Your Laptop │ │ OpenVPN (UDP:1194) ▼
┌──────────────┐ ┌─────────────────────────────┐
│ OpenVPN EC2 │──────▶ │ EKS Private API (HTTPS:443)│
│ Public │ NAT │ Worker Node 1 │
│ Subnet │Masq. │ Worker Node 2 │
│ │ │ ┌─────────────────────┐ │
│ │───────▶│ │ Grafana (Internal LB)│ │
│ │ │ │ grafana.devops.private│ │
│ │ │ └─────────────────────┘ │
└──────────────┘ └─────────────────────────────┘ Public Subnet Private Subnets
Your Laptop │ │ OpenVPN (UDP:1194) ▼
┌──────────────┐ ┌─────────────────────────────┐
│ OpenVPN EC2 │──────▶ │ EKS Private API (HTTPS:443)│
│ Public │ NAT │ Worker Node 1 │
│ Subnet │Masq. │ Worker Node 2 │
│ │ │ ┌─────────────────────┐ │
│ │───────▶│ │ Grafana (Internal LB)│ │
│ │ │ │ grafana.devops.private│ │
│ │ │ └─────────────────────┘ │
└──────────────┘ └─────────────────────────────┘ Public Subnet Private Subnets
Your Laptop │ │ OpenVPN (UDP:1194) ▼
┌──────────────┐ ┌─────────────────────────────┐
│ OpenVPN EC2 │──────▶ │ EKS Private API (HTTPS:443)│
│ Public │ NAT │ Worker Node 1 │
│ Subnet │Masq. │ Worker Node 2 │
│ │ │ ┌─────────────────────┐ │
│ │───────▶│ │ Grafana (Internal LB)│ │
│ │ │ │ grafana.devops.private│ │
│ │ │ └─────────────────────┘ │
└──────────────┘ └─────────────────────────────┘ Public Subnet Private Subnets
eks-private-vpn/
├── main.tf # VPC, EKS, OpenVPN EC2, Security Groups
├── monitoring.tf # kube-prometheus-stack (Prometheus + Grafana)
├── dns.tf # Route 53 private zone + Grafana CNAME
├── providers.tf # AWS, Helm, Kubernetes providers
├── variables.tf # Input variables
├── outputs.tf # Useful outputs
├── openvpn_userdata.sh # OpenVPN server bootstrap script
└── terraform.tfvars # Your configuration values
eks-private-vpn/
├── main.tf # VPC, EKS, OpenVPN EC2, Security Groups
├── monitoring.tf # kube-prometheus-stack (Prometheus + Grafana)
├── dns.tf # Route 53 private zone + Grafana CNAME
├── providers.tf # AWS, Helm, Kubernetes providers
├── variables.tf # Input variables
├── outputs.tf # Useful outputs
├── openvpn_userdata.sh # OpenVPN server bootstrap script
└── terraform.tfvars # Your configuration values
eks-private-vpn/
├── main.tf # VPC, EKS, OpenVPN EC2, Security Groups
├── monitoring.tf # kube-prometheus-stack (Prometheus + Grafana)
├── dns.tf # Route 53 private zone + Grafana CNAME
├── providers.tf # AWS, Helm, Kubernetes providers
├── variables.tf # Input variables
├── outputs.tf # Useful outputs
├── openvpn_userdata.sh # OpenVPN server bootstrap script
└── terraform.tfvars # Your configuration values
# providers.tf
terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } tls = { source = "hashicorp/tls", version = "~> 4.0" } helm = { source = "hashicorp/helm", version = "~> 2.0" } kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.0" } }
} provider "aws" { region = var.aws_region
} provider "helm" { kubernetes { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] } }
} provider "kubernetes" { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] }
}
# providers.tf
terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } tls = { source = "hashicorp/tls", version = "~> 4.0" } helm = { source = "hashicorp/helm", version = "~> 2.0" } kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.0" } }
} provider "aws" { region = var.aws_region
} provider "helm" { kubernetes { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] } }
} provider "kubernetes" { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] }
}
# providers.tf
terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } tls = { source = "hashicorp/tls", version = "~> 4.0" } helm = { source = "hashicorp/helm", version = "~> 2.0" } kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.0" } }
} provider "aws" { region = var.aws_region
} provider "helm" { kubernetes { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] } }
} provider "kubernetes" { host = module.eks.cluster_endpoint cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) exec { api_version = "client.authentication.k8s.io/v1beta1" command = "aws" args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", var.aws_region] }
}
# main.tf
module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "~> 5.0" name = "${var.project_name}-vpc" cidr = var.vpc_cidr # 10.0.0.0/16 azs = var.availability_zones # ["us-east-1a", "us-east-1b"] private_subnets = var.private_subnet_cidrs # ["10.0.1.0/24", "10.0.2.0/24"] public_subnets = var.public_subnet_cidrs # ["10.0.101.0/24", "10.0.102.0/24"] enable_nat_gateway = true single_nat_gateway = true enable_dns_hostnames = true enable_dns_support = true # Required tags for EKS load balancer discovery public_subnet_tags = { "kubernetes.io/role/elb" = "1" } private_subnet_tags = { "kubernetes.io/role/internal-elb" = "1" }
