Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Amazon EKS
  3. API Docs
  4. VpcCniAddon
Amazon EKS v3.8.1 published on Wednesday, Jan 29, 2025 by Pulumi
pulumi/pulumi-eks

eks.VpcCniAddon

Explore with Pulumi AI

eks logo
Amazon EKS v3.8.1 published on Wednesday, Jan 29, 2025 by Pulumi
pulumi/pulumi-eks

    VpcCniAddon manages the configuration of the Amazon VPC CNI plugin for Kubernetes by leveraging the EKS managed add-on. For more information see: https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html

    Create VpcCniAddon Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new VpcCniAddon(name: string, args: VpcCniAddonArgs, opts?: ComponentResourceOptions);
    @overload
def VpcCniAddon(resource_name: str,
                args: VpcCniAddonArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def VpcCniAddon(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                cluster_name: Optional[str] = None,
                eni_config_label_def: Optional[str] = None,
                cni_configure_rpfilter: Optional[bool] = None,
                external_snat: Optional[bool] = None,
                log_file: Optional[str] = None,
                cni_external_snat: Optional[bool] = None,
                configuration_values: Optional[Mapping[str, Any]] = None,
                custom_network_config: Optional[bool] = None,
                disable_tcp_early_demux: Optional[bool] = None,
                enable_network_policy: Optional[bool] = None,
                enable_pod_eni: Optional[bool] = None,
                enable_prefix_delegation: Optional[bool] = None,
                addon_version: Optional[str] = None,
                warm_prefix_target: Optional[int] = None,
                cluster_version: Optional[str] = None,
                cni_custom_network_cfg: Optional[bool] = None,
                log_level: Optional[str] = None,
                node_port_support: Optional[bool] = None,
                resolve_conflicts_on_create: Optional[ResolveConflictsOnCreate] = None,
                resolve_conflicts_on_update: Optional[ResolveConflictsOnUpdate] = None,
                security_context_privileged: Optional[bool] = None,
                service_account_role_arn: Optional[str] = None,
                tags: Optional[Sequence[Mapping[str, str]]] = None,
                veth_prefix: Optional[str] = None,
                warm_eni_target: Optional[int] = None,
                warm_ip_target: Optional[int] = None,
                eni_mtu: Optional[int] = None)
    func NewVpcCniAddon(ctx *Context, name string, args VpcCniAddonArgs, opts ...ResourceOption) (*VpcCniAddon, error)
    public VpcCniAddon(string name, VpcCniAddonArgs args, ComponentResourceOptions? opts = null)
    public VpcCniAddon(String name, VpcCniAddonArgs args)
public VpcCniAddon(String name, VpcCniAddonArgs args, ComponentResourceOptions options)

    type: eks:VpcCniAddon
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args VpcCniAddonArgs
    The arguments to resource properties.
    opts ComponentResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args VpcCniAddonArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args VpcCniAddonArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args VpcCniAddonArgs
    The arguments to resource properties.
    opts ComponentResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args VpcCniAddonArgs
    The arguments to resource properties.
    options ComponentResourceOptions
    Bag of options to control resource's behavior.

    VpcCniAddon Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The VpcCniAddon resource accepts the following input properties:

    ClusterName string
    The name of the EKS cluster.
    AddonVersion string
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    ClusterVersion string
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    CniConfigureRpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    CniCustomNetworkCfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    CniExternalSnat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    ConfigurationValues Dictionary<string, object>
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    CustomNetworkConfig bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    DisableTcpEarlyDemux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    EnableNetworkPolicy bool

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    EnablePodEni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    EnablePrefixDelegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    EniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    EniMtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    ExternalSnat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    LogFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    LogLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    NodePortSupport bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    ResolveConflictsOnCreate Pulumi.Eks.ResolveConflictsOnCreate
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    ResolveConflictsOnUpdate Pulumi.Eks.ResolveConflictsOnUpdate
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    SecurityContextPrivileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    ServiceAccountRoleArn string

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    Tags List<ImmutableDictionary<string, string>>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    VethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    WarmEniTarget int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    WarmIpTarget int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    WarmPrefixTarget int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    ClusterName string
    The name of the EKS cluster.
    AddonVersion string
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    ClusterVersion string
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    CniConfigureRpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    CniCustomNetworkCfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    CniExternalSnat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    ConfigurationValues map[string]interface{}
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    CustomNetworkConfig bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    DisableTcpEarlyDemux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    EnableNetworkPolicy bool

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    EnablePodEni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    EnablePrefixDelegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    EniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    EniMtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    ExternalSnat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    LogFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    LogLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    NodePortSupport bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    ResolveConflictsOnCreate ResolveConflictsOnCreate
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    ResolveConflictsOnUpdate ResolveConflictsOnUpdate
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    SecurityContextPrivileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    ServiceAccountRoleArn string

