{"id":50522,"date":"2025-07-22T02:15:45","date_gmt":"2025-07-22T02:15:45","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=50522"},"modified":"2025-07-22T02:23:38","modified_gmt":"2025-07-22T02:23:38","slug":"aws-eks-how-to-make-eks-api-server-private","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/aws-eks-how-to-make-eks-api-server-private\/","title":{"rendered":"AWS &#8211; EKS &#8211; How to make EKS API Server Private"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"deploying-to-a-private-eks-cluster-using-terraform\">Deploying to a Private EKS Cluster Using Terraform Cloud (TFC)<\/h2>\n\n\n\n<p>By default, Terraform Cloud (TFC) workspaces require network-level access to the EKS API endpoint to deploy workloads or manage clusters. When the EKS API endpoint is <strong>private<\/strong>, it becomes unreachable from the public internet, including TFC. Here are your options for deploying applications to a private EKS cluster from TFC:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. <strong>Use a Network Bridge: AWS VPC Endpoint + PrivateLink<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PrivateLink<\/strong> lets you expose the EKS API as a private service inside your AWS VPC. TFC cannot use this directly, but you can provision a <strong>bastion (jumpbox) EC2 instance<\/strong> or a <strong>client node<\/strong> inside the VPC with access to the private endpoint.<\/li>\n\n\n\n<li>Use an <strong>AWS Session Manager (SSM) tunnel<\/strong> or a self-hosted runner\/agent (see #2 below) running on this bastion to perform EKS operations. TFC connects to the runner, and the runner has private-path-only access to EKS.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">2. <strong>Deploy a Self-Hosted (Agent) Runner in Your AWS VPC<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Terraform Cloud supports <strong>self-hosted agents<\/strong> that can run inside your AWS environment.<\/li>\n\n\n\n<li>Spin up a small EC2 instance (or Fargate task) in a private subnet with permissions scoped for your deployment.<\/li>\n\n\n\n<li>Register this instance as a TFC agent, then run TFC jobs through it. These jobs have network access to your private EKS cluster.<\/li>\n\n\n\n<li>This is the most seamless and secure method as no public access or proxies are exposed.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">3. <strong>Temporary Public Access Only During Deployment<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make the EKS API endpoint public only for the duration of Terraform apply, then revert to private.<\/li>\n\n\n\n<li>This is logistically complex, somewhat insecure, and not recommended for automation but can be used as a short-term workaround.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. <strong>VPN or Direct Peering<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connect your organization&#8217;s internal network and the AWS VPC via <strong>VPN<\/strong> or <strong>VPC Peering<\/strong> so TFC jobs can route to the private API endpoint from a trusted on-premises location (rare, but technically possible).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. <strong>Use a Bastion + SSM Bridge<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set up a bastion host (jumphost) with SSM enabled inside the VPC.<\/li>\n\n\n\n<li>Use [AWS SSM Session Manager] to tunnel traffic from your corporate\/TFC runner to the EKS endpoint.<\/li>\n\n\n\n<li>This pattern is documented by AWS as a secure approach for accessing private EKS clusters for CI\/CD and automation tasks.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Summary Table<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Option<\/th><th>Additional Infra Needed<\/th><th>Security Level<\/th><th>Maint. Overhead<\/th><th>Typical Use Case<\/th><\/tr><\/thead><tbody><tr><td>TFC Agent (self-hosted runner)<\/td><td>EC2 in VPC<\/td><td>High<\/td><td>Moderate<\/td><td>Enterprise, robust CI\/CD<\/td><\/tr><tr><td>PrivateLink &amp; Bastion (jump host)<\/td><td>EC2, PrivateLink<\/td><td>High<\/td><td>High<\/td><td>Strictly isolated clusters<\/td><\/tr><tr><td>Public endpoint (on\/off as needed)<\/td><td>None<\/td><td>Low<\/td><td>Low<\/td><td>Short-term workaround<\/td><\/tr><tr><td>VPN\/Peering<\/td><td>VPN Gateway\/Peering<\/td><td>Varies<\/td><td>High<\/td><td>On-premises CI\/CD bridge<\/td><\/tr><tr><td>Bastion+SSM tunnel<\/td><td>EC2 + AWS SSM<\/td><td>High<\/td><td>Moderate<\/td><td>Secure admin\/CI access<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"recommended-solution\">Recommended Solution<\/h2>\n\n\n\n<p><strong>Deploy a Self-Hosted TFC Agent (Runner) in your AWS VPC<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>This aligns with best practices, giving you private network access to EKS and all AWS resources.