}
# main.tf
module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "~> 5.0" name = "${var.project_name}-vpc" cidr = var.vpc_cidr # 10.0.0.0/16 azs = var.availability_zones # ["us-east-1a", "us-east-1b"] private_subnets = var.private_subnet_cidrs # ["10.0.1.0/24", "10.0.2.0/24"] public_subnets = var.public_subnet_cidrs # ["10.0.101.0/24", "10.0.102.0/24"] enable_nat_gateway = true single_nat_gateway = true enable_dns_hostnames = true enable_dns_support = true # Required tags for EKS load balancer discovery public_subnet_tags = { "kubernetes.io/role/elb" = "1" } private_subnet_tags = { "kubernetes.io/role/internal-elb" = "1" }
}
# main.tf
module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "~> 5.0" name = "${var.project_name}-vpc" cidr = var.vpc_cidr # 10.0.0.0/16 azs = var.availability_zones # ["us-east-1a", "us-east-1b"] private_subnets = var.private_subnet_cidrs # ["10.0.1.0/24", "10.0.2.0/24"] public_subnets = var.public_subnet_cidrs # ["10.0.101.0/24", "10.0.102.0/24"] enable_nat_gateway = true single_nat_gateway = true enable_dns_hostnames = true enable_dns_support = true # Required tags for EKS load balancer discovery public_subnet_tags = { "kubernetes.io/role/elb" = "1" } private_subnet_tags = { "kubernetes.io/role/internal-elb" = "1" }
}
module "eks" { source = "terraform-aws-modules/eks/aws" version = "~> 20.0" cluster_name = "${var.project_name}-cluster" cluster_version = var.kubernetes_version # "1.31" vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.private_subnets # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # THE TWO SETTINGS THAT MAKE THIS PRIVATE cluster_endpoint_public_access = false cluster_endpoint_private_access = true # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # Required in EKS module v20+ — without this, kubectl fails enable_cluster_creator_admin_permissions = true eks_managed_node_groups = { default = { instance_types = var.node_instance_types # ["t3.medium"] min_size = var.node_min_size # 1 max_size = var.node_max_size # 3 desired_size = var.node_desired_size # 2 } }
}
module "eks" { source = "terraform-aws-modules/eks/aws" version = "~> 20.0" cluster_name = "${var.project_name}-cluster" cluster_version = var.kubernetes_version # "1.31" vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.private_subnets # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # THE TWO SETTINGS THAT MAKE THIS PRIVATE cluster_endpoint_public_access = false cluster_endpoint_private_access = true # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # Required in EKS module v20+ — without this, kubectl fails enable_cluster_creator_admin_permissions = true eks_managed_node_groups = { default = { instance_types = var.node_instance_types # ["t3.medium"] min_size = var.node_min_size # 1 max_size = var.node_max_size # 3 desired_size = var.node_desired_size # 2 } }
}
module "eks" { source = "terraform-aws-modules/eks/aws" version = "~> 20.0" cluster_name = "${var.project_name}-cluster" cluster_version = var.kubernetes_version # "1.31" vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.private_subnets # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # THE TWO SETTINGS THAT MAKE THIS PRIVATE cluster_endpoint_public_access = false cluster_endpoint_private_access = true # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # Required in EKS module v20+ — without this, kubectl fails enable_cluster_creator_admin_permissions = true eks_managed_node_groups = { default = { instance_types = var.node_instance_types # ["t3.medium"] min_size = var.node_min_size # 1 max_size = var.node_max_size # 3 desired_size = var.node_desired_size # 2 } }
}
resource "aws_security_group_rule" "vpn_to_eks_api" { description = "Allow VPN server to access EKS API" type = "ingress" from_port = 443 to_port = 443 protocol = "tcp" security_group_id = module.eks.cluster_security_group_id source_security_group_id = aws_security_group.vpn.id
}
resource "aws_security_group_rule" "vpn_to_eks_api" { description = "Allow VPN server to access EKS API" type = "ingress" from_port = 443 to_port = 443 protocol = "tcp" security_group_id = module.eks.cluster_security_group_id source_security_group_id = aws_security_group.vpn.id
}
