A Virtual Private Cloud (VPC) is an isolated network environment within AWS.

AWS VPC provides complete control over networking configuration, including:

  • IP address ranges
  • Subnets
  • Routing tables
  • Network gateways

For SystemLink Enterprise deployments, a properly configured VPC is essential for security, scalability, and network isolation.

Configure your VPC to isolate compute and storage infrastructure on private subnets, separate from internet-facing gateways and load balancers. This configuration follows cloud security best practices and ensures that sensitive workloads are not directly accessible from the internet.

For a general reference of the architecture, refer to the AWS SystemLink Enterprise Kubernetes Architecture Diagram.

Subnet Architecture

Configure your VPC with both public and private subnets to separate internet-facing components from internal infrastructure.

Deploy the following components in private subnets with no direct internet access:

  • EKS cluster nodes: Worker nodes hosting SystemLink Enterprise pods, including web services, web applications, and supporting infrastructure.
  • Databases: Amazon RDS instances for PostgreSQL, or self-managed database instances.
  • VPC Endpoints for S3: Use VPC gateway endpoints to give private subnets direct access to Amazon S3 without sending traffic over the internet.

Deploy the following components in public subnets with internet gateway access:

  • Application Load Balancers (ALB): Internet-facing load balancers for HTTPS traffic to the SystemLink web application and API
  • Network Load Balancers (NLB): TCP load balancers for Salt Master traffic (ports 4505 and 4506)
  • NAT Gateways: Enable outbound internet access for resources in private subnets.

CIDR Block Planning

Plan your VPC CIDR blocks to ensure sufficient IP addresses for SystemLink Enterprise and future growth.

  • Recommended VPC size: /16 CIDR block (65,536 IP addresses) provides flexibility for scaling
  • Minimum VPC size: /20 CIDR block (4,096 IP addresses) for smaller to medium size deployments

Allocate subnets based on the following considerations:

  • Private subnets for EKS nodes: Size based on maximum expected node count. Each EKS node requires one IP address from the subnet CIDR.
  • Private subnets for pods: If using custom networking or VPC CNI custom mode, allocate additional subnets for pod IP addresses. Each pod requires its own IP address.
    • Start with the default VPC CNI configuration where pods share node subnets unless you have specific requirements for pod-level network isolation.
    • Monitor IP utilization carefully. Each node can consume 10-100+ IP addresses depending on the EC2 instance type.
    • Plan for growth. Ensure subnet sizing can support significant scaling of your workload.
  • Public subnets: Smaller allocation, such as /24 is sufficient for load balancers and NAT gateways.
  • Multi-AZ deployment: Create subnet pairs (public/private) in at least two availability zones for high availability.
Table 60. Example CIDR Allocation (VPC Using 10.0.0.0/16)
Subnet Type Availability Zone CIDR Block Available IPs
Private (EKS nodes) us-east-1a 10.0.0.0/19 8,192
Private (EKS nodes) us-east-1b 10.0.32.0/19 8,192
Private (Databases) us-east-1a 10.0.64.0/24 256
Private (Databases) us-east-1b 10.0.65.0/24 256
Public us-east-1a 10.0.128.0/24 256
Public us-east-1b 10.0.129.0/24 256
Note AWS reserves the first four IP addresses and the last IP address in each subnet. Plan accordingly when calculating available addresses.

Security Best Practices

Observe the following security best practices when configuring your VPC for SystemLink Enterprise:

  • No direct internet access for compute and storage: All EKS nodes, databases, and internal services must reside in private subnets with no internet gateway route.
  • Traffic flow isolation: Internet traffic flows through the Internet, the public ALB/NLB, the private Kubernetes Ingress Controller (private subnet), and then the private SystemLink services.
  • Outbound internet via NAT: Use NAT Gateways in public subnets to provide outbound internet access for private subnet resources. Deploy one NAT Gateway per availability zone for high availability.
  • VPC endpoints: Use VPC endpoints for AWS services (S3) to avoid internet routing and reduce data transfer costs.
  • Security groups: Configure security groups to allow only necessary traffic between components. Use the principle of least privilege.

Availability Zone Considerations

Deploy SystemLink Enterprise across multiple availability zones for high availability and fault tolerance:

  • Minimum deployment: Use at least two availability zones with subnet pairs in each zone.
  • EKS node groups: Distribute worker nodes across availability zones.
  • Database Multi-AZ: Enable Multi-AZ deployments for RDS PostgreSQL and DocumentDB.
  • Load balancer distribution: Configure ALB and NLB to distribute traffic across subnets in multiple availability zones.