Skip to content

Commit

Permalink
fix: Update image & description for better understandability (#2045)
Browse files Browse the repository at this point in the history
Signed-off-by: Sébastien Allamand <[email protected]>
  • Loading branch information
allamand authored Nov 8, 2024
1 parent 929479b commit 33f9663
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 0 deletions.
29 changes: 29 additions & 0 deletions patterns/vpc-lattice/cross-cluster-pod-communication/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@

This pattern showcases secure multi-cluster communication between two EKS clusters in different VPCs using VPC Lattice with IAM authorization. It illustrates service discovery and highlights how VPC Lattice facilitates communication between services in EKS clusters with overlapping CIDRs, eliminating the need for networking constructs like private NAT Gateways and Transit Gateways.

> You can also find more informations in the [associated blog post](https://aws.amazon.com/blogs/containers/secure-cross-cluster-communication-in-eks-with-vpc-lattice-and-pod-identity-iam-session-tags/)
## Scenario

With this solution we showcase how to configure Amazon VPC Lattice using the AWS Gateway API Controller in order to manage Amazon VPC Lattice resources through native Kubernetes Gateway API objects. This pattern deploys two distinct VPCs each having it's own EKS cluster, which contain an application that will be used to demonstrate cross-cluster communication.
Expand All @@ -11,6 +13,33 @@ The cross-cluster communication will be established through Amazon VPC Lattice,

![vpc-lattice-pattern-environment.png](https://raw.githubusercontent.com/aws-ia/terraform-aws-eks-blueprints/main/patterns/vpc-lattice/cross-cluster-pod-communication/assets/vpc-lattice-pattern-cross-cluster.png)

1. HttpRoute Configuration
- Defines service exposure through VPC Lattice Gateway API
- Specifies routing rules, paths, and backend services
2. Kyverno Policy Implementation
- Injects Envoy SigV4 proxy sidecar
- Automatically signs AWS API requests with AWS credentials
- Ensures secure authentication for service-to-service communication
3. AWS Private Certificate Authority (PCA)
- Issues and manages private certificates
- Validates custom domain names within VPC Lattice
- Enables TLS encryption for internal communications
4. IAM Authentication Policy
- Defines fine-grained access control rules
- Specifies which principals can access which services
- Implements least-privilege security model
5. ExternalDNS Integration
- Monitors Gateway API Controller's DNSEndpoint resources
- Automatically creates and updates DNS records
- Maintains service discovery through Route 53
6. App1 → App2 Communication Flow
- Routes through VPC Lattice service network
- Authenticated via IAM policies
- Encrypted using TLS certificates from Private CA
7. App2 → App1 Communication Flow
- Utilizes bi-directional VPC Lattice connectivity
- Follows same security and authentication patterns
- Maintains consistent service mesh principles


## Deploy
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 33f9663

Please sign in to comment.