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    Tags []map[string]string
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    VethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    WarmEniTarget int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    WarmIpTarget int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    WarmPrefixTarget int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    clusterName String
    The name of the EKS cluster.
    addonVersion String
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    clusterVersion String
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    cniConfigureRpfilter Boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg Boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat Boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    configurationValues Map<String,Object>
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    customNetworkConfig Boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux Boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableNetworkPolicy Boolean

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    enablePodEni Boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation Boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef String

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu Integer

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat Boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    logFile String

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel String

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodePortSupport Boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    resolveConflictsOnCreate ResolveConflictsOnCreate
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    resolveConflictsOnUpdate ResolveConflictsOnUpdate
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    securityContextPrivileged Boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    serviceAccountRoleArn String

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    tags List<Map<String,String>>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vethPrefix String

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget Integer

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget Integer
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget Integer
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    clusterName string
    The name of the EKS cluster.
    addonVersion string
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    clusterVersion string
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    cniConfigureRpfilter boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    configurationValues {[key: string]: any}
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    customNetworkConfig boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableNetworkPolicy boolean

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    enablePodEni boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef string

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu number

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    logFile string

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel string

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodePortSupport boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    resolveConflictsOnCreate ResolveConflictsOnCreate
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    resolveConflictsOnUpdate ResolveConflictsOnUpdate
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    securityContextPrivileged boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    serviceAccountRoleArn string

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    tags {[key: string]: string}[]
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vethPrefix string

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget number

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget number
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget number
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    cluster_name str
    The name of the EKS cluster.
    addon_version str
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    cluster_version str
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    cni_configure_rpfilter bool
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cni_custom_network_cfg bool
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cni_external_snat bool
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    configuration_values Mapping[str, Any]
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    custom_network_config bool

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disable_tcp_early_demux bool
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enable_network_policy bool

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    enable_pod_eni bool
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enable_prefix_delegation bool
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eni_config_label_def str

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eni_mtu int

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    external_snat bool

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    log_file str

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    log_level str

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    node_port_support bool

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    resolve_conflicts_on_create ResolveConflictsOnCreate
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    resolve_conflicts_on_update ResolveConflictsOnUpdate
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    security_context_privileged bool
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    service_account_role_arn str

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    tags Sequence[Mapping[str, str]]
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    veth_prefix str

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warm_eni_target int

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warm_ip_target int
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warm_prefix_target int
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md
    clusterName String
    The name of the EKS cluster.
    addonVersion String
    The version of the addon to use. If not specified, the latest version of the addon for the cluster's Kubernetes version will be used.
    clusterVersion String
    The Kubernetes version of the cluster. This is used to determine the addon version to use if addonVersion is not specified.
    cniConfigureRpfilter Boolean
    Specifies whether ipamd should configure rp filter for primary interface. Default is false.
    cniCustomNetworkCfg Boolean
    Specifies that your pods may use subnets and security groups that are independent of your worker node's VPC configuration. By default, pods share the same subnet and security groups as the worker node's primary interface. Setting this variable to true causes ipamd to use the security groups and VPC subnet in a worker node's ENIConfig for elastic network interface allocation. You must create an ENIConfig custom resource for each subnet that your pods will reside in, and then annotate or label each worker node to use a specific ENIConfig (multiple worker nodes can be annotated or labelled with the same ENIConfig). Worker nodes can only be annotated with a single ENIConfig at a time, and the subnet in the ENIConfig must belong to the same Availability Zone that the worker node resides in. For more information, see CNI Custom Networking in the Amazon EKS User Guide. Default is false
    cniExternalSnat Boolean
    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied. Disable SNAT if you need to allow inbound communication to your pods from external VPNs, direct connections, and external VPCs, and your pods do not need to access the Internet directly via an Internet Gateway. However, your nodes must be running in a private subnet and connected to the internet through an AWS NAT Gateway or another external NAT device. Default is false
    configurationValues Map<Any>
    Custom configuration values for the vpc-cni addon. This object must match the schema derived from describe-addon-configuration.
    customNetworkConfig Boolean

    Specifies that your pods may use subnets and security groups (within the same VPC as your control plane resources) that are independent of your cluster's resourcesVpcConfig.

    Defaults to false.

    disableTcpEarlyDemux Boolean
    Allows the kubelet's liveness and readiness probes to connect via TCP when pod ENI is enabled. This will slightly increase local TCP connection latency.
    enableNetworkPolicy Boolean

    Enables using Kubernetes network policies. In Kubernetes, by default, all pod-to-pod communication is allowed. Communication can be restricted with Kubernetes NetworkPolicy objects.

