Using Private EKS API Endpoints with Self-Hosted Spacelift

The Spacelift self-hosted EKS deployment module (terraform-aws-eks-spacelift-selfhosted) sets the EKS API endpoint to public access by default. However, you can configure it to use private-only endpoints to meet your security requirements.

Options for Private EKS API Endpoints

You have two main approaches to deploy Spacelift self-hosted with private EKS API endpoints:

1. Modify the Terraform Module

You can override the default public access setting in the module. The cluster_endpoint_public_access = true setting in eks.tf is not a hard requirement and can be changed to:

• cluster_endpoint_public_access = false

• cluster_endpoint_private_access = true

2. Bring Your Own (BYO) EKS Cluster

You can use a pre-deployed Kubernetes cluster in your environment that already has the private endpoint configuration you need. Spacelift provides a BYO EKS cluster example that demonstrates this approach.

You can find the BYO EKS cluster example in the official repository: terraform-aws-eks-spacelift-selfhosted

Flexible Resource Creation

The Spacelift self-hosted modules are designed with flexibility in mind. Many resources in the modules include create parameters that allow you to use existing infrastructure instead of creating new resources. This includes:

• RDS instances

• VPC

• SQS queues

• EKS clusters

This flexibility allows you to integrate Spacelift self-hosted into your existing infrastructure while maintaining your security policies and requirements.