mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-05-01 04:44:29 +02:00
docs: Move examples that are more like test cases to the new tests/ directory; add better example configurations (#3069)
* chore: Move examples that are more like test cases to the new `tests/` directory * chore: Stash * feat: Add better examples for EKS managed node groups * chore: Add better examples for self-managed node groups * chore: Update docs and correct `nodegroup` to `node group`
This commit is contained in:
Bryant Biggs
96
tests/eks-managed-node-group/README.md
Normal file
96
tests/eks-managed-node-group/README.md
Normal file
@@ -0,0 +1,96 @@
|
||||
# EKS Managed Node Group
|
||||
|
||||
## Usage
|
||||
|
||||
To provision the provided configurations you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply --auto-approve
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.40 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.40 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_disabled_eks"></a> [disabled\_eks](#module\_disabled\_eks) | ../.. | n/a |
|
||||
| <a name="module_disabled_eks_managed_node_group"></a> [disabled\_eks\_managed\_node\_group](#module\_disabled\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
|
||||
| <a name="module_ebs_kms_key"></a> [ebs\_kms\_key](#module\_ebs\_kms\_key) | terraform-aws-modules/kms/aws | ~> 2.1 |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_eks_managed_node_group"></a> [eks\_managed\_node\_group](#module\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
|
||||
| <a name="module_key_pair"></a> [key\_pair](#module\_key\_pair) | terraform-aws-modules/key-pair/aws | ~> 2.0 |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_iam_policy.node_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
|
||||
| [aws_security_group.remote_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [aws_ami.eks_default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
|
||||
| [aws_ami.eks_default_arm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
|
||||
| [aws_ami.eks_default_bottlerocket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_access_entries"></a> [access\_entries](#output\_access\_entries) | Map of access entries created and their attributes |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_ip_family"></a> [cluster\_ip\_family](#output\_cluster\_ip\_family) | The IP family used by the cluster (e.g. `ipv4` or `ipv6`) |
|
||||
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_service_cidr"></a> [cluster\_service\_cidr](#output\_cluster\_service\_cidr) | The CIDR block where Kubernetes pod and service IP addresses are assigned from |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_cluster_tls_certificate_sha1_fingerprint"></a> [cluster\_tls\_certificate\_sha1\_fingerprint](#output\_cluster\_tls\_certificate\_sha1\_fingerprint) | The SHA1 fingerprint of the public key of the cluster's certificate |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_eks_managed_node_groups_autoscaling_group_names"></a> [eks\_managed\_node\_groups\_autoscaling\_group\_names](#output\_eks\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by EKS managed node groups |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_kms_key_arn"></a> [kms\_key\_arn](#output\_kms\_key\_arn) | The Amazon Resource Name (ARN) of the key |
|
||||
| <a name="output_kms_key_id"></a> [kms\_key\_id](#output\_kms\_key\_id) | The globally unique identifier for the key |
|
||||
| <a name="output_kms_key_policy"></a> [kms\_key\_policy](#output\_kms\_key\_policy) | The IAM resource policy set on the key |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider"></a> [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
| <a name="output_self_managed_node_groups_autoscaling_group_names"></a> [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
558
tests/eks-managed-node-group/main.tf
Normal file
558
tests/eks-managed-node-group/main.tf
Normal file
@@ -0,0 +1,558 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.29"
|
||||
region = "eu-west-1"
|
||||
|
||||
vpc_cidr = "10.0.0.0/16"
|
||||
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||
|
||||
tags = {
|
||||
Test = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
# IPV6
|
||||
cluster_ip_family = "ipv6"
|
||||
create_cni_ipv6_iam_policy = true
|
||||
|
||||
enable_cluster_creator_admin_permissions = true
|
||||
|
||||
# Enable EFA support by adding necessary security group rules
|
||||
# to the shared node security group
|
||||
enable_efa_support = true
|
||||
|
||||
cluster_addons = {
|
||||
coredns = {
|
||||
most_recent = true
|
||||
}
|
||||
kube-proxy = {
|
||||
most_recent = true
|
||||
}
|
||||
vpc-cni = {
|
||||
most_recent = true
|
||||
before_compute = true
|
||||
configuration_values = jsonencode({
|
||||
