- Newest
- Most votes
- Most comments
Based on the current information available, it appears that there are still limitations when it comes to directly calling a private EKS cluster endpoint from Step Functions.
While AWS has introduced capabilities for Step Functions to access private endpoints through resource sharing, this functionality may not yet fully extend to private EKS cluster API endpoints. The ability to call private HTTPS services has been improved, but EKS presents unique challenges due to its specific API structure and authentication requirements.
For your use case of calling EKS RunJob from a Step Function workflow when the EKS cluster API endpoint access is set to "Private" only, the most reliable approach currently is still to use an intermediary Lambda function. This Lambda function can be placed within the same VPC as your EKS cluster, allowing it to communicate with the private endpoint.
If you want to explore alternatives, you could consider:
-
Using AWS PrivateLink to create a secure, private connection between your VPC and Amazon EKS. This might allow you to set up an interface endpoint for Amazon EKS, which could potentially be accessed by Step Functions.
-
Investigating if you can use Amazon EventBridge in conjunction with Step Functions to trigger actions in your private EKS cluster. EventBridge supports connections to private endpoints, which might provide a workaround.
-
Exploring the use of AWS VPC Lattice, which can help in securely sharing and accessing resources across VPC boundaries.
However, it's important to note that these alternatives may require additional configuration and might not provide a direct solution for calling EKS RunJob from Step Functions when the cluster is set to private access only.
For the most up-to-date and reliable solution, it's recommended to continue using a Lambda function as an intermediary between Step Functions and your private EKS cluster. This approach, while not as direct, ensures secure and controlled access to your private EKS resources.
Sources
Access the Amazon EKS using AWS PrivateLink - Amazon EKS
VpcConfigRequest - Amazon EKS
Securely share AWS resources across VPC and account boundaries with PrivateLink, VPC Lattice, EventBridge, and Step Functions | AWS News Blog
Hello,
In the article it is mentioned "an Amazon Elastic Kubernetes Service (Amazon EKS) service behind a Network Load Balancer". And this article is using on Amazon VPC Lattice and AWS PrivateLink, hence consider reviewing this article: https://www.eksworkshop.com/docs/networking/vpc-lattice/
After the VPC Lattice is configured for EKS, try to configure Step function with HTTP endpoint as 'Private'
Relevant content
- asked 2 years ago
- asked 5 months ago
[PM for EventBridge/Step Functions here] Correct, the announced integration at re:Invent 2024 is not for the cluster API access, but to access private HTTPS endpoints in Kubernetes clusters, such as web servers behind an NLB/ALB. Can you please reach out to us via your support team so we can set up a meeting to discuss your requirements?
I have raised the support ticket for the same but still struggling to get the answer. How can I contact you? I have a simple question "Is it possible to run a Kubernetes Job from Stepfunction on an EKS cluster whose API server access is set to "Private" only through this new capability launched by AWS in AWS re:Invent December 2024?".
No, and therefore I and the service team like to talk to you :) You can connect me directly (email) with my username then [at] amazon.de
Hi @mgasch - Thanks for your support. I have tried reaching out to you through support ticket but looks like you are on vacation. can you please check if anyone from your team can communicate with me?