https://github.com/edgelesssys/stackit-internal-lb-poc
PoC Repository for an internal-only LB on STACKIT
https://github.com/edgelesssys/stackit-internal-lb-poc
Last synced: 5 months ago
JSON representation
PoC Repository for an internal-only LB on STACKIT
- Host: GitHub
- URL: https://github.com/edgelesssys/stackit-internal-lb-poc
- Owner: edgelesssys
- Created: 2025-04-09T08:59:39.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-04-10T11:20:45.000Z (about 1 year ago)
- Last Synced: 2025-06-18T11:53:31.342Z (about 1 year ago)
- Language: HCL
- Size: 20.5 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# stackit-internal-lb-poc
## Specifying node instance types
One can choose specific instance types for worker and control plane nodes by changing the following local
variables in [main.tf](./main.tf):
- `instance_type_worker`: Instance type for the worker nodes.
- `instance_type_control_plane`: Instance type for the control plane nodes.
> [!IMPORTANT]
> Note that both control plane and worker nodes need to use confidential instance types.
## Specifying node IP range
The IP range for the subnet used by Constellation's nodes can be set through the `cidr_vpc_subnet_nodes`
local variable in [main.tf](./main.tf). It needs to be ensured that this does not interfere with the
`192.168.177.0/24` range used by the STACKIT load balancer. If this range needs to be used by the nodes,
the range for the STACKIT load balancer needs to be adjusted and vice versa.
## Specifying load balancer ACLs
Until STACKIT offers pinning a load balancer to a static private IP address, ACLs should serve as a
workaround for prohibiting public access to the load balancer. In addition to the node and LB subnets,
which always need to be able to reach the load balancer, additional IP ranges that should be able to talk
to the load balancer can be specified through the option `extra_acl` in [main.tf](./main.tf).
The load balancer ACL feature needs to be enabled via the `enable_acl` option.