292
  @pulumi.getter(name="enablePodEni")
292
- def enable_pod_eni(self) -> Optional[pulumi.Input[bool]]:
293
+ def enable_pod_eni(self) -> Optional[pulumi.Input[builtins.bool]]:
293
294
  """
294
295
  Specifies whether to allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. Default is `false`. If using liveness and readiness probes, you will also need to disable TCP early demux.
295
296
  """
296
297
  return pulumi.get(self, "enable_pod_eni")
297
298
 
298
299
  @enable_pod_eni.setter
299
- def enable_pod_eni(self, value: Optional[pulumi.Input[bool]]):
300
+ def enable_pod_eni(self, value: Optional[pulumi.Input[builtins.bool]]):
300
301
  pulumi.set(self, "enable_pod_eni", value)
301
302
 
302
303
  @property
303
304
  @pulumi.getter(name="enablePrefixDelegation")
304
- def enable_prefix_delegation(self) -> Optional[pulumi.Input[bool]]:
305
+ def enable_prefix_delegation(self) -> Optional[pulumi.Input[builtins.bool]]:
305
306
  """
306
307
  IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
307
308
  """
308
309
  return pulumi.get(self, "enable_prefix_delegation")
309
310
 
310
311
  @enable_prefix_delegation.setter
311
- def enable_prefix_delegation(self, value: Optional[pulumi.Input[bool]]):
312
+ def enable_prefix_delegation(self, value: Optional[pulumi.Input[builtins.bool]]):
312
313
  pulumi.set(self, "enable_prefix_delegation", value)
313
314
 
314
315
  @property
315
316
  @pulumi.getter(name="eniConfigLabelDef")
316
- def eni_config_label_def(self) -> Optional[pulumi.Input[str]]:
317
+ def eni_config_label_def(self) -> Optional[pulumi.Input[builtins.str]]:
317
318
  """
318
319
  Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone
319
320
  Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
@@ -323,12 +324,12 @@ class VpcCniAddonArgs:
323
324
  return pulumi.get(self, "eni_config_label_def")
324
325
 
325
326
  @eni_config_label_def.setter
326
- def eni_config_label_def(self, value: Optional[pulumi.Input[str]]):
327
+ def eni_config_label_def(self, value: Optional[pulumi.Input[builtins.str]]):
327
328
  pulumi.set(self, "eni_config_label_def", value)
328
329
 
329
330
  @property
330
331
  @pulumi.getter(name="eniMtu")
331
- def eni_mtu(self) -> Optional[pulumi.Input[int]]:
332
+ def eni_mtu(self) -> Optional[pulumi.Input[builtins.int]]:
332
333
  """
333
334
  Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
334
335
 
@@ -337,12 +338,12 @@ class VpcCniAddonArgs:
337
338
  return pulumi.get(self, "eni_mtu")
338
339
 
339
340
  @eni_mtu.setter
340
- def eni_mtu(self, value: Optional[pulumi.Input[int]]):
341
+ def eni_mtu(self, value: Optional[pulumi.Input[builtins.int]]):
341
342
  pulumi.set(self, "eni_mtu", value)
342
343
 
343
344
  @property
344
345
  @pulumi.getter(name="externalSnat")
345
- def external_snat(self) -> Optional[pulumi.Input[bool]]:
346
+ def external_snat(self) -> Optional[pulumi.Input[builtins.bool]]:
346
347
  """
347
348
  Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
348
349
 
@@ -351,12 +352,12 @@ class VpcCniAddonArgs:
351
352
  return pulumi.get(self, "external_snat")
352
353
 
353
354
  @external_snat.setter
354
- def external_snat(self, value: Optional[pulumi.Input[bool]]):
355
+ def external_snat(self, value: Optional[pulumi.Input[builtins.bool]]):
355
356
  pulumi.set(self, "external_snat", value)
356
357
 
357
358
  @property
358
359
  @pulumi.getter(name="logFile")
359
- def log_file(self) -> Optional[pulumi.Input[str]]:
360
+ def log_file(self) -> Optional[pulumi.Input[builtins.str]]:
360
361
  """
361
362
  Specifies the file path used for logs.
362
363
 
@@ -365,12 +366,12 @@ class VpcCniAddonArgs:
365
366
  return pulumi.get(self, "log_file")
366
367
 
