mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-01-16 00:34:31 +01:00
testing initial work now
This commit is contained in:
brandoconnor
34
README.md
34
README.md
@@ -2,6 +2,8 @@
|
||||
|
||||
A terraform module to create a managed Kubernetes cluster on AWS EKS. Available
|
||||
through the [Terraform registry](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws).
|
||||
Inspired by and adapted from [this doc](https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html)
|
||||
and its [source code](https://github.com/terraform-providers/terraform-provider-aws/tree/master/examples/eks-getting-started).
|
||||
|
||||
| Branch | Build status |
|
||||
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
@@ -13,8 +15,7 @@ through the [Terraform registry](https://registry.terraform.io/modules/terraform
|
||||
* You've created a Virtual Private Cloud (VPC) and subnets where you intend to put this EKS.
|
||||
|
||||
It's recommended you use this module with [terraform-aws-vpc](https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws),
|
||||
[terraform-aws-security-group](https://registry.terraform.io/modules/terraform-aws-modules/security-group/aws), and
|
||||
[terraform-aws-autoscaling](https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/).
|
||||
and [terraform-aws-security-group](https://registry.terraform.io/modules/terraform-aws-modules/security-group/aws).
|
||||
|
||||
## Usage example
|
||||
|
||||
@@ -22,13 +23,14 @@ A full example leveraging other community modules is contained in the [examples/
|
||||
|
||||
```hcl
|
||||
module "eks" {
|
||||
source = "terraform-aws-modules/eks/aws"
|
||||
version = "0.1.0"
|
||||
cluster_name = "test-eks-cluster"
|
||||
security_groups = ["sg-edcd9784", "sg-edcd9785"]
|
||||
subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
||||
tags = "${map("Environment", "test")}"
|
||||
vpc_id = "vpc-abcde012"
|
||||
source = "terraform-aws-modules/eks/aws"
|
||||
version = "0.1.0"
|
||||
cluster_name = "test-eks-cluster"
|
||||
subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
||||
tags = "${map("Environment", "test")}"
|
||||
vpc_id = "vpc-abcde012"
|
||||
workers_ami_id = "ami-123456"
|
||||
cluster_ingress_cidrs = ["24.18.23.91/32"]
|
||||
}
|
||||
```
|
||||
|
||||
@@ -84,22 +86,26 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|:----:|:-----:|:-----:|
|
||||
| cluster_ingress_cidrs | The CIDRs from which we can execute kubectl commands. | list | - | yes |
|
||||
| cluster_name | Name of the EKS cluster. | string | - | yes |
|
||||
| security_groups | The security groups to attach to the EKS cluster instances | list | - | yes |
|
||||
| cluster_version | Kubernetes version to use for the cluster. | string | `1.10` | no |
|
||||
| subnets | A list of subnets to associate with the cluster's underlying instances. | list | - | yes |
|
||||
| tags | A map of tags to add to all resources | string | `<map>` | no |
|
||||
| vpc_id | VPC id where the cluster and other resources will be deployed. | string | - | yes |
|
||||
| workers_ami_id | AMI ID for the eks workers. | string | - | yes |
|
||||
| workers_asg_desired_capacity | description | string | `1` | no |
|
||||
| workers_asg_max_size | description | string | `3` | no |
|
||||
| workers_asg_min_size | description | string | `1` | no |
|
||||
| workers_instance_type | Size of the workers instances. | string | `m4.large` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| cluster_arn | The Amazon Resource Name (ARN) of the cluster. |
|
||||
| cluster_certificate_authority | Nested attribute containing certificate-authority-data for your cluster |
|
||||
| cluster_data | The base64 encoded certificate data required to communicate with your cluster. Add this to the certificate-authority-data section of the kubeconfig file for your cluster. |
|
||||
| cluster_certificate_authority_data | Nested attribute containing certificate-authority-data for your cluster. Tis is the base64 encoded certificate data required to communicate with your cluster. |
|
||||
| cluster_endpoint | The endpoint for your Kubernetes API server. |
|
||||