resource "aws_security_group_rule" "vpn_to_eks_api" { description = "Allow VPN server to access EKS API" type = "ingress" from_port = 443 to_port = 443 protocol = "tcp" security_group_id = module.eks.cluster_security_group_id source_security_group_id = aws_security_group.vpn.id
}
data "aws_ami" "ubuntu" { most_recent = true owners = ["099720109477"] # Canonical filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] }
} resource "aws_security_group" "vpn" { name_prefix = "${var.project_name}-vpn-" vpc_id = module.vpc.vpc_id description = "OpenVPN server security group" # OpenVPN — open to the world (authentication via certificates) ingress { description = "OpenVPN" from_port = 1194 to_port = 1194 protocol = "udp" cidr_blocks = ["0.0.0.0/0"] } # SSH — restricted to your IP only ingress { description = "SSH" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = [var.admin_ingress_cidr] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } lifecycle { create_before_destroy = true }
} resource "aws_instance" "vpn" { ami = data.aws_ami.ubuntu.id instance_type = var.openvpn_instance_type # t3.small key_name = var.ssh_key_name subnet_id = module.vpc.public_subnets[0] vpc_security_group_ids = [aws_security_group.vpn.id] associate_public_ip_address = true source_dest_check = false # ← Critical for VPN routing! root_block_device { volume_size = 20 volume_type = "gp3" } user_data = templatefile("${path.module}/openvpn_userdata.sh", { vpc_cidr = var.vpc_cidr vpn_client_cidr = var.vpn_client_cidr }) tags = { Name = "${var.project_name}-openvpn" }
} resource "aws_eip" "vpn" { instance = aws_instance.vpn.id domain = "vpc" tags = { Name = "${var.project_name}-vpn-eip" }
}
data "aws_ami" "ubuntu" { most_recent = true owners = ["099720109477"] # Canonical filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] }
} resource "aws_security_group" "vpn" { name_prefix = "${var.project_name}-vpn-" vpc_id = module.vpc.vpc_id description = "OpenVPN server security group" # OpenVPN — open to the world (authentication via certificates) ingress { description = "OpenVPN" from_port = 1194 to_port = 1194 protocol = "udp" cidr_blocks = ["0.0.0.0/0"] } # SSH — restricted to your IP only ingress { description = "SSH" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = [var.admin_ingress_cidr] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } lifecycle { create_before_destroy = true }
} resource "aws_instance" "vpn" { ami = data.aws_ami.ubuntu.id instance_type = var.openvpn_instance_type # t3.small key_name = var.ssh_key_name subnet_id = module.vpc.public_subnets[0] vpc_security_group_ids = [aws_security_group.vpn.id] associate_public_ip_address = true source_dest_check = false # ← Critical for VPN routing! root_block_device { volume_size = 20 volume_type = "gp3" } user_data = templatefile("${path.module}/openvpn_userdata.sh", { vpc_cidr = var.vpc_cidr vpn_client_cidr = var.vpn_client_cidr }) tags = { Name = "${var.project_name}-openvpn" }
} resource "aws_eip" "vpn" { instance = aws_instance.vpn.id domain = "vpc" tags = { Name = "${var.project_name}-vpn-eip" }
}
data "aws_ami" "ubuntu" { most_recent = true owners = ["099720109477"] # Canonical filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] }
} resource "aws_security_group" "vpn" { name_prefix = "${var.project_name}-vpn-" vpc_id = module.vpc.vpc_id description = "OpenVPN server security group" # OpenVPN — open to the world (authentication via certificates) ingress { description = "OpenVPN" from_port = 1194 to_port = 1194 protocol = "udp" cidr_blocks = ["0.0.0.0/0"] } # SSH — restricted to your IP only ingress { description = "SSH" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = [var.admin_ingress_cidr] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } lifecycle { create_before_destroy = true }
} resource "aws_instance" "vpn" { ami = data.aws_ami.ubuntu.id instance_type = var.openvpn_instance_type # t3.small key_name = var.ssh_key_name subnet_id = module.vpc.public_subnets[0] vpc_security_group_ids = [aws_security_group.vpn.id] associate_public_ip_address = true source_dest_check = false # ← Critical for VPN routing! root_block_device { volume_size = 20 volume_type = "gp3" } user_data = templatefile("${path.module}/openvpn_userdata.sh", { vpc_cidr = var.vpc_cidr vpn_client_cidr = var.vpn_client_cidr }) tags = { Name = "${var.project_name}-openvpn" }
} resource "aws_eip" "vpn" { instance = aws_instance.vpn.id domain = "vpc" tags = { Name = "${var.project_name}-vpn-eip" }
}
#!/bin/bash
set -euo pipefail