<\/li>\n\n\n\n<li>Keeps your EKS endpoint private and your CI\/CD pipeline secure.<\/li>\n\n\n\n<li>See [HashiCorp\u2019s documentation] for steps to register self-hosted agents.<\/li>\n<\/ul>\n\n\n\n<p>Alternatively, for advanced isolation, use <strong>AWS PrivateLink with a jump\/bastion<\/strong> or an <strong>SSM bridge<\/strong> as described by AWS.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"comparing-aws-privatelink-vpc-endpoint-vs-self-hos\">Comparing AWS PrivateLink (VPC Endpoint) vs. Self-Hosted Agent Runner for Private EKS Deployment<\/h1>\n\n\n\n<p>When deciding between <strong>using AWS PrivateLink (VPC Endpoint)<\/strong> and <strong>deploying a self-hosted agent runner in your AWS VPC<\/strong> for private EKS deployment (e.g., with Terraform Cloud), each approach differs in setup complexity, ongoing management, and cost. Here\u2019s a practical, side-by-side breakdown:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"1-aws-privatelink-vpc-endpoint--network-bridge\">1. AWS PrivateLink (VPC Endpoint) + Network Bridge<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exposes your EKS API or application endpoints privately within your VPC, accessible only to resources that reside within the same (or peered) VPCs.<\/li>\n\n\n\n<li>Requires a bridging mechanism: typically a bastion host, jumpbox, or session manager must be set up inside the VPC to bridge external systems (like TFC) to the private EKS API.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Pros<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Secure:<\/strong> Keeps traffic fully within AWS, never exposed to the public internet.<\/li>\n\n\n\n<li><strong>Reduced data transfer cost:<\/strong> Eliminates the need for more expensive NAT Gateways in some setups, offering significant network cost savings per GB transferred.<\/li>\n\n\n\n<li><strong>Simplifies network topology:<\/strong> Direct VPC-to-VPC or VPC-to-service communication; easy to scale by adding more endpoints for different services.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cons<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Setup Complexity:<\/strong> You must configure PrivateLink endpoints and configure bastion hosts or equivalent network bridges, then securely manage bastion access.<\/li>\n\n\n\n<li><strong>Maintenance Overhead:<\/strong> Bastions require hardening, patching, and ongoing management.<\/li>\n\n\n\n<li><strong>Not a direct solution for TFC cloud:<\/strong> TFC (unless running an agent inside your VPC) cannot reach PrivateLink endpoints from the public internet. You&#8217;ll either need a bastion or to move to a self-hosted agent pattern anyway.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cost Summary (Per Month Example)<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Item<\/th><th>Rate<\/th><th>Example (5,000hr + 10TB)<\/th><\/tr><\/thead><tbody><tr><td>Endpoint Hourly<\/td><td>$0.01\/hr<\/td><td>$50<\/td><\/tr><tr><td>Data Processing<\/td><td>$0.01\/GB<\/td><td>$100<\/td><\/tr><tr><td>Data Transfer (AWS)<\/td><td>Often free\/intra-region<\/td><td>$0<\/td><\/tr><tr><td><strong>Total<\/strong><\/td><td><\/td><td><strong>$150<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>In similar NAT Gateway scenarios, total network cost could be over $1,500\/month versus $150\/month with PrivateLink, showing 90%+ savings when substituting NAT Gateway for PrivateLink.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"2-self-hosted-agent-runner-in-your-vpc\">2. Self-Hosted (Agent) Runner in Your VPC<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You deploy a self-hosted agent (an EC2 instance or Fargate task) within your VPC.<\/li>\n\n\n\n<li>This agent executes all Terraform Cloud jobs: it can reach your private EKS API endpoint directly (no bastion, no extra bridge).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Pros<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Easy integration with private resources:<\/strong> Agent, being inside the VPC, talks directly to private EKS, RDS, etc..<\/li>\n\n\n\n<li><strong>Simpler architecture:<\/strong> No need for extra jumpboxes or manual session tunneling.<\/li>\n\n\n\n<li><strong>Secure:<\/strong> Keeps your infrastructure and API access within your secured VPC.<\/li>\n\n\n\n<li><strong>Recommended by Terraform Cloud for private infra:<\/strong> Official guidance from HashiCorp is to use self-hosted agents for deploying to private networks.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cons<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>EC2 instance cost:<\/strong> Running a dedicated agent incurs compute and (minor) storage cost.<\/li>\n\n\n\n<li><strong>Agent maintenance:<\/strong> Occasional need for patching, scaling, and log management, but infrastructure is much simpler than managing bastions with PrivateLink.