367
368
  @log_file.setter
368
- def log_file(self, value: Optional[pulumi.Input[str]]):
369
+ def log_file(self, value: Optional[pulumi.Input[builtins.str]]):
369
370
  pulumi.set(self, "log_file", value)
370
371
 
371
372
  @property
372
373
  @pulumi.getter(name="logLevel")
373
- def log_level(self) -> Optional[pulumi.Input[str]]:
374
+ def log_level(self) -> Optional[pulumi.Input[builtins.str]]:
374
375
  """
375
376
  Specifies the log level used for logs.
376
377
 
@@ -380,12 +381,12 @@ class VpcCniAddonArgs:
380
381
  return pulumi.get(self, "log_level")
381
382
 
382
383
  @log_level.setter
383
- def log_level(self, value: Optional[pulumi.Input[str]]):
384
+ def log_level(self, value: Optional[pulumi.Input[builtins.str]]):
384
385
  pulumi.set(self, "log_level", value)
385
386
 
386
387
  @property
387
388
  @pulumi.getter(name="nodePortSupport")
388
- def node_port_support(self) -> Optional[pulumi.Input[bool]]:
389
+ def node_port_support(self) -> Optional[pulumi.Input[builtins.bool]]:
389
390
  """
390
391
  Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
391
392
 
@@ -394,7 +395,7 @@ class VpcCniAddonArgs:
394
395
  return pulumi.get(self, "node_port_support")
395
396
 
396
397
  @node_port_support.setter
397
- def node_port_support(self, value: Optional[pulumi.Input[bool]]):
398
+ def node_port_support(self, value: Optional[pulumi.Input[builtins.bool]]):
398
399
  pulumi.set(self, "node_port_support", value)
399
400
 
400
401
  @property
@@ -423,19 +424,19 @@ class VpcCniAddonArgs:
423
424
 
424
425
  @property
425
426
  @pulumi.getter(name="securityContextPrivileged")
426
- def security_context_privileged(self) -> Optional[pulumi.Input[bool]]:
427
+ def security_context_privileged(self) -> Optional[pulumi.Input[builtins.bool]]:
427
428
  """
428
429
  Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
429
430
  """
430
431
  return pulumi.get(self, "security_context_privileged")
431
432
 
432
433
  @security_context_privileged.setter
433
- def security_context_privileged(self, value: Optional[pulumi.Input[bool]]):
434
+ def security_context_privileged(self, value: Optional[pulumi.Input[builtins.bool]]):
434
435
  pulumi.set(self, "security_context_privileged", value)
435
436
 
436
437
  @property
437
438
  @pulumi.getter(name="serviceAccountRoleArn")
438
- def service_account_role_arn(self) -> Optional[pulumi.Input[str]]:
439
+ def service_account_role_arn(self) -> Optional[pulumi.Input[builtins.str]]:
439
440
  """
440
441
  The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.
441
442
 
@@ -446,24 +447,24 @@ class VpcCniAddonArgs:
446
447
  return pulumi.get(self, "service_account_role_arn")
447
448
 
448
449
  @service_account_role_arn.setter
449
- def service_account_role_arn(self, value: Optional[pulumi.Input[str]]):
450
+ def service_account_role_arn(self, value: Optional[pulumi.Input[builtins.str]]):
450
451
  pulumi.set(self, "service_account_role_arn", value)
451
452
 
452
453
  @property
453
454
  @pulumi.getter
454
- def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]]:
455
+ def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]]]:
455
456
  """
456
457
  Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
457
458
  """
458
459
  return pulumi.get(self, "tags")
459
460
 
460
461
  @tags.setter
461
- def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]]):
462
+ def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]]]):
462
463
  pulumi.set(self, "tags", value)
463
464
 
464
465
  @property
465
466
  @pulumi.getter(name="vethPrefix")
466
- def veth_prefix(self) -> Optional[pulumi.Input[str]]:
467
+ def veth_prefix(self) -> Optional[pulumi.Input[builtins.str]]:
467
468
  """
468
469
  Specifies the veth prefix used to generate the host-side veth device name for the CNI.
469
470
 
@@ -474,12 +475,12 @@ class VpcCniAddonArgs:
474
475
  return pulumi.get(self, "veth_prefix")
475
476
 
476
477
  @veth_prefix.setter
477
- def veth_prefix(self, value: Optional[pulumi.Input[str]]):
478
+ def veth_prefix(self, value: Optional[pulumi.Input[builtins.str]]):
478
479
  pulumi.set(self, "veth_prefix", value)
479
480
 