    See for more information: Kubernetes Network Policies.

    enablePodEni Boolean
    Specifies whether to allow IPAMD to add the vpc.amazonaws.com/has-trunk-attached label to the node if the instance has capacity to attach an additional ENI. Default is false. If using liveness and readiness probes, you will also need to disable TCP early demux.
    enablePrefixDelegation Boolean
    IPAMD will start allocating (/28) prefixes to the ENIs with ENABLE_PREFIX_DELEGATION set to true.
    eniConfigLabelDef String

    Specifies the ENI_CONFIG_LABEL_DEF environment variable value for worker nodes. This is used to tell Kubernetes to automatically apply the ENIConfig for each Availability Zone Ref: https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html (step 5(c))

    Defaults to the official AWS CNI image in ECR.

    eniMtu Number

    Used to configure the MTU size for attached ENIs. The valid range is from 576 to 9001.

    Defaults to 9001.

    externalSnat Boolean

    Specifies whether an external NAT gateway should be used to provide SNAT of secondary ENI IP addresses. If set to true, the SNAT iptables rule and off-VPC IP rule are not applied, and these rules are removed if they have already been applied.

    Defaults to false.

    logFile String

    Specifies the file path used for logs.

    Defaults to "stdout" to emit Pod logs for kubectl logs.

    logLevel String

    Specifies the log level used for logs.

    Defaults to "DEBUG" Valid values: "DEBUG", "INFO", "WARN", "ERROR", or "FATAL".

    nodePortSupport Boolean

    Specifies whether NodePort services are enabled on a worker node's primary network interface. This requires additional iptables rules and that the kernel's reverse path filter on the primary interface is set to loose.

    Defaults to true.

    resolveConflictsOnCreate "NONE" | "OVERWRITE"
    How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.
    resolveConflictsOnUpdate "NONE" | "OVERWRITE" | "PRESERVE"
    How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.
    securityContextPrivileged Boolean
    Pass privilege to containers securityContext. This is required when SELinux is enabled. This value will not be passed to the CNI config by default
    serviceAccountRoleArn String

    The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role.

    For more information, see Amazon EKS node IAM role in the Amazon EKS User Guide.

    Note: To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster in the Amazon EKS User Guide.

    tags List<Map<String>>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vethPrefix String

    Specifies the veth prefix used to generate the host-side veth device name for the CNI.

    The prefix can be at most 4 characters long.

    Defaults to "eni".

    warmEniTarget Number

    Specifies the number of free elastic network interfaces (and all of their available IP addresses) that the ipamD daemon should attempt to keep available for pod assignment on the node.

    Defaults to 1.

    warmIpTarget Number
    Specifies the number of free IP addresses that the ipamD daemon should attempt to keep available for pod assignment on the node.
    warmPrefixTarget Number
    WARM_PREFIX_TARGET will allocate one full (/28) prefix even if a single IP is consumed with the existing prefix. Ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/prefix-and-ip-target.md

    Outputs

    All input properties are implicitly available as output properties. Additionally, the VpcCniAddon resource produces the following output properties:

    Supporting Types

    ResolveConflictsOnCreate, ResolveConflictsOnCreateArgs

    None
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    Overwrite
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.
    ResolveConflictsOnCreateNone
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    ResolveConflictsOnCreateOverwrite
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.
    None
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    Overwrite
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.
    None
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    Overwrite
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.
    NONE
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    OVERWRITE
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.
    "NONE"
    NONEIf the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.
    "OVERWRITE"
    OVERWRITEIf the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.

    ResolveConflictsOnUpdate, ResolveConflictsOnUpdateArgs

    None
    NONEAmazon EKS doesn't change the value. The update might fail.
    Overwrite
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    Preserve
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.
    ResolveConflictsOnUpdateNone
    NONEAmazon EKS doesn't change the value. The update might fail.
    ResolveConflictsOnUpdateOverwrite
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    ResolveConflictsOnUpdatePreserve
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.
    None
    NONEAmazon EKS doesn't change the value. The update might fail.
    Overwrite
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    Preserve
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.
    None
    NONEAmazon EKS doesn't change the value. The update might fail.
    Overwrite
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    Preserve
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.
    NONE
    NONEAmazon EKS doesn't change the value. The update might fail.
    OVERWRITE
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    PRESERVE
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.
    "NONE"
    NONEAmazon EKS doesn't change the value. The update might fail.
    "OVERWRITE"
    OVERWRITEAmazon EKS overwrites the changed value back to the Amazon EKS default value.
    "PRESERVE"
    PRESERVEAmazon EKS preserves the value. If you choose this option, we recommend that you test any field and value changes on a non-production cluster before updating the add-on on your production cluster.

    Package Details

    Repository
    Amazon EKS pulumi/pulumi-eks
    License
    Apache-2.0
    eks logo
    Amazon EKS v3.8.1 published on Wednesday, Jan 29, 2025 by Pulumi
    pulumi/pulumi-eks