exec > /var/log/openvpn-setup.log 2>&1 export DEBIAN_FRONTEND=noninteractive
apt-get update -y && apt-get upgrade -y # Pre-seed iptables-persistent to avoid interactive prompts
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt-get install -y -o Dpkg::Options::='--force-confdef' \ -o Dpkg::Options::='--force-confold' openvpn easy-rsa iptables-persistent # Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p # ── PKI setup ──────────────────────────────────────────────────────
EASY_RSA="/etc/openvpn/easy-rsa"
mkdir -p "$EASY_RSA"
cp -r /usr/share/easy-rsa/* "$EASY_RSA/"
cd "$EASY_RSA" ./easyrsa init-pki
EASYRSA_BATCH=1 ./easyrsa build-ca nopass
EASYRSA_BATCH=1 ./easyrsa build-server-full server nopass
EASYRSA_BATCH=1 ./easyrsa build-client-full client1 nopass
./easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/ta.key cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/ # ── Server config ─────────────────────────────────────────────────
cat > /etc/openvpn/server.conf <<'EOF'
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/ta.key 0 server ${vpn_client_cidr} 255.255.255.0
topology subnet push "route ${vpc_cidr} 255.255.0.0"
push "dhcp-option DNS 10.0.0.2" keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
EOF # ── NAT / forwarding rules ────────────────────────────────────────
PRIMARY_IF=$(ip route | grep default | awk '{print $5}')
iptables -t nat -A POSTROUTING -s ${vpn_client_cidr}/24 \ -o "$PRIMARY_IF" -j MASQUERADE
iptables -A FORWARD -i tun0 -o "$PRIMARY_IF" -j ACCEPT
iptables -A FORWARD -i "$PRIMARY_IF" -o tun0 \ -m state --state RELATED,ESTABLISHED -j ACCEPT
netfilter-persistent save systemctl enable openvpn@server
systemctl start openvpn@server # ── Generate client .ovpn profile ─────────────────────────────────
PUBLIC_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4 \ || curl -s http://checkip.amazonaws.com)
mkdir -p /home/ubuntu/client-configs cat > /home/ubuntu/client-configs/client1.ovpn <<CLIENTCONF
client
dev tun
proto udp
remote $PUBLIC_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3 <ca>
$(cat /etc/openvpn/ca.crt)
</ca>
<cert>
$(openssl x509 -in "$EASY_RSA/pki/issued/client1.crt")
</cert>
<key>
$(cat "$EASY_RSA/pki/private/client1.key")
</key>
<tls-auth>
$(cat /etc/openvpn/ta.key)
</tls-auth>
CLIENTCONF chown -R ubuntu:ubuntu /home/ubuntu/client-configs
chmod 600 /home/ubuntu/client-configs/client1.ovpn echo "=== OpenVPN setup complete ==="
#!/bin/bash
set -euo pipefail
exec > /var/log/openvpn-setup.log 2>&1 export DEBIAN_FRONTEND=noninteractive
apt-get update -y && apt-get upgrade -y # Pre-seed iptables-persistent to avoid interactive prompts
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt-get install -y -o Dpkg::Options::='--force-confdef' \ -o Dpkg::Options::='--force-confold' openvpn easy-rsa iptables-persistent # Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p # ── PKI setup ──────────────────────────────────────────────────────
EASY_RSA="/etc/openvpn/easy-rsa"
mkdir -p "$EASY_RSA"
cp -r /usr/share/easy-rsa/* "$EASY_RSA/"
cd "$EASY_RSA" ./easyrsa init-pki
EASYRSA_BATCH=1 ./easyrsa build-ca nopass
EASYRSA_BATCH=1 ./easyrsa build-server-full server nopass
EASYRSA_BATCH=1 ./easyrsa build-client-full client1 nopass
./easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/ta.key cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/ # ── Server config ─────────────────────────────────────────────────
cat > /etc/openvpn/server.conf <<'EOF'
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/ta.key 0 server ${vpn_client_cidr} 255.255.255.0
topology subnet push "route ${vpc_cidr} 255.255.0.0"
push "dhcp-option DNS 10.0.0.2" keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
EOF # ── NAT / forwarding rules ────────────────────────────────────────
PRIMARY_IF=$(ip route | grep default | awk '{print $5}')
iptables -t nat -A POSTROUTING -s ${vpn_client_cidr}/24 \ -o "$PRIMARY_IF" -j MASQUERADE
iptables -A FORWARD -i tun0 -o "$PRIMARY_IF" -j ACCEPT
iptables -A FORWARD -i "$PRIMARY_IF" -o tun0 \ -m state --state RELATED,ESTABLISHED -j ACCEPT
netfilter-persistent save systemctl enable openvpn@server
systemctl start openvpn@server # ── Generate client .ovpn profile ─────────────────────────────────
PUBLIC_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4 \ || curl -s http://checkip.amazonaws.com)
mkdir -p /home/ubuntu/client-configs cat > /home/ubuntu/client-configs/client1.ovpn <<CLIENTCONF
client
dev tun
proto udp