480
481
  @property
481
482
  @pulumi.getter(name="warmEniTarget")
482
- def warm_eni_target(self) -> Optional[pulumi.Input[int]]:
483
+ def warm_eni_target(self) -> Optional[pulumi.Input[builtins.int]]:
483
484
  """
484
485
  Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
485
486
 
@@ -488,66 +489,67 @@ class VpcCniAddonArgs:
488
489
  return pulumi.get(self, "warm_eni_target")
489
490
 
490
491
  @warm_eni_target.setter
491
- def warm_eni_target(self, value: Optional[pulumi.Input[int]]):
492
+ def warm_eni_target(self, value: Optional[pulumi.Input[builtins.int]]):
492
493
  pulumi.set(self, "warm_eni_target", value)
493
494
 
494
495
  @property
495
496
  @pulumi.getter(name="warmIpTarget")
496
- def warm_ip_target(self) -> Optional[pulumi.Input[int]]:
497
+ def warm_ip_target(self) -> Optional[pulumi.Input[builtins.int]]:
497
498
  """
498
499
  Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
499
500
  """
500
501
  return pulumi.get(self, "warm_ip_target")
501
502
 
502
503
  @warm_ip_target.setter
503
- def warm_ip_target(self, value: Optional[pulumi.Input[int]]):
504
+ def warm_ip_target(self, value: Optional[pulumi.Input[builtins.int]]):
504
505
  pulumi.set(self, "warm_ip_target", value)
505
506
 
506
507
  @property
507
508
  @pulumi.getter(name="warmPrefixTarget")
508
- def warm_prefix_target(self) -> Optional[pulumi.Input[int]]:
509
+ def warm_prefix_target(self) -> Optional[pulumi.Input[builtins.int]]:
509
510
  """
510
511
  WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
511
512
  """
512
513
  return pulumi.get(self, "warm_prefix_target")
513
514
 
514
515
  @warm_prefix_target.setter
515
- def warm_prefix_target(self, value: Optional[pulumi.Input[int]]):
516
+ def warm_prefix_target(self, value: Optional[pulumi.Input[builtins.int]]):
516
517
  pulumi.set(self, "warm_prefix_target", value)
517
518
 
