Skip to content

AWS infrastructure options#

When you deploy child clusters on AWS, MKE 4 uses the Cluster API Provider AWS (CAPA) to provision and manage cluster infrastructure. The spec.infrastructure.configuration block exposes the key CAPA settings — EC2 instance sizing, AMI selection, SSH access, and optional bastion host provisioning — for both control plane and worker nodes. All parameters are optional unless noted; omitting them applies the provider defaults as documented herein.

Example AWS configuration, with all optional parameters#

spec:
  infrastructure:
    provider: aws
    credential: aws-cluster-identity-cred
    controlPlaneNumber: 3
    workersNumber: 3
    configuration:
      sshKeyName: mke4-admin
      publicIP: false
      controlPlane:
        instanceType: m5.xlarge
        iamInstanceProfile: control-plane.cluster-api-provider-aws.sigs.k8s.io
        rootVolumeSize: 64
        imageLookup:
          format: amzn2-ami-hvm*-gp2
          org: "137112412989"
          baseOS: ""
        uncompressedUserData: false
        nonRootVolumes: []
      worker:
        instanceType: m5.large
        iamInstanceProfile: control-plane.cluster-api-provider-aws.sigs.k8s.io
        rootVolumeSize: 64
        imageLookup:
          format: amzn2-ami-hvm*-gp2
          org: "137112412989"
          baseOS: ""
        uncompressedUserData: false
        nonRootVolumes: []
      bastion:
        enabled: true
        disableIngressRules: false
        allowedCIDRBlocks:
          - 10.0.0.0/8
        instanceType: t3.micro
        ami: ""

Top-level configuration parameters#

Parameter                     Type Required Default Description
sshKeyName string no — Name of an existing EC2 key pair to inject into instances. An empty string disables SSH key injection; the parameter itself may also be null.
publicIP boolean no false If true, EC2 instances are assigned a public IP.

Important: Use only when the cluster subnets are public.
controlPlane object no — Sizing, image lookup, and storage configuration for control plane EC2 instances. Refer to controlPlane / worker.
worker object no — Sizing, image lookup, and storage configuration for worker EC2 instances. Refer to controlPlane / worker.
bastion object no — Optional bastion host configuration for accessing the VPC private network. Refer to bastion.

controlPlane / worker (AWS) parameters#

The controlPlane and worker objects are identical in shape.

Parameter                                         Type                     Required Default (control plane / worker)                       Constraints Description
instanceType string no m5.xlarge / m5.large non-empty EC2 instance type. For example, m5.xlarge, m6i.2xlarge.
iamInstanceProfile string no control-plane.cluster-api-provider-aws.sigs.k8s.io / control-plane.cluster-api-provider-aws.sigs.k8s.io non-empty Name of the IAM instance profile attached to the EC2. instance.
rootVolumeSize integer (GiB) no 32 / 32 ≥ 8 Root EBS volume size in GiB. Must be at least 8 and must be ≥ the AMI snapshot. size.
amiID string no "" / "" — Explicit Amazon Machine Image ID to boot from. When empty, the image is resolved through imageLookup.
imageLookup.format string no al2023-ami-*-kernel-*-x86_64 / al2023-ami-*-kernel-*-x86_64 non-empty AMI name pattern used when amiID is unset. The value is ignored if amiID is provided.
imageLookup.org string no 137112412989 / 137112412989 non-empty AWS Organization (account) ID that owns the AMI. The default is Amazon's Amazon-Linux 2 owner ID. Ignored if amiID is provided.
imageLookup.baseOS string no "" / "" — Base OS name to match during AMI lookup, such as ubuntu-22.04. The value is ignored if amiID is provided.
uncompressedUserData boolean no false / false — If true, EC2 user data is sent uncompressed. Cloud-init handles gzip-compressed user data natively; user data stored in AWS Secrets Manager is always gzipped regardless.
nonRootVolumes list of objects no [] / [] — Additional EBS volumes attached to the instance. Each entry follows the CAPA AWSMachineSpec.NonRootVolumes schema (https://pkg.go.dev/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2#AWSMachineSpec.NonRootVolumes).

bastion parameters#

Optional bastion host that the AWS provider can deploy alongside the cluster for SSH ingress into the private VPC.

Parameter                                    Type                Required Default (control plane / worker)      Constraints Description                                   
enabled boolean no false — Master switch. When true, CAPA provisions a bastion instance with a public IP.
disableIngressRules boolean no false Requires allowedCIDRBlocks to be empty When true, CAPA ensures no ingress rules exist in the security group of the bastion. Cannot be combined with non-empty allowedCIDRBlocks.
allowedCIDRBlocks list of strings no [] each entry must be a valid CIDR CIDR blocks allowed to reach the bastion. Sets ingress rules on its security group. Defaults to 0.0.0.0/0 in CAPA when omitted; pass an explicit list to restrict access.
instanceType string no t2.micro — EC2 instance type for the bastion. The CAPA default is t3.micro everywhere except us-east-1, which uses t2.micro; the MKE chart pins t2.micro unless it is overridden.
ami string no "" — Explicit AMI to boot the bastion. When empty, CAPA picks a public AMI.