Setting up Kubernetes Clusters on Amazon VPC based Private Subnets

Using Amazon Virtual Private Cloud (VPC) based private subnets to deploy Platform9 Managed Kubernetes clusters improves the security of your application deployment.

Putting both master and worker nodes on private subnets prevents direct reachability to the nodes from the Internet, and reduces the overall attack surface. All master and worker nodes can access the Internet through a NAT gateway. The nodes can be accessed via a bastion host, if required.

If you are using site-to-site VPNs from your corporate network to Amazon Web Services (AWS), you may want to utilize private subnets, so that you can deploy the Kubernetes hosts on the address space that matches what you use internally. In this case, the Kubernetes hosts would be reachable from the corporate network via a secure VPN or a dedicated AWS connection, instead of transiting the insecure public Internet.

The following diagram is a conceptual representation of an Amazon VPC with a public subnet and a private subnet.

You can deploy your Kubernetes cluster on a setup that is similar to the setup seen in the above diagram.

Before you can create a Kubernetes cluster on an Amazon VPC based private subnet, you must have added AWS as your cloud provider. Refer to this article to add AWS as your cloud provider.

You can then take one of the following two paths to create a Kubernetes cluster.

The sections that follow provide details to

Create VPC

The following criteria must be satisfied by the Amazon VPC based private subnet, on which you want to deploy your Kubernetes cluster.

Follow the steps given below to create a VPC and configure public and private subnets required for the Kubernetes cluster.

  1. Create a VPC with a /16 IPv4 CIDR block. Refer to Step 1-Create the VPC in http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/getting-started-ipv4.html for details.
  2. Edit the VPC to enable DNS hostname. Refer to http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html to enable DNS hostname.
  3. Create a subnet on the VPC that can be used by elastic load balancers(ELB). This is your public subnet. Refer to http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#AddaSubnet to add a subnet.
  4. Enable auto-assignment of public IPv4 addresses for the public subnet created in the step above. Refer to http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html#subnet-public-ip to enable auto-assignment of IPv4 addresses.
  5. Create and attach an Internet gateway to your VPC. Refer to the Attaching an Internet Gateway section at http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html, to create and attach an internet gateway to the VPC.
  6. Create a route table in your VPC and add a route with a destination of 0.0.0.0/0 for IPv4 traffic. Refer to http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html for details.
  7. Forward all traffic to the Internet gateway for this route.
  8. Set the route table as the main route table. Refer to the Main Route Tables section in http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html for details.
  9. Create a  subnet on the VPC.  Ensure that the auto-assign IP address attribute is disabled so that this becomes a private subnet. Ensure that the availability zone for this subnet is the same as the one that is used in the public subnet.
  10. Create a NAT gateway on the public subnet. While creating the NAT gateway, create an Elastic IP and assign it to the NAT gateway. Refer to http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html#nat-gateway-creating for details.
  11. Create a route table for the private subnet. This is the NAT route table. Add a route for the NAT table and forward all traffic to the NAT gateway created on the VPC.
  12. Edit the route table subnet association to associate the NAT route table with the private subnet.
  13. Repeat the steps 3 to 12 for each availability zone to create public and private subnets for the availability zone.

The public subnet is accessible through the Internet gateway and the private network is accessible through the NAT gateway.

You can deploy your applications on the private subnet.

Platform9 Managed Kubernetes simplified the process by automating the deployment of a lot of the above components. Refer to
this tutorial
for more details on different networking configurations supported by Managed Kubernetes


June 14, 2017