remote $PUBLIC_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3 <ca>
$(cat /etc/openvpn/ca.crt)
</ca>
<cert>
$(openssl x509 -in "$EASY_RSA/pki/issued/client1.crt")
</cert>
<key>
$(cat "$EASY_RSA/pki/private/client1.key")
</key>
<tls-auth>
$(cat /etc/openvpn/ta.key)
</tls-auth>
CLIENTCONF chown -R ubuntu:ubuntu /home/ubuntu/client-configs
chmod 600 /home/ubuntu/client-configs/client1.ovpn echo "=== OpenVPN setup complete ==="
#!/bin/bash
set -euo pipefail
exec > /var/log/openvpn-setup.log 2>&1 export DEBIAN_FRONTEND=noninteractive
apt-get update -y && apt-get upgrade -y # Pre-seed iptables-persistent to avoid interactive prompts
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt-get install -y -o Dpkg::Options::='--force-confdef' \ -o Dpkg::Options::='--force-confold' openvpn easy-rsa iptables-persistent # Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p # ── PKI setup ──────────────────────────────────────────────────────
EASY_RSA="/etc/openvpn/easy-rsa"
mkdir -p "$EASY_RSA"
cp -r /usr/share/easy-rsa/* "$EASY_RSA/"
cd "$EASY_RSA" ./easyrsa init-pki
EASYRSA_BATCH=1 ./easyrsa build-ca nopass
EASYRSA_BATCH=1 ./easyrsa build-server-full server nopass
EASYRSA_BATCH=1 ./easyrsa build-client-full client1 nopass
./easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/ta.key cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/ # ── Server config ─────────────────────────────────────────────────
cat > /etc/openvpn/server.conf <<'EOF'
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/ta.key 0 server ${vpn_client_cidr} 255.255.255.0
topology subnet push "route ${vpc_cidr} 255.255.0.0"
push "dhcp-option DNS 10.0.0.2" keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
EOF # ── NAT / forwarding rules ────────────────────────────────────────
PRIMARY_IF=$(ip route | grep default | awk '{print $5}')
iptables -t nat -A POSTROUTING -s ${vpn_client_cidr}/24 \ -o "$PRIMARY_IF" -j MASQUERADE
iptables -A FORWARD -i tun0 -o "$PRIMARY_IF" -j ACCEPT
iptables -A FORWARD -i "$PRIMARY_IF" -o tun0 \ -m state --state RELATED,ESTABLISHED -j ACCEPT
netfilter-persistent save systemctl enable openvpn@server
systemctl start openvpn@server # ── Generate client .ovpn profile ─────────────────────────────────
PUBLIC_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4 \ || curl -s http://checkip.amazonaws.com)
mkdir -p /home/ubuntu/client-configs cat > /home/ubuntu/client-configs/client1.ovpn <<CLIENTCONF
client
dev tun
proto udp
remote $PUBLIC_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3 <ca>
$(cat /etc/openvpn/ca.crt)
</ca>
<cert>
$(openssl x509 -in "$EASY_RSA/pki/issued/client1.crt")
</cert>
<key>
$(cat "$EASY_RSA/pki/private/client1.key")
</key>
<tls-auth>
$(cat /etc/openvpn/ta.key)
</tls-auth>
CLIENTCONF chown -R ubuntu:ubuntu /home/ubuntu/client-configs
chmod 600 /home/ubuntu/client-configs/client1.ovpn echo "=== OpenVPN setup complete ==="
# monitoring.tf
resource "kubernetes_namespace" "monitoring" { metadata { name = "monitoring" } depends_on = [module.eks]
} resource "helm_release" "kube_prometheus_stack" { name = "kube-prometheus-stack" namespace = kubernetes_namespace.monitoring.metadata[0].name repository = "https://prometheus-community.github.io/helm-charts" chart = "kube-prometheus-stack" version = "65.1.0" # ── Grafana ───────────────────────────────────────────────────── set { name = "grafana.enabled" value = "true" } set { name = "grafana.adminPassword" value = var.grafana_admin_password } set { name = "grafana.service.type" value = "LoadBalancer" } # Internal LB annotations — type = "string" is critical! set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-internal" value = "true" type = "string" } set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-scheme" value = "internal" type = "string" } set { name = "grafana.service.port" value = "80" } # ── Prometheus ────────────────────────────────────────────────── set { name = "prometheus.prometheusSpec.retention" value = "7d" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.accessModes[0]" value = "ReadWriteOnce" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage" value = "20Gi" } depends_on = [module.eks]
}
# monitoring.tf
resource "kubernetes_namespace" "monitoring" { metadata { name = "monitoring" } depends_on = [module.eks]