| cluster_id | The name of the cluster. |
|
||||
| cluster_security_group_ids | description |
|
||||
| cluster_version | The Kubernetes server version for the cluster. |
|
||||
| cluster_vpc_config | description |
|
||||
| config_map_aws_auth | description |
|
||||
| kubeconfig | description |
|
||||
|
||||
106
cluster.tf
106
cluster.tf
@@ -1,87 +1,67 @@
|
||||
#
|
||||
# EKS Cluster Resources
|
||||
# * IAM Role to allow EKS service to manage other AWS services
|
||||
# * EC2 Security Group to allow networking traffic with EKS cluster
|
||||
# * EKS Cluster
|
||||
#
|
||||
|
||||
resource "aws_eks_cluster" "demo" {
|
||||
resource "aws_eks_cluster" "this" {
|
||||
name = "${var.cluster_name}"
|
||||
role_arn = "${aws_iam_role.demo-cluster.arn}"
|
||||
role_arn = "${aws_iam_role.cluster.arn}"
|
||||
version = "${var.cluster_version}"
|
||||
|
||||
vpc_config {
|
||||
security_group_ids = ["${aws_security_group.demo-cluster.id}"]
|
||||
security_group_ids = ["${aws_security_group.cluster.id}"]
|
||||
subnet_ids = ["${var.subnets}"]
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
"aws_iam_role_policy_attachment.demo-cluster-AmazonEKSClusterPolicy",
|
||||
"aws_iam_role_policy_attachment.demo-cluster-AmazonEKSServicePolicy",
|
||||
"aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy",
|
||||
"aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy",
|
||||
]
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "demo-cluster" {
|
||||
name = "terraform-eks-demo-cluster"
|
||||
|
||||
assume_role_policy = <<POLICY
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "eks.amazonaws.com"
|
||||
},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
]
|
||||
}
|
||||
POLICY
|
||||
resource "aws_iam_role" "cluster" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
assume_role_policy = "${data.aws_iam_policy_document.cluster_assume_role_policy.json}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSClusterPolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
|
||||
role = "${aws_iam_role.demo-cluster.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSServicePolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
|
||||
role = "${aws_iam_role.demo-cluster.name}"
|
||||
}
|
||||
|
||||
resource "aws_security_group" "demo-cluster" {
|
||||
name = "terraform-eks-demo-cluster"
|
||||
description = "Cluster communication with worker nodes"
|
||||
resource "aws_security_group" "cluster" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
description = "Cluster communication with workers nodes"
|
||||
vpc_id = "${var.vpc_id}"
|
||||
|
||||
egress {
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
tags {
|
||||
Name = "terraform-eks-demo"
|
||||
}
|
||||
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_cluster_sg"))}"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "demo-cluster-ingress-node-https" {
|
||||
description = "Allow pods to communicate with the cluster API Server"
|
||||
from_port = 443
|
||||
resource "aws_security_group_rule" "cluster_egress_internet" {
|
||||
description = "Allow cluster egress to the Internet."
|
||||
protocol = "-1"
|
||||
security_group_id = "${aws_security_group.cluster.id}"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
type = "egress"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
|
||||
description = "Allow pods to communicate with the cluster API Server."
|
||||
protocol = "tcp"
|
||||
security_group_id = "${aws_security_group.demo-cluster.id}"
|
||||
source_security_group_id = "${aws_security_group.demo-node.id}"
|
||||
security_group_id = "${aws_security_group.cluster.id}"
|
||||
source_security_group_id = "${aws_security_group.workers.id}"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "demo-cluster-ingress-workstation-https" {
|
||||
cidr_blocks = ["${local.workstation_external_cidr}"]
|
||||
description = "Allow workstation to communicate with the cluster API Server"
|
||||
from_port = 443
|
||||
resource "aws_security_group_rule" "cluster_https_cidr_ingress" {
|
||||
cidr_blocks = ["${var.cluster_ingress_cidrs}"]
|
||||
description = "Allow communication with the cluster API Server."