env = {
|
||||
# Reference docs https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html
|
||||
ENABLE_PREFIX_DELEGATION = "true"
|
||||
WARM_PREFIX_TARGET = "1"
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
control_plane_subnet_ids = module.vpc.intra_subnets
|
||||
|
||||
eks_managed_node_group_defaults = {
|
||||
ami_type = "AL2_x86_64"
|
||||
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
|
||||
}
|
||||
|
||||
eks_managed_node_groups = {
|
||||
# Default node group - as provided by AWS EKS
|
||||
default_node_group = {
|
||||
# By default, the module creates a launch template to ensure tags are propagated to instances, etc.,
|
||||
# so we need to disable it to use the default template provided by the AWS EKS managed node group service
|
||||
use_custom_launch_template = false
|
||||
|
||||
disk_size = 50
|
||||
|
||||
# Remote access cannot be specified with a launch template
|
||||
remote_access = {
|
||||
ec2_ssh_key = module.key_pair.key_pair_name
|
||||
source_security_group_ids = [aws_security_group.remote_access.id]
|
||||
}
|
||||
}
|
||||
|
||||
# AL2023 node group utilizing new user data format which utilizes nodeadm
|
||||
# to join nodes to the cluster (instead of /etc/eks/bootstrap.sh)
|
||||
al2023_nodeadm = {
|
||||
ami_type = "AL2023_x86_64_STANDARD"
|
||||
|
||||
use_latest_ami_release_version = true
|
||||
|
||||
cloudinit_pre_nodeadm = [
|
||||
{
|
||||
content_type = "application/node.eks.aws"
|
||||
content = <<-EOT
|
||||
---
|
||||
apiVersion: node.eks.aws/v1alpha1
|
||||
kind: NodeConfig
|
||||
spec:
|
||||
kubelet:
|
||||
config:
|
||||
shutdownGracePeriod: 30s
|
||||
featureGates:
|
||||
DisableKubeletCloudCredentialProviders: true
|
||||
EOT
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
# Default node group - as provided by AWS EKS using Bottlerocket
|
||||
bottlerocket_default = {
|
||||
# By default, the module creates a launch template to ensure tags are propagated to instances, etc.,
|
||||
# so we need to disable it to use the default template provided by the AWS EKS managed node group service
|
||||
use_custom_launch_template = false
|
||||
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
}
|
||||
|
||||
# Adds to the AWS provided user data
|
||||
bottlerocket_add = {
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
|
||||
use_latest_ami_release_version = true
|
||||
|
||||
# This will get added to what AWS provides
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Custom AMI, using module provided bootstrap data
|
||||
bottlerocket_custom = {
|
||||
# Current bottlerocket AMI
|
||||
ami_id = data.aws_ami.eks_default_bottlerocket.image_id
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
|
||||
# Use module user data template to bootstrap
|
||||
enable_bootstrap_user_data = true
|
||||
# This will get added to the template
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# The admin host container provides SSH access and runs with "superpowers".
|
||||
# It is disabled by default, but can be disabled explicitly.
|
||||
[settings.host-containers.admin]
|
||||
enabled = false
|
||||
|
||||
# The control host container provides out-of-band access via SSM.
|
||||
# It is enabled by default, and can be disabled if you do not expect to use SSM.
|
||||
# This could leave you with no way to access the API and change settings on an existing node!
|
||||
[settings.host-containers.control]
|
||||
enabled = true
|
||||
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
|
||||
[settings.kubernetes.node-labels]
|
||||
label1 = "foo"
|
||||
label2 = "bar"
|
||||
|
||||
[settings.kubernetes.node-taints]
|
||||
dedicated = "experimental:PreferNoSchedule"
|
||||
special = "true:NoSchedule"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Use a custom AMI
|
||||
custom_ami = {
|
||||
ami_type = "AL2_ARM_64"
|
||||
# Current default AMI used by managed node groups - pseudo "custom"
|
||||
ami_id = data.aws_ami.eks_default_arm.image_id
|
||||
|
||||
# This will ensure the bootstrap user data is used to join the node
|
||||
# By default, EKS managed node groups will not append bootstrap script;
|
||||
# this adds it back in using the default template provided by the module
|
||||
# Note: this assumes the AMI provided is an EKS optimized AMI derivative
|
||||
enable_bootstrap_user_data = true
|
||||
|
||||
instance_types = ["t4g.medium"]
|
||||
}
|
||||
|
||||
# Complete
|
||||
complete = {
|
||||
name = "complete-eks-mng"
|
||||
use_name_prefix = true
|
||||
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
min_size = 1
|
||||
max_size = 7
|
||||
desired_size = 1
|
||||
|
||||
ami_id = data.aws_ami.eks_default.image_id
|
||||
enable_bootstrap_user_data = true
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "you are free little kubelet!"