518
519
 
520
+ @pulumi.type_token("eks:index:VpcCniAddon")
519
521
  class VpcCniAddon(pulumi.ComponentResource):
520
522
  @overload
521
523
  def __init__(__self__,
522
524
  resource_name: str,
523
525
  opts: Optional[pulumi.ResourceOptions] = None,
524
- addon_version: Optional[pulumi.Input[str]] = None,
525
- cluster_name: Optional[pulumi.Input[str]] = None,
526
- cluster_version: Optional[pulumi.Input[str]] = None,
527
- cni_configure_rpfilter: Optional[pulumi.Input[bool]] = None,
528
- cni_custom_network_cfg: Optional[pulumi.Input[bool]] = None,
529
- cni_external_snat: Optional[pulumi.Input[bool]] = None,
526
+ addon_version: Optional[pulumi.Input[builtins.str]] = None,
527
+ cluster_name: Optional[pulumi.Input[builtins.str]] = None,
528
+ cluster_version: Optional[pulumi.Input[builtins.str]] = None,
529
+ cni_configure_rpfilter: Optional[pulumi.Input[builtins.bool]] = None,
530
+ cni_custom_network_cfg: Optional[pulumi.Input[builtins.bool]] = None,
531
+ cni_external_snat: Optional[pulumi.Input[builtins.bool]] = None,
530
532
  configuration_values: Optional[pulumi.Input[Mapping[str, Any]]] = None,
531
- custom_network_config: Optional[pulumi.Input[bool]] = None,
532
- disable_tcp_early_demux: Optional[pulumi.Input[bool]] = None,
533
- enable_network_policy: Optional[pulumi.Input[bool]] = None,
534
- enable_pod_eni: Optional[pulumi.Input[bool]] = None,
535
- enable_prefix_delegation: Optional[pulumi.Input[bool]] = None,
536
- eni_config_label_def: Optional[pulumi.Input[str]] = None,
537
- eni_mtu: Optional[pulumi.Input[int]] = None,
538
- external_snat: Optional[pulumi.Input[bool]] = None,
539
- log_file: Optional[pulumi.Input[str]] = None,
540
- log_level: Optional[pulumi.Input[str]] = None,
541
- node_port_support: Optional[pulumi.Input[bool]] = None,
533
+ custom_network_config: Optional[pulumi.Input[builtins.bool]] = None,
534
+ disable_tcp_early_demux: Optional[pulumi.Input[builtins.bool]] = None,
535
+ enable_network_policy: Optional[pulumi.Input[builtins.bool]] = None,
536
+ enable_pod_eni: Optional[pulumi.Input[builtins.bool]] = None,
537
+ enable_prefix_delegation: Optional[pulumi.Input[builtins.bool]] = None,
538
+ eni_config_label_def: Optional[pulumi.Input[builtins.str]] = None,
539
+ eni_mtu: Optional[pulumi.Input[builtins.int]] = None,
540
+ external_snat: Optional[pulumi.Input[builtins.bool]] = None,
541
+ log_file: Optional[pulumi.Input[builtins.str]] = None,
542
+ log_level: Optional[pulumi.Input[builtins.str]] = None,
543
+ node_port_support: Optional[pulumi.Input[builtins.bool]] = None,
542
544
  resolve_conflicts_on_create: Optional['ResolveConflictsOnCreate'] = None,
543
545
  resolve_conflicts_on_update: Optional['ResolveConflictsOnUpdate'] = None,
544
- security_context_privileged: Optional[pulumi.Input[bool]] = None,
545
- service_account_role_arn: Optional[pulumi.Input[str]] = None,
546
- tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]] = None,
547
- veth_prefix: Optional[pulumi.Input[str]] = None,
548
- warm_eni_target: Optional[pulumi.Input[int]] = None,
549
- warm_ip_target: Optional[pulumi.Input[int]] = None,
550
- warm_prefix_target: Optional[pulumi.Input[int]] = None,
546
+ security_context_privileged: Optional[pulumi.Input[builtins.bool]] = None,
547
+ service_account_role_arn: Optional[pulumi.Input[builtins.str]] = None,
548
+ tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]]] = None,
549
+ veth_prefix: Optional[pulumi.Input[builtins.str]] = None,
550
+ warm_eni_target: Optional[pulumi.Input[builtins.int]] = None,
551
+ warm_ip_target: Optional[pulumi.Input[builtins.int]] = None,
552
+ warm_prefix_target: Optional[pulumi.Input[builtins.int]] = None,
551
553
  __props__=None):
552
554
  """
553
555
  VpcCniAddon manages the configuration of the Amazon VPC CNI plugin for Kubernetes by leveraging the EKS managed add-on.
@@ -555,61 +557,61 @@ class VpcCniAddon(pulumi.ComponentResource):
555
557
 
556
558
  :param str resource_name: The name of the resource.
557
559
  :param pulumi.ResourceOptions opts: Options for the resource.
558
- :param pulumi.Input[str] addon_version: The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
559
- :param pulumi.Input[str] cluster_name: The name of the EKS cluster.
560
- :param pulumi.Input[str] cluster_version: The Kubernetes version of the cluster. This is used to determine the addon version to use if `addonVersion` is not specified.
561
- :param pulumi.Input[bool] cni_configure_rpfilter: Specifies whether ipamd should configure rp filter for primary interface. Default is `false`.
562
- :param pulumi.Input[bool] cni_custom_network_cfg: Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is `false`
563
- :param pulumi.Input[bool] cni_external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is `false`
560
+ :param pulumi.Input[builtins.str] addon_version: The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
561
+ :param pulumi.Input[builtins.str] cluster_name: The name of the EKS cluster.
562
+ :param pulumi.Input[builtins.str] cluster_version: The Kubernetes version of the cluster. This is used to determine the addon version to use if `addonVersion` is not specified.
563
+ :param pulumi.Input[builtins.bool] cni_configure_rpfilter: Specifies whether ipamd should configure rp filter for primary interface. Default is `false`.
564
+ :param pulumi.Input[builtins.bool] cni_custom_network_cfg: Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is `false`
565
+ :param pulumi.Input[builtins.bool] cni_external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is `false`
564
566
  :param pulumi.Input[Mapping[str, Any]] configuration_values: Custom configuration values for the vpc-cni addon. This object must match the schema derived from [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html).
565
- :param pulumi.Input[bool] custom_network_config: Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's `resourcesVpcConfig`.
567
+ :param pulumi.Input[builtins.bool] custom_network_config: Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's `resourcesVpcConfig`.
566
568
 
