3.2 Set Up Network Fabric¶

The network fabric provides connectivity between all Kubernetes nodes, outbound internet access for image pulls, and a stable endpoint for the Kubernetes API. The requirements are:

All nodes must be able to reach each other on the required ports (see Firewall Rules)
Control plane nodes need a stable endpoint (VIP or load balancer) for the Kubernetes API
All nodes need outbound internet access (directly or via NAT/proxy)
DNS resolution must work for both internal and external domains

AWSBare MetalProxmox VMs

The network module (terraform/modules/aws/network) creates the full VPC networking layer for the cluster. You do not run this module independently -- it is composed into terraform/cluster/aws/main.tf and deployed as part of the full terraform apply. This section explains what the module creates, how it works, and where to customise it.

Architecture¶

Internet
    │
┌───┴───┐
│  IGW  │
└───┬───┘
    │
┌───┴──────────────────────────────────┐
│  Public Subnets (one per AZ)         │
│  - NAT Gateways                      │
│  - Network Load Balancer             │
│  - map_public_ip_on_launch = true    │
└───┬──────────────────────────────────┘
    │ (NAT)
┌───┴──────────────────────────────────┐
│  Private Subnets (one per AZ)        │
│  - Control Plane EC2 instances       │
│  - Worker EC2 instances              │
│  - map_public_ip_on_launch = false   │
└──────────────────────────────────────┘

Step 1: Configure Network Variables¶

Open terraform/cluster/envs/aws.tfvars and set the network parameters.

VPC CIDR¶

The vpc_cidr defines the overall address space for the VPC. All subnets must fall within this range:

terraform/cluster/aws/variables.tf

variable "vpc_cidr" {
  description = "VPC CIDR block"
  type        = string
  default     = "10.0.0.0/16"
}

Change this if 10.0.0.0/16 conflicts with your existing networks. The demo environment uses 10.2.0.0/16:

terraform/cluster/envs/aws.tfvars

vpc_cidr = "10.2.0.0/16"

Availability Zones and Subnets¶

You must define one public and one private subnet per availability zone. These three lists must have the same length:

terraform/cluster/envs/aws.tfvars

availability_zones   = ["af-south-1a"]
public_subnet_cidrs  = ["10.2.1.0/24"]
private_subnet_cidrs = ["10.2.11.0/24"]

Single AZ (demo / cost saving):

availability_zones   = ["af-south-1a"]
public_subnet_cidrs  = ["10.2.1.0/24"]
private_subnet_cidrs = ["10.2.11.0/24"]

Multi-AZ (production / HA):

availability_zones   = ["af-south-1a", "af-south-1b", "af-south-1c"]
public_subnet_cidrs  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnet_cidrs = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]

NAT Gateway Strategy¶

NAT gateways give private subnet nodes outbound internet access. Choose a strategy:

terraform/cluster/envs/aws.tfvars

enable_nat_gateway = true
single_nat_gateway = true   # false = one per AZ (HA)

Setting	Behaviour	Cost
`single_nat_gateway = true`	One NAT gateway shared across all AZs	~$41.61/mo
`single_nat_gateway = false`	One NAT gateway per AZ (HA -- survives AZ failure)	~$41.61/mo per AZ