|
||||
protocol = "tcp"
|
||||
security_group_id = "${aws_security_group.demo-cluster.id}"
|
||||
security_group_id = "${aws_security_group.cluster.id}"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
|
||||
role = "${aws_iam_role.cluster.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
|
||||
role = "${aws_iam_role.cluster.name}"
|
||||
}
|
||||
|
||||
62
data.tf
62
data.tf
@@ -1,16 +1,59 @@
|
||||
data "aws_region" "current" {}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
data "aws_iam_policy_document" "workers_assume_role_policy" {
|
||||
statement {
|
||||
sid = "EKSWorkerAssumeRole"
|
||||
|
||||
provider "http" {}
|
||||
actions = [
|
||||
"sts:AssumeRole",
|
||||
]
|
||||
|
||||
data "http" "workstation-external-ip" {
|
||||
url = "http://icanhazip.com"
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["ec2.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "cluster_assume_role_policy" {
|
||||
statement {
|
||||
sid = "EKSClusterAssumeRole"
|
||||
|
||||
actions = [
|
||||
"sts:AssumeRole",
|
||||
]
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["eks.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Override with variable or hardcoded value if necessary
|
||||
locals {
|
||||
workstation_external_cidr = "${chomp(data.http.workstation-external-ip.body)}/32"
|
||||
# More information: https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
||||
workers_userdata = <<USERDATA
|
||||
#!/bin/bash -xe
|
||||
|
||||
CA_CERTIFICATE_DIRECTORY=/etc/kubernetes/pki
|
||||
CA_CERTIFICATE_FILE_PATH=$CA_CERTIFICATE_DIRECTORY/ca.crt
|
||||
mkdir -p $CA_CERTIFICATE_DIRECTORY
|
||||
echo "${aws_eks_cluster.this.certificate_authority.0.data}" | base64 -d > $CA_CERTIFICATE_FILE_PATH
|
||||
INTERNAL_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
|
||||
sed -i s,MASTER_ENDPOINT,${aws_eks_cluster.this.endpoint},g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,CLUSTER_NAME,${var.cluster_name},g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,REGION,${data.aws_region.current.name},g /etc/systemd/system/kubelet.service
|
||||
sed -i s,MAX_PODS,20,g /etc/systemd/system/kubelet.service
|
||||
sed -i s,MASTER_ENDPOINT,${aws_eks_cluster.this.endpoint},g /etc/systemd/system/kubelet.service
|
||||
sed -i s,INTERNAL_IP,$INTERNAL_IP,g /etc/systemd/system/kubelet.service
|
||||
DNS_CLUSTER_IP=10.100.0.10
|
||||
if [[ $INTERNAL_IP == 10.* ]] ; then DNS_CLUSTER_IP=172.20.0.10; fi
|
||||
sed -i s,DNS_CLUSTER_IP,$DNS_CLUSTER_IP,g /etc/systemd/system/kubelet.service
|
||||
sed -i s,CERTIFICATE_AUTHORITY_FILE,$CA_CERTIFICATE_FILE_PATH,g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,CLIENT_CA_FILE,$CA_CERTIFICATE_FILE_PATH,g /etc/systemd/system/kubelet.service
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet kube-proxy
|
||||
USERDATA
|
||||
|
||||
config_map_aws_auth = <<CONFIGMAPAWSAUTH
|
||||
apiVersion: v1
|
||||
@@ -20,7 +63,7 @@ metadata:
|
||||
namespace: kube-system
|
||||
data:
|
||||
mapRoles: |
|
||||
- rolearn: ${aws_iam_role.demo-node.arn}
|
||||
- rolearn: ${aws_iam_role.workers.arn}
|
||||
username: system:node:{{EC2PrivateDNSName}}
|
||||
groups:
|
||||
- system:bootstrappers
|
||||
@@ -29,12 +72,11 @@ CONFIGMAPAWSAUTH
|
||||
|
||||
kubeconfig = <<KUBECONFIG
|
||||
|
||||
|
||||
apiVersion: v1
|
||||
clusters:
|
||||
- cluster:
|
||||
server: ${aws_eks_cluster.demo.endpoint}
|
||||
certificate-authority-data: ${aws_eks_cluster.demo.certificate_authority.0.data}
|
||||
server: ${aws_eks_cluster.this.endpoint}
|
||||
certificate-authority-data: ${aws_eks_cluster.this.certificate_authority.0.data}
|
||||
name: kubernetes
|
||||
contexts:
|
||||
- context:
|
||||
|
||||
@@ -16,73 +16,7 @@ The following IAM policy is the minimum needed to execute the module from the te
|
||||
{
|
||||
"Sid": "Stmt1507789535000",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"autoscaling:*LoadBalancerTargetGroups",
|
||||
"autoscaling:*AutoScalingGroup",
|
||||
"autoscaling:*LaunchConfiguration",
|
||||
"autoscaling:*AutoScalingGroups",
|
||||
"autoscaling:*LaunchConfigurations",
|
||||
