Create new eks-nat cloudformation stack and add GH runner

[ronardcaktus]

Prepares the changes necessary for restricting public access to resources in the Philly HIP AWS account.

Run inv deploy.playbook deploy-cf-stack.yml to deploy the stack.

Different attempts to connect to the cluster from non-Public access source allowlist

time kubectl get ns   
Unable to connect to the server: dial tcp 3.213.170.182:443: i/o timeout
kubectl get ns  0.23s user 0.13s system 1% cpu 30.583 total

 > curl -k https://C3219F3CB49E4B1C82CFE8C82A846345.sk1.us-east-1.eks.amazonaws.com
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",
  "reason": "Forbidden",
  "details": {},
  "code": 403
}%                                                        

TODO: Add the Caktus IP to make future connections easier.

Closes:

• https://app.clickup.com/t/8688u1u64

[copelco]

Task linked: CU-8688u1u64 Remove public IPs from philly-hip AWS account

[copelco]

Looks reasonable to me!

I have a vague memory that we can't easily apply this to an existing EKS stack without destroying some resources, but hopefully I'm miss-remembering! How does it look on the ChangeSet approval screen?

[ronardcaktus]

Looks reasonable to me!

I have a vague memory that we can't easily apply this to an existing EKS stack without destroying some resources, but hopefully I'm miss-remembering! How does it look on the ChangeSet approval screen?

It doesn't look too bad. We are contacting the client and asking for a 3 hour time slot just in case things don't go as planned.