Networking

VPC # ✅ Working

Creates and manages a VPC with DNS settings, instance tenancy, optional IPv6 CIDR block, and secondary IPv4 CIDRs. Secondary CIDRs are reconciled on every sync — missing ones are added, removed ones are disassociated.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: VPC
metadata:
  name: prod-vpc
  namespace: networking
spec:
  cidrBlock: 10.0.0.0/16
  enableDnsSupport: true
  enableDnsHostnames: true
  assignIpv6CidrBlock: true
  secondaryIPv4CIDRs:
    - 100.64.0.0/16
  tags:
    env: prod
    team: platform

Notes

• cidrBlock is immutable after creation. To change it, delete and recreate the VPC (and all dependent resources).
• instanceTenancy is immutable after creation.
• secondaryIPv4CIDRs are reconciled on every sync — adding entries associates the CIDR, removing entries disassociates it from the VPC.

Deletion

Subnet # ✅ Working

Creates a subnet within a VPC. The controller waits for the referenced VPC CR to be Ready before creating the subnet.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: Subnet
metadata:
  name: prod-public-subnet-1a
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  cidrBlock: 10.0.1.0/24
  availabilityZone: us-east-1a
  mapPublicIpOnLaunch: true
  tags:
    env: prod
    type: public
    kubernetes.io/role/elb: "1"

Notes

• cidrBlock is immutable after creation.
• The controller waits for the VPC CR to be Ready before creating the subnet. If the VPC CR is not Ready, the subnet CR will have reason: DependencyNotReady.

Deletion

InternetGateway # ✅ Working

Creates an Internet Gateway and attaches it to the referenced VPC. Only one IGW can be attached to a VPC at a time.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: InternetGateway
metadata:
  name: prod-igw
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  tags:
    env: prod

Notes

• Maximum one internet gateway per VPC. Creating a second one while the first is attached will result in an error.
• The controller handles both creation and attachment in the same reconcile loop.

Deletion

RouteTable # ✅ Working

Route table with individual route management and subnet associations. Routes and subnet associations are diffed on every reconcile. The local route is never removed.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: RouteTable
metadata:
  name: prod-public-rt
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  routes:
    - destinationCidr: 0.0.0.0/0
      gatewayId: igw-0abc123   # or use InternetGateway CR name via ref
  subnetAssociations:
    - prod-public-subnet-1a
    - prod-public-subnet-1b
  tags:
    env: prod
    type: public
---
apiVersion: aws.konfig.io/v1alpha1
kind: RouteTable
metadata:
  name: prod-private-rt-1a
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  routes:
    - destinationCidr: 0.0.0.0/0
      natGatewayRef: prod-nat-1a   # references NatGateway CR
  subnetAssociations:
    - prod-private-subnet-1a
  tags:
    env: prod
    type: private

Notes

• Routes are diffed on every reconcile — routes in AWS not in spec are deleted; routes in spec not in AWS are created.
• The local route (VPC CIDR → local) is always preserved and never deleted, even if not specified in spec.
• Subnet associations are delta-synced: the controller associates subnets in spec not yet associated, and disassociates subnets removed from spec.
• When using natGatewayRef, the controller waits for the NatGateway CR to be Ready before creating the route.

Deletion

NatGateway # ✅ Working ⏱ async

Creates a NAT gateway in the specified subnet. Public NAT gateways automatically allocate an Elastic IP address. Provisioning takes 1–3 minutes.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: NatGateway
metadata:
  name: prod-nat-1a
  namespace: networking
spec:
  subnetRef:
    name: prod-public-subnet-1a
  connectivityType: public
  tags:
    env: prod
    az: us-east-1a

Notes

• Public NAT gateways allocate a new Elastic IP address automatically. The EIP allocation ID is stored in status.elasticIpAllocationId.
• Private NAT gateways do not allocate an EIP and are used for routing between private subnets.
• connectivityType is immutable after creation.

Deletion

SecurityGroup # ✅ Working

Creates a security group with ingress and egress rules. Rules support IPv4 CIDR, IPv6 CIDR, prefix lists, and references to other security groups — all with per-rule descriptions. Drift detection runs on every reconcile.

Spec

Each SGRule in ingressRules / egressRules supports:

Status

Example — Web Security Group

apiVersion: aws.konfig.io/v1alpha1
kind: SecurityGroup
metadata:
  name: web-sg
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  groupName: web-sg
  description: "Web tier security group"
  ingressRules:
    - protocol: tcp
      fromPort: 443
      toPort: 443
      cidrIpv4: 0.0.0.0/0
      description: "HTTPS from internet"
    - protocol: tcp
      fromPort: 443
      toPort: 443
      cidrIpv6: "::/0"
      description: "HTTPS from internet (IPv6)"
    - protocol: tcp
      fromPort: 80
      toPort: 80
      cidrIpv4: 0.0.0.0/0
      description: "HTTP redirect"
  egressRules:
    - protocol: "-1"
      fromPort: -1
      toPort: -1
      cidrIpv4: 0.0.0.0/0
      description: "All outbound"
  tags:
    env: prod
    tier: web

Example — DB Security Group (SG reference)

apiVersion: aws.konfig.io/v1alpha1
kind: SecurityGroup
metadata:
  name: db-sg
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  groupName: db-sg
  description: "Database tier security group"
  ingressRules:
    - protocol: tcp
      fromPort: 5432
      toPort: 5432
      sourceGroupRef: web-sg    # references SecurityGroup CR
      description: "PostgreSQL from web tier"
  tags:
    env: prod
    tier: db

Notes

• groupName and description are immutable after creation.
• All rules are diffed on every reconcile cycle. Rules present in AWS but not in spec are deleted; rules in spec but not in AWS are created.
• When using sourceGroupRef, the controller waits for the referenced security group CR to be Ready.

Deletion

VPCEndpoint # ✅ Working

Creates Interface or Gateway VPC endpoints for AWS services. Gateway endpoints (S3, DynamoDB) are free; Interface endpoints are billed per hour and per GB.

Spec

Status

Example — S3 Gateway Endpoint

apiVersion: aws.konfig.io/v1alpha1
kind: VPCEndpoint
metadata:
  name: s3-gateway-endpoint
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  serviceName: com.amazonaws.us-east-1.s3
  endpointType: Gateway
  routeTableRefs:
    - prod-private-rt-1a
    - prod-private-rt-1b
  tags:
    env: prod
---
apiVersion: aws.konfig.io/v1alpha1
kind: VPCEndpoint
metadata:
  name: ecr-api-endpoint
  namespace: networking
spec:
  vpcRef:
    name: prod-vpc
  serviceName: com.amazonaws.us-east-1.ecr.api
  endpointType: Interface
  subnetRefs:
    - prod-private-subnet-1a
    - prod-private-subnet-1b
  securityGroupRefs:
    - web-sg
  tags:
    env: prod

Notes

• Gateway endpoints (S3, DynamoDB) are free and add a route to the specified route tables. No ENIs are created.
• Interface endpoints create ENIs in the specified subnets and are billed per hour and per GB of data processed.
• The service name format is always com.amazonaws.<region>.<service>. Run aws ec2 describe-vpc-endpoint-services to discover available services in your region.

Deletion