} resource "helm_release" "kube_prometheus_stack" { name = "kube-prometheus-stack" namespace = kubernetes_namespace.monitoring.metadata[0].name repository = "https://prometheus-community.github.io/helm-charts" chart = "kube-prometheus-stack" version = "65.1.0" # ── Grafana ───────────────────────────────────────────────────── set { name = "grafana.enabled" value = "true" } set { name = "grafana.adminPassword" value = var.grafana_admin_password } set { name = "grafana.service.type" value = "LoadBalancer" } # Internal LB annotations — type = "string" is critical! set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-internal" value = "true" type = "string" } set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-scheme" value = "internal" type = "string" } set { name = "grafana.service.port" value = "80" } # ── Prometheus ────────────────────────────────────────────────── set { name = "prometheus.prometheusSpec.retention" value = "7d" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.accessModes[0]" value = "ReadWriteOnce" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage" value = "20Gi" } depends_on = [module.eks]
}
# monitoring.tf
resource "kubernetes_namespace" "monitoring" { metadata { name = "monitoring" } depends_on = [module.eks]
} resource "helm_release" "kube_prometheus_stack" { name = "kube-prometheus-stack" namespace = kubernetes_namespace.monitoring.metadata[0].name repository = "https://prometheus-community.github.io/helm-charts" chart = "kube-prometheus-stack" version = "65.1.0" # ── Grafana ───────────────────────────────────────────────────── set { name = "grafana.enabled" value = "true" } set { name = "grafana.adminPassword" value = var.grafana_admin_password } set { name = "grafana.service.type" value = "LoadBalancer" } # Internal LB annotations — type = "string" is critical! set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-internal" value = "true" type = "string" } set { name = "grafana.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-scheme" value = "internal" type = "string" } set { name = "grafana.service.port" value = "80" } # ── Prometheus ────────────────────────────────────────────────── set { name = "prometheus.prometheusSpec.retention" value = "7d" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.accessModes[0]" value = "ReadWriteOnce" } set { name = "prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage" value = "20Gi" } depends_on = [module.eks]
}
# dns.tf
resource "aws_route53_zone" "private" { name = "devops.private" vpc { vpc_id = module.vpc.vpc_id } tags = { Name = "${var.project_name}-private-zone" }
} # Read the LB hostname after Helm deploys Grafana
data "kubernetes_service" "grafana" { metadata { name = "kube-prometheus-stack-grafana" namespace = "monitoring" } depends_on = [helm_release.kube_prometheus_stack]
} # CNAME: grafana.devops.private → internal-xxx.elb.amazonaws.com
resource "aws_route53_record" "grafana" { zone_id = aws_route53_zone.private.zone_id name = "grafana.devops.private" type = "CNAME" ttl = 300 records = [ data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname ]
}
# dns.tf
resource "aws_route53_zone" "private" { name = "devops.private" vpc { vpc_id = module.vpc.vpc_id } tags = { Name = "${var.project_name}-private-zone" }
} # Read the LB hostname after Helm deploys Grafana
data "kubernetes_service" "grafana" { metadata { name = "kube-prometheus-stack-grafana" namespace = "monitoring" } depends_on = [helm_release.kube_prometheus_stack]
} # CNAME: grafana.devops.private → internal-xxx.elb.amazonaws.com
resource "aws_route53_record" "grafana" { zone_id = aws_route53_zone.private.zone_id name = "grafana.devops.private" type = "CNAME" ttl = 300 records = [ data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname ]
}
# dns.tf
resource "aws_route53_zone" "private" { name = "devops.private" vpc { vpc_id = module.vpc.vpc_id } tags = { Name = "${var.project_name}-private-zone" }
} # Read the LB hostname after Helm deploys Grafana
data "kubernetes_service" "grafana" { metadata { name = "kube-prometheus-stack-grafana" namespace = "monitoring" } depends_on = [helm_release.kube_prometheus_stack]
} # CNAME: grafana.devops.private → internal-xxx.elb.amazonaws.com
resource "aws_route53_record" "grafana" { zone_id = aws_route53_zone.private.zone_id name = "grafana.devops.private" type = "CNAME" ttl = 300 records = [ data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname ]
}
# variables.tf
variable "aws_region" { default = "us-east-1" }
variable "project_name" { default = "eks-private" }
variable "vpc_cidr" { default = "10.0.0.0/16" }
variable "availability_zones" { default = ["us-east-1a", "us-east-1b"] }