|
||||
EOT
|
||||
|
||||
capacity_type = "SPOT"
|
||||
force_update_version = true
|
||||
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
|
||||
labels = {
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
|
||||
taints = [
|
||||
{
|
||||
key = "dedicated"
|
||||
value = "gpuGroup"
|
||||
effect = "NO_SCHEDULE"
|
||||
}
|
||||
]
|
||||
|
||||
update_config = {
|
||||
max_unavailable_percentage = 33 # or set `max_unavailable`
|
||||
}
|
||||
|
||||
description = "EKS managed node group example launch template"
|
||||
|
||||
ebs_optimized = true
|
||||
disable_api_termination = false
|
||||
enable_monitoring = true
|
||||
|
||||
block_device_mappings = {
|
||||
xvda = {
|
||||
device_name = "/dev/xvda"
|
||||
ebs = {
|
||||
volume_size = 75
|
||||
volume_type = "gp3"
|
||||
iops = 3000
|
||||
throughput = 150
|
||||
encrypted = true
|
||||
kms_key_id = module.ebs_kms_key.key_arn
|
||||
delete_on_termination = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
metadata_options = {
|
||||
http_endpoint = "enabled"
|
||||
http_tokens = "required"
|
||||
http_put_response_hop_limit = 2
|
||||
instance_metadata_tags = "disabled"
|
||||
}
|
||||
|
||||
create_iam_role = true
|
||||
iam_role_name = "eks-managed-node-group-complete-example"
|
||||
iam_role_use_name_prefix = false
|
||||
iam_role_description = "EKS managed node group complete example role"
|
||||
iam_role_tags = {
|
||||
Purpose = "Protector of the kubelet"
|
||||
}
|
||||
iam_role_additional_policies = {
|
||||
AmazonEC2ContainerRegistryReadOnly = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||
additional = aws_iam_policy.node_additional.arn
|
||||
}
|
||||
|
||||
launch_template_tags = {
|
||||
# enable discovery of autoscaling groups by cluster-autoscaler
|
||||
"k8s.io/cluster-autoscaler/enabled" : true,
|
||||
"k8s.io/cluster-autoscaler/${local.name}" : "owned",
|
||||
}
|
||||
|
||||
tags = {
|
||||
ExtraTag = "EKS managed node group complete example"
|
||||
}
|
||||
}
|
||||
|
||||
efa = {
|
||||
# Disabling automatic creation due to instance type/quota availability
|
||||
# Can be enabled when appropriate for testing/validation
|
||||
create = false
|
||||
|
||||
ami_type = "AL2_x86_64_GPU"
|
||||
instance_types = ["trn1n.32xlarge"]
|
||||
|
||||
enable_efa_support = true
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
# Mount NVME instance store volumes since they are typically
|
||||
# available on instances that support EFA
|
||||
setup-local-disks raid0
|
||||
EOT
|
||||
|
||||
min_size = 2
|
||||
max_size = 2
|
||||
desired_size = 2
|
||||
}
|
||||
}
|
||||
|
||||
access_entries = {
|
||||
# One access entry with a policy associated
|
||||
ex-single = {
|
||||
kubernetes_groups = []
|
||||
principal_arn = aws_iam_role.this["single"].arn
|
||||
|
||||
policy_associations = {
|
||||
single = {
|
||||
policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
|
||||
access_scope = {
|
||||
namespaces = ["default"]
|
||||
type = "namespace"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Example of adding multiple policies to a single access entry
|
||||
ex-multiple = {
|
||||
kubernetes_groups = []
|
||||
principal_arn = aws_iam_role.this["multiple"].arn
|
||||
|
||||
policy_associations = {
|
||||
ex-one = {
|
||||
policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy"
|
||||
access_scope = {
|
||||
namespaces = ["default"]
|
||||
type = "namespace"
|
||||
}
|
||||
}
|
||||
ex-two = {
|
||||
policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
|
||||
access_scope = {
|
||||
type = "cluster"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
module "disabled_eks" {
|
||||
source = "../.."
