Repository navigation
feat: add skipDefaultNatRoute option to subnet groups - #34
Merged
Merged
Conversation
By default every private subnet gets an automatic 0.0.0.0/0 route to the NAT gateway in its own AZ. Add `skipDefaultNatRoute` so a subnet group can opt out and declare its own 0.0.0.0/0 route (e.g. NAT_GATEWAY with a routerId), allowing all AZs of a group to egress via a single NAT gateway. Defaults to false, so existing stacks are unaffected. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
mr-robot-in
approved these changes
Oct 27, 2026
iamkinchit
added a commit
that referenced
this pull request
Oct 27, 2026
smallcase/cdk-vpc-module-go is archived, so the Go publish job fails on every release. Because the GitHub release job needs all publishers to succeed, no git tag or GitHub release is created, projen recomputes the same version each time, and npm rejects the duplicate (0.0.23). That blocks every new release, including skipDefaultNatRoute (#34). Remove publishToGo and regenerate the projen files (release/build workflows, package:go task, mergify check). Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
iamkinchit
added a commit
that referenced
this pull request
Oct 27, 2026
Add usage docs for the skipDefaultNatRoute option added in #34 (pin a subnet group's egress to a single NAT gateway). This is a releasable commit so the release workflow cuts 0.0.24, which carries #34 and #35; npm 0.0.23 predates them and cannot be republished. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an optional
skipDefaultNatRouteflag to subnet group props (ISubnetsProps). When true, the group's private subnets are left out ofnatProvider.configureNat, so they do not get the automatic0.0.0.0/0route to the same-AZ NAT gateway.Why
Needed for the sc-stag-tool EKS POC: a Karpenter node pool spread across all AZs whose route tables must all egress through a single NAT gateway. The group declares its own
0.0.0.0/0route (RouterType.NAT_GATEWAY+routerId) instead. Without this flag, the automatic route and the explicit one would collide (AlreadyExists).Compatibility
Defaults to
false: no change for existing stacks.API.mdis regenerated by the build.Known issue (not part of this PR)
The release workflow's Go publish step currently fails (
GO_GITHUB_TOKEN: could not read Password), which blocks the git tag and GitHub release. Not addressed here.🤖 Generated with Claude Code