Skip to content

Commit bbe7af9

Browse files
antonputraantonputra
authored
270 (#486)
* How to Create a Fully Private AWS EKS Cluster? (Client VPN & Resolve Private Route 53 DNS Locally) * Remove tf state
1 parent 13657cf commit bbe7af9

24 files changed

+618
-2
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# New Video - https://youtu.be/s6C-d3SDqoA
1+
# New Video - https://youtu.be/Zv4c4YC-aAM
22

3-
[<img src="assets/269.png?raw=true">](https://youtu.be/s6C-d3SDqoA)
3+
[<img src="assets/270.png?raw=true">](https://youtu.be/Zv4c4YC-aAM)
44

55
# Consulting
66

‎assets/269.png‎

-600 KB
Binary file not shown.

‎assets/270.png‎

145 KB
Loading

‎docs/contents.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,3 +189,4 @@
189189
- [265 - Rust vs C++ Performance: Can Rust Actually Be Faster? (Pt. 2)](../lessons/265)
190190
- [268 - Build a Secure AWS EKS CI/CD Pipeline: Step-by-Step Tutorial (ArgoCD + GitHub Actions)](../lessons/268)
191191
- [269 - Reduce AWS Latency by 200x: Drop from 7ms to 35μs](../lessons/269)
192+
- [270 - How to Create a Fully Private AWS EKS Cluster? (Client VPN & Resolve Private Route 53 DNS Locally)](../lessons/270)

‎lessons/270/README.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# How to Create a Fully Private AWS EKS Cluster? (Client VPN & Resolve Private Route 53 DNS Locally)
2+
3+
You can find tutorial [here](https://youtu.be/Zv4c4YC-aAM).
4+
5+
## Commands
6+
7+
```bash
8+
sudo apt-get update && sudo apt-get -y upgrade
9+
curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/openvpn.gpg
10+
echo "deb [signed-by=/etc/apt/keyrings/openvpn.gpg] http://build.openvpn.net/debian/openvpn/stable $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/openvpn.list
11+
sudo apt-get update
12+
sudo apt-get install -y openvpn
13+
wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.2.4/EasyRSA-3.2.4.tgz
14+
tar -zxf EasyRSA-3.2.4.tgz
15+
sudo mv EasyRSA-3.2.4/ /etc/openvpn/easy-rsa
16+
sudo ln -s /etc/openvpn/easy-rsa/easyrsa /usr/local/bin/
17+
cd /etc/openvpn/easy-rsa
18+
easyrsa init-pki
19+
easyrsa build-ca nopass
20+
easyrsa gen-req openvpn-server nopass
21+
easyrsa sign-req server openvpn-server
22+
openvpn --genkey secret ta.key
23+
sudo vim /etc/sysctl.conf
24+
sudo sysctl -p
25+
sudo iptables -t nat -S
26+
ip route list default
27+
sudo iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o ens5 -j MASQUERADE
28+
sudo apt-get install iptables-persistent
29+
sudo vim /etc/openvpn/server/server.conf
30+
cat /etc/passwd | grep nobody
31+
cat /etc/group | grep nogroup
32+
sudo systemctl start openvpn-server@server
33+
sudo systemctl status openvpn-server@server
34+
sudo systemctl enable openvpn-server@server
35+
journalctl --no-pager --full -u openvpn-server@server -f
36+
easyrsa gen-req example-1 nopass
37+
easyrsa sign-req client example-1
38+
cat /etc/openvpn/easy-rsa/pki/ca.crt
39+
cat /etc/openvpn/easy-rsa/pki/issued/example-1.crt
40+
cat /etc/openvpn/easy-rsa/pki/private/example-1.key
41+
cat /etc/openvpn/easy-rsa/ta.key
42+
netstat -nr -f inet
43+
journalctl --no-pager --full -u openvpn-server@server -f
44+
aws eks update-kubeconfig --name dev-main --region us-east-1
45+
```