"ec2:AllocateAddress",
|
||||
"ec2:AssignIpv6Addresses",
|
||||
"ec2:AssignPrivateIpAddresses",
|
||||
"ec2:AssociateAddress",
|
||||
"ec2:AssociateDhcpOptions",
|
||||
"ec2:AssociateRouteTable",
|
||||
"ec2:AttachInternetGateway",
|
||||
"ec2:AttachNetworkInterface",
|
||||
"ec2:AuthorizeSecurityGroupEgress",
|
||||
"ec2:AuthorizeSecurityGroupIngress",
|
||||
"ec2:CreateDhcpOptions",
|
||||
"ec2:CreateInternetGateway",
|
||||
"ec2:CreateNatGateway",
|
||||
"ec2:CreateNetworkAcl",
|
||||
"ec2:CreateNetworkAclEntry",
|
||||
"ec2:CreateNetworkInterface",
|
||||
"ec2:CreateNetworkInterfacePermission",
|
||||
"ec2:CreateRoute",
|
||||
"ec2:CreateRouteTable",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:CreateSubnet",
|
||||
"ec2:CreateTags",
|
||||
"ec2:CreateVpc",
|
||||
"ec2:DeleteDhcpOptions",
|
||||
"ec2:DeleteInternetGateway",
|
||||
"ec2:DeleteNatGateway",
|
||||
"ec2:DeleteNetworkAcl",
|
||||
"ec2:DeleteNetworkAclEntry",
|
||||
"ec2:DeleteNetworkInterface",
|
||||
"ec2:DeleteRoute",
|
||||
"ec2:DeleteRouteTable",
|
||||
"ec2:DeleteSecurityGroup",
|
||||
"ec2:DeleteSubnet",
|
||||
"ec2:DeleteTags",
|
||||
"ec2:DeleteVpc",
|
||||
"ec2:Describe*",
|
||||
"ec2:DetachInternetGateway",
|
||||
"ec2:DetachNetworkInterface",
|
||||
"ec2:DisassociateAddress",
|
||||
"ec2:DisassociateRouteTable",
|
||||
"ec2:DisassociateSubnetCidrBlock",
|
||||
"ec2:DisassociateVpcCidrBlock",
|
||||
"ec2:ModifySubnetAttribute",
|
||||
"ec2:ModifyVpcAttribute",
|
||||
"ec2:ModifyVpcEndpoint",
|
||||
"ec2:ReleaseAddress",
|
||||
"ec2:RevokeSecurityGroupEgress",
|
||||
"ec2:RevokeSecurityGroupIngress",
|
||||
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
|
||||
"ec2:UpdateSecurityGroupRuleDescriptionsIngress"
|
||||
],
|
||||
"Resource": ["*"]
|
||||
},
|
||||
{
|
||||
"Sid": "Stmt1507789655001",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:UploadServerCertificate",
|
||||
"iam:DeleteServerCertificate",
|
||||
"iam:GetServerCertificate"
|
||||
],
|
||||
"Action": [],
|
||||
"Resource": ["*"]
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
data "aws_region" "current" {}
|
||||
|
||||
data "aws_ami" "ubuntu" {
|
||||
most_recent = true
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
|
||||
}
|
||||
|
||||
filter {
|
||||
name = "virtualization-type"
|
||||
values = ["hvm"]
|
||||
}
|
||||
|
||||
owners = ["099720109477"] # Canonical
|
||||
}
|
||||
@@ -1,7 +0,0 @@
|
||||
locals {
|
||||
tags = "${map("Environment", "test",
|
||||
"GithubRepo", "terraform-aws-eks",
|
||||
"GithubOrg", "terraform-aws-modules",
|
||||
"Workspace", "${terraform.workspace}",
|
||||
)}"
|
||||
}
|
||||
@@ -11,14 +11,38 @@ provider "random" {
|
||||
version = "= 1.3.1"
|
||||
}
|
||||
|
||||
# resource "random_pet" "suffix" {
|
||||
# length = 1
|
||||
# }
|
||||
provider "http" {}
|
||||
|
||||
# resource "random_string" "suffix" {
|
||||
# length = 8
|
||||
# special = false
|
||||
# }
|
||||
data "aws_ami" "eks_worker" {
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["eks-worker-*"]
|
||||
}
|
||||
|
||||
most_recent = true
|
||||
owners = ["602401143452"] # Amazon
|
||||
}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
data "http" "workstation_external_ip" {
|
||||
url = "http://icanhazip.com"
|
||||
}
|
||||
|
||||
locals {
|
||||
workstation_external_cidr = "${chomp(data.http.workstation_external_ip.body)}/32"
|
||||
|
||||
tags = "${map("Environment", "test",
|
||||
"GithubRepo", "terraform-aws-eks",
|
||||
"GithubOrg", "terraform-aws-modules",
|
||||
"Workspace", "${terraform.workspace}",
|
||||
)}"
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
@@ -42,14 +66,11 @@ module "security_group" {
|
||||
}
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
# cluster_name = "test-eks-${random_string.suffix.result}"
|
||||
# cluster_name = "test-eks-${random_pet.suffix.id}"
|
||||
cluster_name = "test-eks-cluster"
|
||||
|
||||
security_groups = ["${module.security_group.this_security_group_id}"]
|
||||
subnets = "${module.vpc.public_subnets}"
|
||||
tags = "${local.tags}"
|
||||
vpc_id = "${module.vpc.vpc_id}"
|
||||
source = "../.."