variable "private_subnet_cidrs" { default = ["10.0.1.0/24", "10.0.2.0/24"] }
variable "public_subnet_cidrs" { default = ["10.0.101.0/24", "10.0.102.0/24"] }
variable "kubernetes_version" { default = "1.31" }
variable "node_instance_types" { default = ["t3.medium"] }
variable "node_desired_size" { default = 2 }
variable "node_min_size" { default = 1 }
variable "node_max_size" { default = 3 }
variable "openvpn_instance_type" { default = "t3.small" }
variable "vpn_client_cidr" { default = "10.8.0.0/24" } variable "ssh_key_name" { description = "Name of an existing EC2 key pair" type = string
} variable "admin_ingress_cidr" { description = "Your public IP/32 for SSH access" type = string
} variable "grafana_admin_password" { description = "Admin password for Grafana" type = string sensitive = true default = "admin"
}
# variables.tf
variable "aws_region" { default = "us-east-1" }
variable "project_name" { default = "eks-private" }
variable "vpc_cidr" { default = "10.0.0.0/16" }
variable "availability_zones" { default = ["us-east-1a", "us-east-1b"] }
variable "private_subnet_cidrs" { default = ["10.0.1.0/24", "10.0.2.0/24"] }
variable "public_subnet_cidrs" { default = ["10.0.101.0/24", "10.0.102.0/24"] }
variable "kubernetes_version" { default = "1.31" }
variable "node_instance_types" { default = ["t3.medium"] }
variable "node_desired_size" { default = 2 }
variable "node_min_size" { default = 1 }
variable "node_max_size" { default = 3 }
variable "openvpn_instance_type" { default = "t3.small" }
variable "vpn_client_cidr" { default = "10.8.0.0/24" } variable "ssh_key_name" { description = "Name of an existing EC2 key pair" type = string
} variable "admin_ingress_cidr" { description = "Your public IP/32 for SSH access" type = string
} variable "grafana_admin_password" { description = "Admin password for Grafana" type = string sensitive = true default = "admin"
}
# variables.tf
variable "aws_region" { default = "us-east-1" }
variable "project_name" { default = "eks-private" }
variable "vpc_cidr" { default = "10.0.0.0/16" }
variable "availability_zones" { default = ["us-east-1a", "us-east-1b"] }
variable "private_subnet_cidrs" { default = ["10.0.1.0/24", "10.0.2.0/24"] }
variable "public_subnet_cidrs" { default = ["10.0.101.0/24", "10.0.102.0/24"] }
variable "kubernetes_version" { default = "1.31" }
variable "node_instance_types" { default = ["t3.medium"] }
variable "node_desired_size" { default = 2 }
variable "node_min_size" { default = 1 }
variable "node_max_size" { default = 3 }
variable "openvpn_instance_type" { default = "t3.small" }
variable "vpn_client_cidr" { default = "10.8.0.0/24" } variable "ssh_key_name" { description = "Name of an existing EC2 key pair" type = string
} variable "admin_ingress_cidr" { description = "Your public IP/32 for SSH access" type = string
} variable "grafana_admin_password" { description = "Admin password for Grafana" type = string sensitive = true default = "admin"
}
# outputs.tf
output "openvpn_public_ip" { value = aws_eip.vpn.public_ip
} output "ssh_to_vpn" { value = "ssh -i <your-key.pem> ubuntu@${aws_eip.vpn.public_ip}"
} output "configure_kubectl" { description = "Run after connecting to VPN" value = "aws eks update-kubeconfig --region ${var.aws_region} --name ${module.eks.cluster_name}"
} output "grafana_url" { description = "Grafana URL (accessible only through VPN)" value = "http://grafana.devops.private"
} output "grafana_lb_hostname" { value = data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname
}
# outputs.tf
output "openvpn_public_ip" { value = aws_eip.vpn.public_ip
} output "ssh_to_vpn" { value = "ssh -i <your-key.pem> ubuntu@${aws_eip.vpn.public_ip}"
} output "configure_kubectl" { description = "Run after connecting to VPN" value = "aws eks update-kubeconfig --region ${var.aws_region} --name ${module.eks.cluster_name}"
} output "grafana_url" { description = "Grafana URL (accessible only through VPN)" value = "http://grafana.devops.private"
} output "grafana_lb_hostname" { value = data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname
}
# outputs.tf
output "openvpn_public_ip" { value = aws_eip.vpn.public_ip
} output "ssh_to_vpn" { value = "ssh -i <your-key.pem> ubuntu@${aws_eip.vpn.public_ip}"
} output "configure_kubectl" { description = "Run after connecting to VPN" value = "aws eks update-kubeconfig --region ${var.aws_region} --name ${module.eks.cluster_name}"
} output "grafana_url" { description = "Grafana URL (accessible only through VPN)" value = "http://grafana.devops.private"
