CloudWiki
Resource

Endpoints

Kubernetes
Kubernetes
An Endpoints resource is an abstraction, linked to a Service, which defines the list of endpoints that actually implement the service.
Terraform Name
terraform
kubernetes_endpoints
Endpoints
attributes:
  • metadata - (Required) Standard endpoints' metadata. For more info see Kubernetes reference
  • subset - (Optional) Set of addresses and ports that comprise a service. Can be repeated multiple times.

Nested Blocks

metadata

Arguments

  • annotations - (Optional) An unstructured key value map stored with the endpoints resource that may be used to store arbitrary metadata.

Note

By default, the provider ignores any annotations whose key names end with kubernetes.io. This is necessary because such annotations can be mutated by server-side components and consequently cause a perpetual diff in the Terraform plan output. If you explicitly specify any such annotations in the configuration template then Terraform will consider these as normal resource attributes and manage them as expected (while still avoiding the perpetual diff problem). For more info see Kubernetes reference

  • generate_name - (Optional) Prefix, used by the server, to generate a unique name ONLY IF the name field has not been provided. This value will also be combined with a unique suffix. For more info see Kubernetes reference
  • labels - (Optional) Map of string keys and values that can be used to organize and categorize (scope and select) the endpoints resource. May match selectors of replication controllers and services.

Note

By default, the provider ignores any labels whose key names end with kubernetes.io. This is necessary because such labels can be mutated by server-side components and consequently cause a perpetual diff in the Terraform plan output. If you explicitly specify any such labels in the configuration template then Terraform will consider these as normal resource attributes and manage them as expected (while still avoiding the perpetual diff problem). For more info see Kubernetes reference

  • name - (Optional) Name of the endpoints resource, must be unique. Cannot be updated. This name should correspond with an accompanying Service resource. For more info see Kubernetes reference
  • namespace - (Optional) Namespace defines the space within which name of the endpoints resource must be unique.

Attributes

  • generation - A sequence number representing a specific generation of the desired state.
  • resource_version - An opaque value that represents the internal version of this endpoints resource that can be used by clients to determine when endpoints resource has changed. For more info see Kubernetes reference
  • uid - The unique in time and space value for this endpoints resource. For more info see Kubernetes reference

subset

Arguments

  • address - (Optional) An IP address block which offers the related ports and is ready to accept traffic. These endpoints should be considered safe for load balancers and clients to utilize. Can be repeated multiple times.
  • not_ready_address - (Optional) A IP address block which offers the related ports but is not currently marked as ready because it have not yet finished starting, have recently failed a readiness check, or have recently failed a liveness check. Can be repeated multiple times.
  • port - (Optional) A port number block available on the related IP addresses. Can be repeated multiple times.

address

Attributes

  • ip - The IP of this endpoint. May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16), or link-local multicast ((224.0.0.0/24).
  • hostname - (Optional) The Hostname of this endpoint.
  • node_name - (Optional) Node hosting this endpoint. This can be used to determine endpoints local to a node.

not_ready_address

Attributes

  • ip - The IP of this endpoint. May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16), or link-local multicast ((224.0.0.0/24).
  • hostname - (Optional) The Hostname of this endpoint.
  • node_name - (Optional) Node hosting this endpoint. This can be used to determine endpoints local to a node.

port

Arguments

  • name - (Optional) The name of this port within the endpoint. All ports within the endpoint must have unique names. Optional if only one port is defined on this endpoint.
  • port - (Required) The port that will be utilized by this endpoint.
  • protocol - (Optional) The IP protocol for this port. Supports TCP and UDP. Default is TCP.

Associating resources with a
Endpoints
Resources do not "belong" to a
Endpoints
Rather, one or more Security Groups are associated to a resource.
Create
Endpoints
via Terraform:
Syntax:

resource "kubernetes_endpoints" "example" {
 metadata {
   name = "terraform-example"
 }

 subset {
   address {
     ip = "10.0.0.4"
   }

   address {
     ip = "10.0.0.5"
   }

   port {
     name     = "http"
     port     = 80
     protocol = "TCP"
   }

   port {
     name     = "https"
     port     = 443
     protocol = "TCP"
   }
 }

 subset {
   address {
     ip = "10.0.1.4"
   }

   address {
     ip = "10.0.1.5"
   }

   port {
     name     = "http"
     port     = 80
     protocol = "TCP"
   }

   port {
     name     = "https"
     port     = 443
     protocol = "TCP"
   }
 }
}

resource "kubernetes_service" "example" {
 metadata {
   name = "${kubernetes_endpoints.example.metadata.0.name}"
 }

 spec {
   port {
     port        = 8080
     target_port = 80
   }

   port {
     port        = 8443
     target_port = 443
   }
 }
}

Create
Endpoints
via CLI:
Parameters:

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: example-abc
 labels:
   kubernetes.io/service-name: example
addressType: IPv4
ports:
 - name: http
   protocol: TCP
   port: 80
endpoints:
 - addresses:
     - "10.1.2.3"
   conditions:
     ready: true
   hostname: pod-1
   nodeName: node-1
   zone: us-west2-a

Example:
aws cost
Costs
Direct Cost
Indirect Cost
No items found.
Best Practices for
Endpoints

Categorized by Availability, Security & Compliance and Cost

Low
Access allowed from VPN
No items found.
Low
Auto Scaling Group not in use
No items found.
Medium
Connections towards DynamoDB should be via VPC endpoints
No items found.
Medium
Container in CrashLoopBackOff state
No items found.
Low
EC2 with GPU capabilities
No items found.
Medium
EC2 with high privileged policies
No items found.
Medium
ECS cluster delete alarm
No items found.
Critical
ECS task with Admin access (*:*)
Medium
ECS task with high privileged policies
No items found.
Critical
EKS cluster delete alarm
No items found.
Medium
ElastiCache cluster delete alarm
No items found.
Medium
Ensure Container liveness probe is configured
No items found.
Medium
Ensure ECS task definition has memory limit
No items found.
Critical
Ensure EMR cluster master nodes are not publicly accessible
No items found.
More from
Kubernetes