|
||||
cluster_name = "test-eks-${random_string.suffix.result}"
|
||||
subnets = "${module.vpc.public_subnets}"
|
||||
tags = "${local.tags}"
|
||||
vpc_id = "${module.vpc.vpc_id}"
|
||||
workers_ami_id = "${data.aws_ami.eks_worker.id}"
|
||||
cluster_ingress_cidrs = ["${local.workstation_external_cidr}"]
|
||||
}
|
||||
|
||||
@@ -2,3 +2,8 @@ output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS controlplane."
|
||||
value = "${module.eks.cluster_endpoint}"
|
||||
}
|
||||
|
||||
output "cluster_security_group_ids" {
|
||||
description = "."
|
||||
value = "${module.eks.cluster_security_group_ids}"
|
||||
}
|
||||
|
||||
21
main.tf
21
main.tf
@@ -3,6 +3,8 @@
|
||||
|
||||
* A terraform module to create a managed Kubernetes cluster on AWS EKS. Available
|
||||
* through the [Terraform registry](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws).
|
||||
* Inspired by and adapted from [this doc](https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html)
|
||||
* and its [source code](https://github.com/terraform-providers/terraform-provider-aws/tree/master/examples/eks-getting-started).
|
||||
|
||||
* | Branch | Build status |
|
||||
* | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
@@ -14,8 +16,7 @@
|
||||
** You've created a Virtual Private Cloud (VPC) and subnets where you intend to put this EKS.
|
||||
|
||||
* It's recommended you use this module with [terraform-aws-vpc](https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws),
|
||||
* [terraform-aws-security-group](https://registry.terraform.io/modules/terraform-aws-modules/security-group/aws), and
|
||||
* [terraform-aws-autoscaling](https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/).
|
||||
* and [terraform-aws-security-group](https://registry.terraform.io/modules/terraform-aws-modules/security-group/aws).
|
||||
|
||||
* ## Usage example
|
||||
|
||||
@@ -23,13 +24,14 @@
|
||||
|
||||
* ```hcl
|
||||
* module "eks" {
|
||||
* source = "terraform-aws-modules/eks/aws"
|
||||
* version = "0.1.0"
|
||||
* cluster_name = "test-eks-cluster"
|
||||
* security_groups = ["sg-edcd9784", "sg-edcd9785"]
|
||||
* subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
||||
* tags = "${map("Environment", "test")}"
|
||||
* vpc_id = "vpc-abcde012"
|
||||
* source = "terraform-aws-modules/eks/aws"
|
||||
* version = "0.1.0"
|
||||
* cluster_name = "test-eks-cluster"
|
||||
* subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
||||
* tags = "${map("Environment", "test")}"
|
||||
* vpc_id = "vpc-abcde012"
|
||||
* workers_ami_id = "ami-123456"
|
||||
* cluster_ingress_cidrs = ["24.18.23.91/32"]
|
||||
* }
|
||||
* ```
|
||||
|
||||
@@ -82,3 +84,4 @@
|
||||
* MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/LICENSE) for full details.