567
569
  Defaults to false.
568
- :param pulumi.Input[bool] disable_tcp_early_demux: Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
569
- :param pulumi.Input[bool] enable_network_policy: Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.
570
+ :param pulumi.Input[builtins.bool] disable_tcp_early_demux: Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
571
+ :param pulumi.Input[builtins.bool] enable_network_policy: Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.
570
572
 
571
573
  See for more information: [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/).
572
- :param pulumi.Input[bool] enable_pod_eni: Specifies whether to allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. Default is `false`. If using liveness and readiness probes, you will also need to disable TCP early demux.
573
- :param pulumi.Input[bool] enable_prefix_delegation: IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
574
- :param pulumi.Input[str] eni_config_label_def: Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone
574
+ :param pulumi.Input[builtins.bool] enable_pod_eni: Specifies whether to allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. Default is `false`. If using liveness and readiness probes, you will also need to disable TCP early demux.
575
+ :param pulumi.Input[builtins.bool] enable_prefix_delegation: IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
576
+ :param pulumi.Input[builtins.str] eni_config_label_def: Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone
575
577
  Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))
576
578
 
577
579
  Defaults to the official AWS CNI image in ECR.
578
- :param pulumi.Input[int] eni_mtu: Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
580
+ :param pulumi.Input[builtins.int] eni_mtu: Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.
579
581
 
580
582
  Defaults to 9001.
581
- :param pulumi.Input[bool] external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
583
+ :param pulumi.Input[builtins.bool] external_snat: Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.
582
584
 
583
585
  Defaults to false.
584
- :param pulumi.Input[str] log_file: Specifies the file path used for logs.
586
+ :param pulumi.Input[builtins.str] log_file: Specifies the file path used for logs.
585
587
 
586
588
  Defaults to "stdout" to emit Pod logs for `kubectl logs`.
587
- :param pulumi.Input[str] log_level: Specifies the log level used for logs.
589
+ :param pulumi.Input[builtins.str] log_level: Specifies the log level used for logs.
588
590
 
589
591
  Defaults to "DEBUG"
590
592
  Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".
591
- :param pulumi.Input[bool] node_port_support: Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
593
+ :param pulumi.Input[builtins.bool] node_port_support: Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.
592
594
 
593
595
  Defaults to true.
594
596
  :param 'ResolveConflictsOnCreate' resolve_conflicts_on_create: How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are `NONE` and `OVERWRITE`. For more details see the [CreateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html) API Docs.
595
597
  :param 'ResolveConflictsOnUpdate' resolve_conflicts_on_update: How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are `NONE`, `OVERWRITE`, and `PRESERVE`. For more details see the [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
596
- :param pulumi.Input[bool] security_context_privileged: Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
597
- :param pulumi.Input[str] service_account_role_arn: The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.
598
+ :param pulumi.Input[builtins.bool] security_context_privileged: Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
599
+ :param pulumi.Input[builtins.str] service_account_role_arn: The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.
598
600
 
599
601
  For more information, see [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) in the Amazon EKS User Guide.
600
602
 
601
603
  Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see [Enabling IAM roles for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) in the Amazon EKS User Guide.
602
- :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]] tags: Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
603
- :param pulumi.Input[str] veth_prefix: Specifies the veth prefix used to generate the host-side veth device name for the CNI.
604
+ :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]] tags: Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
605
+ :param pulumi.Input[builtins.str] veth_prefix: Specifies the veth prefix used to generate the host-side veth device name for the CNI.
604
606
 
605
607
  The prefix can be at most 4 characters long.
606
608
 
607
609
  Defaults to "eni".
608
- :param pulumi.Input[int] warm_eni_target: Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
610
+ :param pulumi.Input[builtins.int] warm_eni_target: Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.
609
611
 