‎lessons/270/example-1.ovpn‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
client
2+
dev tun
3+
proto udp
4+
remote 54.234.2.175 1194
5+
resolv-retry infinite
6+
nobind
7+
persist-key
8+
persist-tun
9+
remote-cert-tls server
10+
cipher AES-256-GCM
11+
auth SHA256
12+
key-direction 1
13+
verb 3
14+
15+
; If Linux client do NOT use systemd-resolved
16+
; script-security 2
17+
; up /etc/openvpn/update-resolv-conf
18+
; down /etc/openvpn/update-resolv-conf
19+
20+
; If Linux client do USE systemd-resolved
21+
; script-security 2
22+
; up /etc/openvpn/update-systemd-resolved
23+
; down /etc/openvpn/update-systemd-resolved
24+
; down-pre
25+
; dhcp-option DOMAIN-ROUTE .
26+
27+
<ca>
28+
-----BEGIN CERTIFICATE-----
29+
MIIB/TCCAYKgAwIBAgIUCcT5+o8xHJVpoi2YCa3V/BskWUowCgYIKoZIzj0EAwQw
30+
FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjUxMDE5MDU0NzU1WhcNMzUxMDE3
31+
MDU0NzU1WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTB2MBAGByqGSM49AgEGBSuB
32+
BAAiA2IABMR2w9FWxy5pW2jWkVe7EtjrZtwkOHYFFo4VyQQbwN0HA38i+9MBlhDA
33+
RFMc5S9flpjXVsVM7KaBmUYSSS2J5IxCoS+G4NENaTN/QJ6xG7Pe6V4/2xfFj2Kr
34+
Z9MPy8K3B6OBkDCBjTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRZosPucrOxQywt
35+
CDsgg/otDSQaOjBRBgNVHSMESjBIgBRZosPucrOxQywtCDsgg/otDSQaOqEapBgw
36+
FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0GCFAnE+fqPMRyVaaItmAmt1fwbJFlKMAsG
37+
A1UdDwQEAwIBBjAKBggqhkjOPQQDBANpADBmAjEAnr3hWbjgsjyfQqg/vDUh0ie5
38+
u0kQ1BcBHOfFeufZyF5HqVuiq4HfnfQOk6A+cqcAAjEAvtOWYtxMfr0pzfBLqtp0
39+
TCCAhbLr9lyQkmpAVKwD1to4rkmpPAV3LOkbN5dmn2Q1
40+
-----END CERTIFICATE-----
41+
</ca>
42+
43+
<cert>
44+
-----BEGIN CERTIFICATE-----
45+
MIICCTCCAY6gAwIBAgIQMvm/zKyHXcsJl5IIgFRswDAKBggqhkjOPQQDBDAWMRQw
46+
EgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yNTEwMTkwNTUxMjBaFw0yODAxMjIwNTUx
47+
MjBaMBQxEjAQBgNVBAMMCWV4YW1wbGUtMTB2MBAGByqGSM49AgEGBSuBBAAiA2IA
48+
BEIX/Ez7ii2u54RXvkQHaf7n3iY+NBU2Oy5iwf/FJrzwM7O8mhyMU6uz1DDkwWzA
49+
U11sGQdlSWHMGM7iBDnwW0+ASA9w3FI/YzEc0jxUM2mTZPCW64ECHvThe0gqJo5a
50+
CaOBojCBnzAJBgNVHRMEAjAAMB0GA1UdDgQWBBQMVdmJLkD9/QpEhJXX4NEwPobS
51+
CTBRBgNVHSMESjBIgBRZosPucrOxQywtCDsgg/otDSQaOqEapBgwFjEUMBIGA1UE
52+
AwwLRWFzeS1SU0EgQ0GCFAnE+fqPMRyVaaItmAmt1fwbJFlKMBMGA1UdJQQMMAoG
53+
CCsGAQUFBwMCMAsGA1UdDwQEAwIHgDAKBggqhkjOPQQDBANpADBmAjEArtAEZ7ia
54+
uTMWjUsH1BO3mnSIIDr1aFoW3KxBl/9foCsytNydpZgIhTxTB0bwZfCtAjEAmiBY
55+
t6XxqZ5lAUr+5pesTETecNPmSrMXfolbv0lAnuDKiDp3Qed/mkqSUqZTvmiK
56+
-----END CERTIFICATE-----
57+
</cert>
58+
59+
<key>
60+
-----BEGIN PRIVATE KEY-----
61+
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD90tbIdDRcue04LVST
62+
OOmSox7eRjZh/RhBNG790jzjZq6wj6BwQtAwBMznEEmvaR6hZANiAARCF/xM+4ot
63+
rueEV75EB2n+594mPjQVNjsuYsH/xSa88DOzvJocjFOrs9Qw5MFswFNdbBkHZUlh
64+
zBjO4gQ58FtPgEgPcNxSP2MxHNI8VDNpk2TwluuBAh704XtIKiaOWgk=
65+
-----END PRIVATE KEY-----
66+
</key>
67+
68+
<tls-crypt>
69+
-----BEGIN OpenVPN Static key V1-----
70+
49bd538a3e01410d542c2e32d47e17e3
71+
bb401d5d972db33260c48bf7c9f73e31
72+
673b48fcc7b3f96c6a0419d3d0f0446f
73+
88a7ba7d9b3cf6f52bfc4e4f1b10e914
74+
104355d99d7a58084fcf1bbdd3a5736c
75+
d2a31e86c928b53a5f5d9cd2be7d7356
76+
104ba00bbbd574ad1c43dbdd427f7f91
77+
de9d9bac17fd77ff2e947021e50f6e5a
78+
b877d20918f5f5949e5493f74d8b1133
79+
a1755a19138dd577a787026d8712c17c
80+
0fa9435278bf70b185fd685119793208
81+
b52f6353af25c77bebd18d65d781617e
82+
b9b05b436c71cde183006a85d9cd1942
83+
82035d35e94928870f6b8e672f44e384
84+
cc3969e6e5552dae20639eefd9974731
85+
585596a32209a8a98fcf00bdd80491a0
86+
-----END OpenVPN Static key V1-----
87+
</tls-crypt>