|
||||
*/
|
||||
|
||||
provider "http" {}
|
||||
|
||||
16
outputs.tf
16
outputs.tf
@@ -10,31 +10,31 @@ output "kubeconfig" {
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name of the cluster."
|
||||
value = "${aws_eks_cluster.demo.id}"
|
||||
value = "${aws_eks_cluster.this.id}"
|
||||
}
|
||||
|
||||
# Though documented: not yet supported
|
||||
# Though documented, not yet supported
|
||||
# output "cluster_arn" {
|
||||
# description = "The Amazon Resource Name (ARN) of the cluster."
|
||||
# value = "${aws_eks_cluster.demo.arn}"
|
||||
# value = "${aws_eks_cluster.this.arn}"
|
||||
# }
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Nested attribute containing certificate-authority-data for your cluster. Tis is the base64 encoded certificate data required to communicate with your cluster."
|
||||
value = "${aws_eks_cluster.demo.certificate_authority.0.data}"
|
||||
value = "${aws_eks_cluster.this.certificate_authority.0.data}"
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "The endpoint for your Kubernetes API server."
|
||||
value = "${aws_eks_cluster.demo.endpoint}"
|
||||
value = "${aws_eks_cluster.this.endpoint}"
|
||||
}
|
||||
|
||||
output "cluster_version" {
|
||||
description = "The Kubernetes server version for the cluster."
|
||||
value = "${aws_eks_cluster.demo.version}"
|
||||
value = "${aws_eks_cluster.this.version}"
|
||||
}
|
||||
|
||||
output "cluster_vpc_config" {
|
||||
output "cluster_security_group_ids" {
|
||||
description = "description"
|
||||
value = "${aws_eks_cluster.demo.vpc_config}"
|
||||
value = "${aws_eks_cluster.this.vpc_config.0.security_group_ids}"
|
||||
}
|
||||
|
||||
43
variables.tf
43
variables.tf
@@ -1,14 +1,15 @@
|
||||
variable "cluster_ingress_cidrs" {
|
||||
description = "The CIDRs from which we can execute kubectl commands."
|
||||
type = "list"
|
||||
}
|
||||
|
||||
variable "cluster_name" {
|
||||
description = "Name of the EKS cluster."
|
||||
}
|
||||
|
||||
variable "vpc_id" {
|
||||
description = "VPC id where the cluster and other resources will be deployed."
|
||||
}
|
||||
|
||||
variable "security_groups" {
|
||||
description = "The security groups to attach to the EKS cluster instances"
|
||||
type = "list"
|
||||
variable "cluster_version" {
|
||||
description = "Kubernetes version to use for the cluster."
|
||||
default = "1.10"
|
||||
}
|
||||
|
||||
variable "subnets" {
|
||||
@@ -20,3 +21,31 @@ variable "tags" {
|
||||
description = "A map of tags to add to all resources"
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "vpc_id" {
|
||||
description = "VPC id where the cluster and other resources will be deployed."
|
||||
}
|
||||
|
||||
variable "workers_ami_id" {
|
||||
description = "AMI ID for the eks workers."
|
||||
}
|
||||
|
||||
variable "workers_asg_desired_capacity" {
|
||||
description = "description"
|
||||
default = "1"
|
||||
}
|
||||
|
||||
variable "workers_asg_max_size" {
|
||||
description = "description"
|
||||
default = "3"
|
||||
}
|
||||
|
||||
variable "workers_asg_min_size" {
|
||||
description = "description"
|
||||
default = "1"
|
||||
}
|
||||
|
||||
variable "workers_instance_type" {
|
||||
description = "Size of the workers instances."