} output "grafana_lb_hostname" { value = data.kubernetes_service.grafana.status[0].load_balancer[0].ingress[0].hostname
}
# Create terraform.tfvars
cat > terraform.tfvars <<EOF
aws_region = "us-east-1"
project_name = "eks-private"
ssh_key_name = "your-keypair-name"
admin_ingress_cidr = "YOUR_PUBLIC_IP/32"
grafana_admin_password = "YourSecurePassword"
EOF terraform init
terraform apply
# Create terraform.tfvars
cat > terraform.tfvars <<EOF
aws_region = "us-east-1"
project_name = "eks-private"
ssh_key_name = "your-keypair-name"
admin_ingress_cidr = "YOUR_PUBLIC_IP/32"
grafana_admin_password = "YourSecurePassword"
EOF terraform init
terraform apply
# Create terraform.tfvars
cat > terraform.tfvars <<EOF
aws_region = "us-east-1"
project_name = "eks-private"
ssh_key_name = "your-keypair-name"
admin_ingress_cidr = "YOUR_PUBLIC_IP/32"
grafana_admin_password = "YourSecurePassword"
EOF terraform init
terraform apply
# Get the VPN public IP from outputs
VPN_IP=$(terraform output -raw openvpn_public_ip) # Download the auto-generated client profile
scp -i your-key.pem ubuntu@${VPN_IP}:/home/ubuntu/client-configs/client1.ovpn . # Connect to VPN
sudo openvpn --config client1.ovpn
# Get the VPN public IP from outputs
VPN_IP=$(terraform output -raw openvpn_public_ip) # Download the auto-generated client profile
scp -i your-key.pem ubuntu@${VPN_IP}:/home/ubuntu/client-configs/client1.ovpn . # Connect to VPN
sudo openvpn --config client1.ovpn
# Get the VPN public IP from outputs
VPN_IP=$(terraform output -raw openvpn_public_ip) # Download the auto-generated client profile
scp -i your-key.pem ubuntu@${VPN_IP}:/home/ubuntu/client-configs/client1.ovpn . # Connect to VPN
sudo openvpn --config client1.ovpn
# Route DNS through the VPN tunnel to VPC DNS
sudo resolvectl dns tun0 10.0.0.2
sudo resolvectl domain tun0 "~."
# Route DNS through the VPN tunnel to VPC DNS
sudo resolvectl dns tun0 10.0.0.2
sudo resolvectl domain tun0 "~."
# Route DNS through the VPN tunnel to VPC DNS
sudo resolvectl dns tun0 10.0.0.2
sudo resolvectl domain tun0 "~."
# Configure kubectl
aws eks update-kubeconfig --region us-east-1 --name eks-private-cluster # Verify
kubectl get nodes
# Configure kubectl
aws eks update-kubeconfig --region us-east-1 --name eks-private-cluster # Verify
kubectl get nodes
# Configure kubectl
aws eks update-kubeconfig --region us-east-1 --name eks-private-cluster # Verify
kubectl get nodes
NAME STATUS ROLES AGE VERSION
ip-10-0-1-xxx.ec2.internal Ready <none> 15m v1.31.x
ip-10-0-2-xxx.ec2.internal Ready <none> 15m v1.31.x
NAME STATUS ROLES AGE VERSION
ip-10-0-1-xxx.ec2.internal Ready <none> 15m v1.31.x
ip-10-0-2-xxx.ec2.internal Ready <none> 15m v1.31.x
NAME STATUS ROLES AGE VERSION
ip-10-0-1-xxx.ec2.internal Ready <none> 15m v1.31.x
ip-10-0-2-xxx.ec2.internal Ready <none> 15m v1.31.x
json: cannot unmarshal bool into Go struct field
ObjectMeta.metadata.annotations of type string
json: cannot unmarshal bool into Go struct field
ObjectMeta.metadata.annotations of type string
json: cannot unmarshal bool into Go struct field
ObjectMeta.metadata.annotations of type string - The Kubernetes API has zero internet exposure
- Access is gated through a self-hosted OpenVPN server
- Prometheus + Grafana monitor everything, exposed via an internal load balancer
- Route 53 private DNS gives us grafana.devops.private
- Everything is Terraform — one terraform apply to rule them all - push "route ${vpc_cidr} 255.255.0.0" — tells VPN clients to route all VPC traffic (10.0.0.0/16) through the tunnel
- push "dhcp-option DNS 10.0.0.2" — pushes the VPC DNS resolver to clients. 10.0.0.2 is the Amazon-provided DNS (always VPC CIDR base + 2). This is how grafana.devops.private resolves!
- MASQUERADE — rewrites VPN client source IPs to the server's VPC IP, so EKS and internal services accept the traffic
- DEBIAN_FRONTEND=noninteractive + debconf-set-selections — prevents iptables-persistent from hanging on interactive prompts in user data - Kubernetes cluster health and resource utilization
- Node CPU, memory, disk, and network metrics
- Pod-level resource consumption
- Prometheus self-monitoring - Zero public Kubernetes API exposure
- Self-hosted OpenVPN with automated PKI and client profile generation
- Prometheus + Grafana monitoring via internal load balancer
- Route 53 private DNS — grafana.devops.private
- 100% Terraform — reproducible, version-controlled, auditable - Education Masters in CompSci
- Work SWE Netanel Systems
- Joined Feb 23, 2026
