Enable AWS_VPC_K8S_CNI_EXTERNALSNAT=true

[Nuru]

In order to use a Network Load Balancer with "Preserve Source IP" as Ingress to a Kubernetes service, you need to put the EKS cluster in a private subnet and set AWS_VPC_K8S_CNI_EXTERNALSNAT=true in the aws-node Daemonset. According to AWS, the way to do this is

kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=true

We need some way to set this via Terraform, since it is a required setting.

References

• Traffic from outside VPC does not reach pod aws/amazon-vpc-cni-k8s#1392

[Nuru]

Closing this as not so important now that the underlying problem has been resolved in amazon-vpc-cni-k8s release 1.8.0.