|
||||
default = "m4.large"
|
||||
}
|
||||
|
||||
162
worker_nodes.tf
162
worker_nodes.tf
@@ -1,162 +0,0 @@
|
||||
# EKS Worker Nodes Resources
|
||||
# * IAM role allowing Kubernetes actions to access other AWS services
|
||||
# * EC2 Security Group to allow networking traffic
|
||||
# * Data source to fetch latest EKS worker AMI
|
||||
# * AutoScaling Launch Configuration to configure worker instances
|
||||
# * AutoScaling Group to launch worker instances
|
||||
#
|
||||
|
||||
# TODO: create this policy as a data source
|
||||
resource "aws_iam_role" "demo-node" {
|
||||
name = "terraform-eks-demo-node"
|
||||
|
||||
assume_role_policy = <<POLICY
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "ec2.amazonaws.com"
|
||||
},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
]
|
||||
}
|
||||
POLICY
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "demo-node-AmazonEKSWorkerNodePolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
|
||||
role = "${aws_iam_role.demo-node.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "demo-node-AmazonEKS_CNI_Policy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
|
||||
role = "${aws_iam_role.demo-node.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "demo-node-AmazonEC2ContainerRegistryReadOnly" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||
role = "${aws_iam_role.demo-node.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_instance_profile" "demo-node" {
|
||||
name = "terraform-eks-demo"
|
||||
role = "${aws_iam_role.demo-node.name}"
|
||||
}
|
||||
|
||||
resource "aws_security_group" "demo-node" {
|
||||
name = "terraform-eks-demo-node"
|
||||
description = "Security group for all nodes in the cluster"
|
||||
vpc_id = "${var.vpc_id}"
|
||||
|
||||
egress {
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
tags = "${
|
||||
map(
|
||||
"Name", "terraform-eks-demo-node",
|
||||
"kubernetes.io/cluster/${var.cluster_name}", "owned",
|
||||
)
|
||||
}"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "demo-node-ingress-self" {
|
||||
description = "Allow node to communicate with each other"
|
||||
from_port = 0
|
||||
protocol = "-1"
|
||||
security_group_id = "${aws_security_group.demo-node.id}"
|
||||
source_security_group_id = "${aws_security_group.demo-node.id}"
|
||||
to_port = 65535
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "demo-node-ingress-cluster" {
|
||||
description = "Allow worker Kubelets and pods to receive communication from the cluster control plane"
|
||||
from_port = 1025
|
||||
protocol = "tcp"
|
||||
security_group_id = "${aws_security_group.demo-node.id}"
|
||||
source_security_group_id = "${aws_security_group.demo-cluster.id}"
|
||||
to_port = 65535
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
data "aws_ami" "eks-worker" {
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["eks-worker-*"]
|
||||
}
|
||||
|
||||
most_recent = true
|
||||
owners = ["602401143452"] # Amazon
|
||||
}
|
||||
|
||||
# EKS currently documents this required userdata for EKS worker nodes to
|
||||
# properly configure Kubernetes applications on the EC2 instance.
|
||||
# We utilize a Terraform local here to simplify Base64 encoding this
|
||||
# information into the AutoScaling Launch Configuration.
|
||||
# More information: https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
||||
locals {
|
||||
demo-node-userdata = <<USERDATA
|
||||
#!/bin/bash -xe
|
||||
|
||||
CA_CERTIFICATE_DIRECTORY=/etc/kubernetes/pki
|
||||
CA_CERTIFICATE_FILE_PATH=$CA_CERTIFICATE_DIRECTORY/ca.crt
|
||||
mkdir -p $CA_CERTIFICATE_DIRECTORY
|
||||
echo "${aws_eks_cluster.demo.certificate_authority.0.data}" | base64 -d > $CA_CERTIFICATE_FILE_PATH
|
||||
INTERNAL_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
|
||||
sed -i s,MASTER_ENDPOINT,${aws_eks_cluster.demo.endpoint},g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,CLUSTER_NAME,${var.cluster_name},g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,REGION,${data.aws_region.current.name},g /etc/systemd/system/kubelet.service
|
||||
sed -i s,MAX_PODS,20,g /etc/systemd/system/kubelet.service
|
||||
sed -i s,MASTER_ENDPOINT,${aws_eks_cluster.demo.endpoint},g /etc/systemd/system/kubelet.service
|
||||
sed -i s,INTERNAL_IP,$INTERNAL_IP,g /etc/systemd/system/kubelet.service
|
||||
DNS_CLUSTER_IP=10.100.0.10
|
||||
if [[ $INTERNAL_IP == 10.* ]] ; then DNS_CLUSTER_IP=172.20.0.10; fi
|
||||
sed -i s,DNS_CLUSTER_IP,$DNS_CLUSTER_IP,g /etc/systemd/system/kubelet.service
|
||||