<\/li>\n\n\n\n<li><strong>Still inside your AWS bill:<\/strong> Cost is very controllable\u2014typically a single t3.medium\/t3.large EC2 covers most needs.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cost Summary (Typical, per agent)<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Item<\/th><th>Ballpark Rate\/Month<\/th><th>Example<\/th><\/tr><\/thead><tbody><tr><td>EC2 (t3.medium)<\/td><td>$32<\/td><td>$32<\/td><\/tr><tr><td>EBS Storage<\/td><td>$1-2<\/td><td>$1-2<\/td><\/tr><tr><td>Data Transfer<\/td><td>VPC-internal\/free<\/td><td>$0<\/td><\/tr><tr><td><strong>Total<\/strong><\/td><td><\/td><td><strong>$33-34<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"head-to-head-setup-management-and-cost\">Head-to-Head: Setup, Management, and Cost<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Factor<\/th><th>PrivateLink + Bridge<\/th><th>Self-Hosted Agent Runner<\/th><\/tr><\/thead><tbody><tr><td><strong>Ease of Setup<\/strong><\/td><td>Moderate to complex<\/td><td>Easier: just launch agent<\/td><\/tr><tr><td><strong>Ongoing Management<\/strong><\/td><td>Must maintain bastion(s), IAM, patching<\/td><td>Just agent maintenance<\/td><\/tr><tr><td><strong>Cost<\/strong><\/td><td>$150\/mo (with data)<\/td><td>~$33\/mo (agent typical)<\/td><\/tr><tr><td><strong>Recommended by TFC?<\/strong><\/td><td>Not direct, requires extra bridging<\/td><td><strong>Yes: official preferred<\/strong><\/td><\/tr><tr><td><strong>Direct Integration with TFC<\/strong><\/td><td>No<\/td><td><strong>Yes<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Recommendation<\/strong><\/h2>\n\n\n\n<p><strong>For most teams deploying to private EKS with Terraform Cloud:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deploying a <strong>Self-Hosted Agent Runner in your AWS VPC<\/strong> is the most recommended, easiest-to-manage, and most cost-effective solution.\n<ul class=\"wp-block-list\">\n<li>No need for NAT Gateway or complex network bridges.<\/li>\n\n\n\n<li>Lower running cost for typical CI\/CD workloads.<\/li>\n\n\n\n<li>Direct compatibility with Terraform Cloud\u2019s automation tools.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p><strong>Only use PrivateLink + Network Bridge if:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You need to share your application across VPCs\/account boundaries (e.g., SaaS with private endpoints), or you have other integration requirements that specifically need L4\/L7 networking via PrivateLink.<\/li>\n<\/ul>\n\n\n\n<p><strong>Bottom line:<\/strong><br>For seamless TFC-to-EKS automation that is easy to set up, maintain, and cost-optimal, choose a self-hosted agent runner in your AWS VPC.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"deploying-to-a-private-eks-cluster-privatelink-wit\">Deploying to a Private EKS Cluster: PrivateLink with Bastion Host<\/h2>\n\n\n\n<p>When you want to keep your Amazon EKS cluster\u2019s API endpoint private\u2014but still require Terraform Cloud (TFC) or other automation to deploy to it\u2014a proven solution is to combine <strong>AWS PrivateLink<\/strong> with a <strong>bastion host<\/strong> (jumpbox) inside your VPC. Here\u2019s how this works, the architecture options, and key considerations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How PrivateLink Secures EKS API Access<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS PrivateLink<\/strong> allows you to expose the EKS API as a private endpoint within your VPC.<\/li>\n\n\n\n<li>This means only resources inside the VPC (or those accessing via trusted connectivity such as VPC peering) can reach the EKS API. Public internet access is prevented.<\/li>\n\n\n\n<li>The PrivateLink interface endpoint creates elastic network interfaces (ENIs) in your VPC, serving as secure entry points for EKS API traffic.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Terraform Cloud Can&#8217;t Reach the Private API Directly<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>TFC runs jobs from its managed, internet-based infrastructure<\/strong>.<\/li>\n\n\n\n<li>It cannot access resources reachable only on your private VPC network or via PrivateLink endpoints.<\/li>\n\n\n\n<li>To bridge this gap, you use a <strong>bastion host<\/strong> in your AWS network.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Bastion Host Pattern: How It Works<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">1. <strong>Bastion Host or Client Node Setup<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Launch an EC2 instance (the &#8220;bastion&#8221;) in a public subnet of your VPC.<\/li>\n\n\n\n<li>Install the necessary tools: <code>kubectl<\/code>, AWS CLI, and (if desired) Terraform itself.<\/li>\n\n\n\n<li>This instance should have an IAM role or credentials that permit access to the EKS cluster, with security group rules allowing it to reach the EKS API endpoint.