610
612
  Defaults to 1.
611
- :param pulumi.Input[int] warm_ip_target: Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
612
- :param pulumi.Input[int] warm_prefix_target: WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
613
+ :param pulumi.Input[builtins.int] warm_ip_target: Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
614
+ :param pulumi.Input[builtins.int] warm_prefix_target: WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
613
615
  """
614
616
  ...
615
617
  @overload
@@ -636,33 +638,33 @@ class VpcCniAddon(pulumi.ComponentResource):
636
638
  def _internal_init(__self__,
637
639
  resource_name: str,
638
640
  opts: Optional[pulumi.ResourceOptions] = None,
639
- addon_version: Optional[pulumi.Input[str]] = None,
640
- cluster_name: Optional[pulumi.Input[str]] = None,
641
- cluster_version: Optional[pulumi.Input[str]] = None,
642
- cni_configure_rpfilter: Optional[pulumi.Input[bool]] = None,
643
- cni_custom_network_cfg: Optional[pulumi.Input[bool]] = None,
644
- cni_external_snat: Optional[pulumi.Input[bool]] = None,
641
+ addon_version: Optional[pulumi.Input[builtins.str]] = None,
642
+ cluster_name: Optional[pulumi.Input[builtins.str]] = None,
643
+ cluster_version: Optional[pulumi.Input[builtins.str]] = None,
644
+ cni_configure_rpfilter: Optional[pulumi.Input[builtins.bool]] = None,
645
+ cni_custom_network_cfg: Optional[pulumi.Input[builtins.bool]] = None,
646
+ cni_external_snat: Optional[pulumi.Input[builtins.bool]] = None,
645
647
  configuration_values: Optional[pulumi.Input[Mapping[str, Any]]] = None,
646
- custom_network_config: Optional[pulumi.Input[bool]] = None,
647
- disable_tcp_early_demux: Optional[pulumi.Input[bool]] = None,
648
- enable_network_policy: Optional[pulumi.Input[bool]] = None,
649
- enable_pod_eni: Optional[pulumi.Input[bool]] = None,
650
- enable_prefix_delegation: Optional[pulumi.Input[bool]] = None,
651
- eni_config_label_def: Optional[pulumi.Input[str]] = None,
652
- eni_mtu: Optional[pulumi.Input[int]] = None,
653
- external_snat: Optional[pulumi.Input[bool]] = None,
654
- log_file: Optional[pulumi.Input[str]] = None,
655
- log_level: Optional[pulumi.Input[str]] = None,
656
- node_port_support: Optional[pulumi.Input[bool]] = None,
648
+ custom_network_config: Optional[pulumi.Input[builtins.bool]] = None,
649
+ disable_tcp_early_demux: Optional[pulumi.Input[builtins.bool]] = None,
650
+ enable_network_policy: Optional[pulumi.Input[builtins.bool]] = None,
651
+ enable_pod_eni: Optional[pulumi.Input[builtins.bool]] = None,
652
+ enable_prefix_delegation: Optional[pulumi.Input[builtins.bool]] = None,
653
+ eni_config_label_def: Optional[pulumi.Input[builtins.str]] = None,
654
+ eni_mtu: Optional[pulumi.Input[builtins.int]] = None,
655
+ external_snat: Optional[pulumi.Input[builtins.bool]] = None,
656
+ log_file: Optional[pulumi.Input[builtins.str]] = None,
657
+ log_level: Optional[pulumi.Input[builtins.str]] = None,
658
+ node_port_support: Optional[pulumi.Input[builtins.bool]] = None,
657
659
  resolve_conflicts_on_create: Optional['ResolveConflictsOnCreate'] = None,
658
660
  resolve_conflicts_on_update: Optional['ResolveConflictsOnUpdate'] = None,
659
- security_context_privileged: Optional[pulumi.Input[bool]] = None,
660
- service_account_role_arn: Optional[pulumi.Input[str]] = None,
661
- tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]] = None,
662
- veth_prefix: Optional[pulumi.Input[str]] = None,
663
- warm_eni_target: Optional[pulumi.Input[int]] = None,
664
- warm_ip_target: Optional[pulumi.Input[int]] = None,
665
- warm_prefix_target: Optional[pulumi.Input[int]] = None,
661
+ security_context_privileged: Optional[pulumi.Input[builtins.bool]] = None,
662
+ service_account_role_arn: Optional[pulumi.Input[builtins.str]] = None,
663
+ tags: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]]] = None,
664
+ veth_prefix: Optional[pulumi.Input[builtins.str]] = None,
665
+ warm_eni_target: Optional[pulumi.Input[builtins.int]] = None,
666
+ warm_ip_target: Optional[pulumi.Input[builtins.int]] = None,
667
+ warm_prefix_target: Optional[pulumi.Input[builtins.int]] = None,
666
668
  __props__=None):
667
669
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
668
670
  if not isinstance(opts, pulumi.ResourceOptions):