sed -i s,CERTIFICATE_AUTHORITY_FILE,$CA_CERTIFICATE_FILE_PATH,g /var/lib/kubelet/kubeconfig
|
||||
sed -i s,CLIENT_CA_FILE,$CA_CERTIFICATE_FILE_PATH,g /etc/systemd/system/kubelet.service
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet kube-proxy
|
||||
USERDATA
|
||||
}
|
||||
|
||||
resource "aws_launch_configuration" "demo" {
|
||||
associate_public_ip_address = true
|
||||
iam_instance_profile = "${aws_iam_instance_profile.demo-node.name}"
|
||||
image_id = "${data.aws_ami.eks-worker.id}"
|
||||
instance_type = "m4.large"
|
||||
name_prefix = "terraform-eks-demo"
|
||||
security_groups = ["${aws_security_group.demo-node.id}"]
|
||||
user_data_base64 = "${base64encode(local.demo-node-userdata)}"
|
||||
|
||||
lifecycle {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_autoscaling_group" "demo" {
|
||||
desired_capacity = 2
|
||||
launch_configuration = "${aws_launch_configuration.demo.id}"
|
||||
max_size = 2
|
||||
min_size = 1
|
||||
name = "terraform-eks-demo"
|
||||
vpc_zone_identifier = ["${var.subnets}"]
|
||||
|
||||
tag {
|
||||
key = "Name"
|
||||
value = "terraform-eks-demo"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
|
||||
tag {
|
||||
key = "kubernetes.io/cluster/${var.cluster_name}"
|
||||
value = "owned"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
}
|
||||
85
workers.tf
Normal file
85
workers.tf
Normal file
@@ -0,0 +1,85 @@
|
||||
resource "aws_autoscaling_group" "workers" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
launch_configuration = "${aws_launch_configuration.workers.id}"
|
||||
desired_capacity = "${var.workers_asg_desired_capacity}"
|
||||
max_size = "${var.workers_asg_max_size}"
|
||||
min_size = "${var.workers_asg_min_size}"
|
||||
vpc_zone_identifier = ["${var.subnets}"]
|
||||
tags = ["${merge(var.tags, map("Name", "${var.cluster_name}-eks_asg", "propagate_at_launch", "true"))}"]
|
||||
}
|
||||
|
||||
resource "aws_launch_configuration" "workers" {
|
||||
associate_public_ip_address = true
|
||||
name_prefix = "${var.cluster_name}"
|
||||
iam_instance_profile = "${aws_iam_instance_profile.workers.name}"
|
||||
image_id = "${var.workers_ami_id}"
|
||||
instance_type = "${var.workers_instance_type}"
|
||||
security_groups = ["${aws_security_group.workers.id}"]
|
||||
user_data_base64 = "${base64encode(local.workers_userdata)}"
|
||||
|
||||
lifecycle {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group" "workers" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
description = "Security group for all nodes in the cluster."
|
||||
vpc_id = "${var.vpc_id}"
|
||||
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg"))}"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "workers_egress_internet" {
|
||||
description = "Allow nodes all egress to the Internet."
|
||||
protocol = "-1"
|
||||
security_group_id = "${aws_security_group.workers.id}"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
type = "egress"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "workers_ingress_self" {
|
||||
description = "Allow node to communicate with each other."
|
||||
protocol = "-1"
|
||||
security_group_id = "${aws_security_group.workers.id}"
|
||||
source_security_group_id = "${aws_security_group.workers.id}"
|
||||
from_port = 0
|
||||
to_port = 65535
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "workers_ingress_cluster" {
|
||||
description = "Allow workers Kubelets and pods to receive communication from the cluster control plane."
|
||||
protocol = "tcp"
|
||||
security_group_id = "${aws_security_group.workers.id}"
|
||||
source_security_group_id = "${aws_security_group.cluster.id}"
|
||||
from_port = 1025
|
||||
to_port = 65535
|
||||
type = "ingress"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "workers" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}"
|
||||
}
|
||||
|
||||
resource "aws_iam_instance_profile" "workers" {
|
||||
name_prefix = "${var.cluster_name}"
|
||||
role = "${aws_iam_role.workers.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "workers_AmazonEKSworkersNodePolicy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSworkersNodePolicy"
|
||||
role = "${aws_iam_role.workers.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "workers_AmazonEKS_CNI_Policy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
|
||||
role = "${aws_iam_role.workers.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "workers_AmazonEC2ContainerRegistryReadOnly" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||
role = "${aws_iam_role.workers.name}"
|
||||
}
|
||||
Reference in New Issue
Block a user