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">2. <strong>Restricting Access to the Bastion<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Best practice<\/strong>: Do not assign a public IP. Instead, access the instance via <strong>AWS Systems Manager Session Manager<\/strong> (SSM) for shell access, removing the need for SSH keys and public access.<\/li>\n\n\n\n<li>Only allow port 443 from the bastion\u2019s security group to the EKS API endpoint private IP.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">3. <strong>Running Terraform or Deployment Tools<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You may run Terraform (and the Kubernetes provider) <em>directly<\/em> on the bastion, or use it as a jump host for your automation.<\/li>\n\n\n\n<li>The workflow is:\n<ul class=\"wp-block-list\">\n<li>TFC or your operator connects (often via SSM or SSH) to the bastion.<\/li>\n\n\n\n<li>All <code>kubectl<\/code>, <code>helm<\/code>, or Terraform <code>apply<\/code> commands that interact with EKS run within the bastion environment.<\/li>\n\n\n\n<li>The bastion uses the VPC PrivateLink endpoint to talk to the EKS API securely.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. <strong>Securing and Automating<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Limit who can access the bastion using IAM policies and SSM session permissions.<\/li>\n\n\n\n<li>Use automation scripts or CI\/CD pipelines that trigger Terraform runs or deployment scripts from inside the bastion.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Architectural Overview<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Component<\/th><th>Purpose<\/th><\/tr><\/thead><tbody><tr><td>EKS with PrivateLink<\/td><td>API accessible only inside VPC<\/td><\/tr><tr><td>Bastion host (jumpbox)<\/td><td>Bridge for deployment tools, limited to VPC network<\/td><\/tr><tr><td>TFC\/CI\/CD<\/td><td>Triggers deployment actions remotely<\/td><\/tr><tr><td>SSM\/VPN (optional)<\/td><td>Secure connectivity to bastion (no public SSH)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation Tips<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Place the bastion host in the same VPC (and preferably subnet) with access to the EKS PrivateLink endpoint.<\/li>\n\n\n\n<li>Grant the bastion IAM permissions for EKS and, if needed, for Terraform state management (S3, DynamoDB).<\/li>\n\n\n\n<li>Restrict security group and network ACLs so only trusted systems can reach the bastion, and only the bastion can reach EKS.<\/li>\n\n\n\n<li>Clean up or terminate the bastion when not needed, or use on-demand ephemeral instances for extra security.<\/li>\n\n\n\n<li>For production, consider:\n<ul class=\"wp-block-list\">\n<li>Using <strong>SSM Session Manager<\/strong> for access (rather than public IP or SSH).<\/li>\n\n\n\n<li>Enforcing audit logging and access controls on the bastion.<\/li>\n\n\n\n<li>Regularly updating bastion software and patching.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Reference Use Cases and Guides<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Official Docs<\/strong>: Explains creating PrivateLink endpoints for EKS and securing access.<\/li>\n\n\n\n<li><strong>Community Guides<\/strong>: Cover setup with Terraform and detail how automation must be executed from inside the VPC (typically on the bastion).<\/li>\n\n\n\n<li><strong>CI\/CD Automation<\/strong>: TFC can trigger agents (scripts or self-hosted runners) set up inside the VPC, ideally using the bastion for both access and deployment orchestration.<\/li>\n<\/ul>\n\n\n\n<p><strong>Conclusion:<\/strong><br>By combining AWS PrivateLink with a bastion host inside your VPC, you ensure EKS API endpoints are fully private\u2014meeting strong security standards\u2014while still enabling deployments from Terraform Cloud or any CI\/CD system. All sensitive operations and credentials stay inside your protected network, dramatically reducing external exposure.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Deploying to a Private EKS Cluster Using Terraform Cloud (TFC) By default, Terraform Cloud (TFC) workspaces require network-level access to the EKS API endpoint to deploy workloads or manage clusters&#8230;. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-50522","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=50522"}],"version-history":[{"count":4,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50522\/revisions"}],"predecessor-version":[{"id":50526,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/50522\/revisions\/50526"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=50522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=50522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=50522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}