‎lessons/270/server.conf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Port for OpenVPN
2+
port 1194
3+
# Protocol, can be tcp or udp
4+
proto udp
5+
# It will create a routed IP tunnel
6+
dev tun
7+
# Location of the Certificate Authority
8+
ca /etc/openvpn/easy-rsa/pki/ca.crt
9+
# Location of the OpenVPN certificate
10+
cert /etc/openvpn/easy-rsa/pki/issued/openvpn-server.crt
11+
# Location of the OpenVPN private key
12+
key /etc/openvpn/easy-rsa/pki/private/openvpn-server.key
13+
# Disable Diffie Hellman since we are using elliptic curves
14+
dh none
15+
# Location of the ta secret that used it is used as an additional HMAC signature
16+
# to all SSL/TLS handshake packets for integrity verification.
17+
tls-crypt /etc/openvpn/easy-rsa/ta.key 0
18+
# Cipher to use
19+
cipher AES-256-GCM
20+
# Auth used to authenticate received packets
21+
auth SHA256
22+
# Configure server mode and supply a VPN subnet
23+
# for OpenVPN to draw client addresses from.
24+
server 10.8.0.0 255.255.255.0
25+
# Location to save records of client <-> virtual IP address
26+
ifconfig-pool-persist /var/log/openvpn/ipp.txt
27+
# ping-like messages to be sent back and forth to check the status
28+
keepalive 10 120
29+
# Used reduce the OpenVPN daemon's privileges after initialization
30+
user nobody
31+
group nogroup
32+
# Persist certain options that may no longer be available because of the privilege downgrade
33+
persist-key
34+
persist-tun
35+
# Shows current connections
36+
status /var/log/openvpn/openvpn-status.log
37+
# Log verbosity
38+
verb 3
39+
# Notify the client when the server restarts so it can automatically reconnect
40+
explicit-exit-notify 1
41+
# Network topology
42+
topology subnet
43+
44+
# Push route from AWS (private subnet az1), 10.0.0.0/19
45+
push "route 10.0.0.0 255.255.224.0"
46+
# Push route from AWS (private subnet az1), 10.0.32.0/19
47+
push "route 10.0.32.0 255.255.224.0"
48+
49+
# Push AWS name server since we want to use private hosted zones
50+
# (Optional) if 10.0.0.2 is not included in routes
51+
# push "route 10.0.0.2 255.255.255.255"
52+
push "dhcp-option DNS 10.0.0.2"
53+
54+
# (Optional) Location of the Revoked Certificates (Example)
55+
# crl-verify /etc/openvpn/easy-rsa/pki/crl.pem

‎lessons/270/terraform/0-locals.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
locals {
2+
env = "dev"
3+
4+
region = "us-east-1"
5+
az1 = "us-east-1a"
6+
az2 = "us-east-1b"
7+
8+
vpc_cidr = "10.0.0.0/16"
9+
10+
private_subnet_az1_cidr = "10.0.0.0/19"
11+
private_subnet_az2_cidr = "10.0.32.0/19"
12+
public_subnet_az1_cidr = "10.0.64.0/19"
13+
public_subnet_az2_cidr = "10.0.96.0/19"
14+
15+
eks_cluster_name = "main"
16+
eks_version = "1.34"
17+
}

‎lessons/270/terraform/1-providers.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
5+
terraform {
6+
required_version = ">= 1.0"
7+
8+
required_providers {
9+
aws = {
10+
source = "hashicorp/aws"
11+
version = "~> 6.0"
12+
}
13+
}
14+
}

‎lessons/270/terraform/10-eks-sg.tf.bac‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
resource "aws_vpc_security_group_ingress_rule" "eks_allow_443_from_openvpn" {
2+
security_group_id = aws_eks_cluster.eks.vpc_config[0].cluster_security_group_id
3+
referenced_security_group_id = aws_security_group.openvpn.id
4+
5+
from_port = 443
6+
to_port = 443
7+
ip_protocol = "tcp"
8+
9+
tags = {
10+
Name = "eks-allow-443-from-openvpn"
11+
}
12+
}

0 commit comments

Comments
 (0)