Configuring virtual network

This guide walks you through setting up the AWS networking infrastructure required to deploy Adeptia Automate on an Amazon EKS (Elastic Kubernetes Service) cluster. By the end of this guide, you will have:

• A VPC with public and/or private subnets, routing, and internet access.
• A Security Group configured to allow your EKS cluster to communicate with your database and file storage.

---

Prerequisites

Ensure the following are in place before you begin:

• An AWS account with sufficient permissions to create VPCs, subnets, security groups, and NAT Gateways. At minimum, your IAM user or role should have the AmazonVPCFullAccess policy attached.
• You are working in the correct AWS region where you plan to deploy your EKS cluster. All resources created in this guide must be in the same region.

---

Step 1: Create the VPC and Network Resources

AWS provides a guided wizard (VPC and More) that creates the VPC, subnets, route tables, and gateways together in a single flow.

Steps

1. Open the AWS Console and navigate to VPC Dashboard → Your VPCs.
2. Click "Create VPC" and select "VPC and More". This mode creates all associated resources — subnets, route tables, and gateways — together in a single flow, rather than requiring you to set up each one individually.
3. Enter a descriptive name for your VPC (For example, adeptia-vpc). The VPC is your private, isolated network boundary on AWS — all your EKS nodes, databases, and storage will live inside it.
4. Set the IPv4 CIDR block. This defines the total IP address range available across all your subnets — choose a range large enough to accommodate your EKS nodes, pods, and other resources (For example, 10.0.0.0/16).
5. Leave IPv6 as "No IPv6 CIDR block" and Tenancy as "Default".
6. Set the number of Availability Zones (AZs). Each AZ is an independent data center — spreading resources across AZs means your deployment stays available if one goes down. Keep in mind:
   • More AZs improve fault tolerance but increase cost, since resources like NAT Gateways are replicated per AZ.
   • A minimum of 2 AZs is recommended for any production deployment.
7. Set the number of public and private subnets. Subnets are subdivisions of your VPC. As a general rule, plan for one subnet per AZ per tier:
   • Public subnet deployment: Create at least 1 public subnet per AZ; private subnets are optional.
   • Private subnet deployment: Create at least 1 private subnet per AZ; public subnets are still needed for load balancers.
8. Configure the NAT Gatewaybased on your deployment:

   • Public subnet deployment: Select "None" — a NAT Gateway is not needed.

   • Private subnet deployment: Select "In 1 AZ" for standard deployments, or "1 per AZ" if high availability is a requirement.

     	A public subnet is internet-facing — resources deployed in it are directly reachable from the internet. A private subnet is isolated — resources cannot be reached from the internet directly. If deploying in a private subnet, a NAT Gateway is required to enable outbound internet access for your nodes (For example, for pulling container images).

9. Leave VPC Endpoint as "None" and DNS options as default.
10. Review the resource summary shown by the wizard — it should list your VPC, subnets, route tables, and an Internet Gateway (plus a NAT Gateway if selected).
11. Click "Create VPC" and wait for all resources to reach the "Available" state. This typically takes 1–2 minutes.

Additional step for public subnet deployments only

For EKS nodes in a public subnet to receive a publicly routable IP address on launch, you must enable automatic public IP assignment on each public subnet:

1. In the VPC Dashboard, go to Subnets.
2. Select a public subnet, click Actions → Edit subnet settings.
3. Check "Enable auto-assign public IPv4 address" and click Save.
4. Repeat for each public subnet.

Verification

Once complete, confirm the following in your VPC Dashboard:

• Your VPC appears with status "Available".
• Your subnets appear and are associated with your VPC.
• An Internet Gateway is listed under Internet Gateways and shows as "Attached" to your VPC.
• (Private deployment only) A NAT Gateway is listed with status "Available".

---

Step 2: Configure the Security Group

A security group acts as a virtual firewall, controlling what network traffic is allowed to reach your resources. You need to configure the Default VPC Security Group so that your EKS workloads can communicate with your database and shared file storage.

	EKS automatically creates and manages its own security group when you create your cluster, and the AWS Load Balancer Controller manages load balancer security groups. You do not need to create or modify these — they are handled automatically.

Steps

1. In the AWS Console, navigate to VPC Dashboard → Security Groups.

2. Find the security group named "default" associated with your newly created VPC.

3. Select it, then click Actions → Edit inbound rules.

4. Add the following rules:

   Type	Protocol	Port	Source	When to add
   All Traffic	All	All	Self (this security group's ID)	Always
   MySQL/Aurora	TCP	3306	EKS Security Group ID	Always
   HTTPS	TCP	443	EKS Security Group ID	Always
   NFS	TCP	2049	EKS Security Group ID	Always
   RDP	TCP	3389	Your IP address	Only if using a Windows jump-box

Once you have configured the AWS networking infrastructure, provision the EKS cluster.