|
||||
|
||||
create = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Sub-Module Usage on Existing/Separate Cluster
|
||||
################################################################################
|
||||
|
||||
module "eks_managed_node_group" {
|
||||
source = "../../modules/eks-managed-node-group"
|
||||
|
||||
name = "separate-eks-mng"
|
||||
cluster_name = module.eks.cluster_name
|
||||
cluster_ip_family = module.eks.cluster_ip_family
|
||||
cluster_service_cidr = module.eks.cluster_service_cidr
|
||||
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id
|
||||
vpc_security_group_ids = [
|
||||
module.eks.node_security_group_id,
|
||||
]
|
||||
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
|
||||
# this will get added to what AWS provides
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
|
||||
[settings.kubernetes.node-labels]
|
||||
"label1" = "foo"
|
||||
"label2" = "bar"
|
||||
EOT
|
||||
|
||||
tags = merge(local.tags, { Separate = "eks-managed-node-group" })
|
||||
}
|
||||
|
||||
module "disabled_eks_managed_node_group" {
|
||||
source = "../../modules/eks-managed-node-group"
|
||||
|
||||
create = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 5.0"
|
||||
|
||||
name = local.name
|
||||
cidr = local.vpc_cidr
|
||||
|
||||
azs = local.azs
|
||||
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
|
||||
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
|
||||
intra_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 52)]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_ipv6 = true
|
||||
create_egress_only_igw = true
|
||||
|
||||
public_subnet_ipv6_prefixes = [0, 1, 2]
|
||||
public_subnet_assign_ipv6_address_on_creation = true
|
||||
private_subnet_ipv6_prefixes = [3, 4, 5]
|
||||
private_subnet_assign_ipv6_address_on_creation = true
|
||||
intra_subnet_ipv6_prefixes = [6, 7, 8]
|
||||
intra_subnet_assign_ipv6_address_on_creation = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
module "ebs_kms_key" {
|
||||
source = "terraform-aws-modules/kms/aws"
|
||||
version = "~> 2.1"
|
||||
|
||||
description = "Customer managed key to encrypt EKS managed node group volumes"
|
||||
|
||||
# Policy
|
||||
key_administrators = [
|
||||
data.aws_caller_identity.current.arn
|
||||
]
|
||||
|
||||
key_service_roles_for_autoscaling = [
|
||||
# required for the ASG to manage encrypted volumes for nodes
|
||||
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",
|
||||
# required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
module.eks.cluster_iam_role_arn,
|
||||
]
|
||||
|
||||
# Aliases
|
||||
aliases = ["eks/${local.name}/ebs"]
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
module "key_pair" {
|
||||
source = "terraform-aws-modules/key-pair/aws"
|
||||
version = "~> 2.0"
|
||||
|
||||
key_name_prefix = local.name
|
||||
create_private_key = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_security_group" "remote_access" {
|
||||
name_prefix = "${local.name}-remote-access"
|
||||
description = "Allow remote SSH access"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
description = "SSH access"
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = ["10.0.0.0/8"]
|
||||
}
|
||||
|
||||
egress {
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
ipv6_cidr_blocks = ["::/0"]
|
||||
}
|
||||
|
||||
tags = merge(local.tags, { Name = "${local.name}-remote" })
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "node_additional" {
|
||||
name = "${local.name}-additional"
|
||||
description = "Example usage of node additional policy"
|
||||
|
||||
policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = [
|
||||
"ec2:Describe*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Resource = "*"
|
||||
},
|
||||
]
|
||||
})
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_ami" "eks_default" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["amazon-eks-node-${local.cluster_version}-v*"]
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_ami" "eks_default_arm" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["amazon-eks-arm64-node-${local.cluster_version}-v*"]
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_ami" "eks_default_bottlerocket" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["bottlerocket-aws-k8s-${local.cluster_version}-x86_64-*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "this" {
|
||||
for_each = toset(["single", "multiple"])
|
||||
|
||||
name = "ex-${each.key}"
|
||||
|
||||
# Just using for this example
|
||||
assume_role_policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = "sts:AssumeRole"
|
||||
Effect = "Allow"
|
||||
Sid = "Example"
|
||||
Principal = {
|
||||
Service = "ec2.amazonaws.com"
|
||||
}
|
||||
},
|
||||
]
|
||||
})
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
221
tests/eks-managed-node-group/outputs.tf
Normal file
221
tests/eks-managed-node-group/outputs.tf
Normal file
@@ -0,0 +1,221 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_name" {
|
||||
description = "The name of the EKS cluster"
|
||||
value = module.eks.cluster_name
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
output "cluster_service_cidr" {
|
||||
description = "The CIDR block where Kubernetes pod and service IP addresses are assigned from"
|
||||
value = module.eks.cluster_service_cidr
|
||||
}
|
||||
|
||||
output "cluster_ip_family" {
|
||||
description = "The IP family used by the cluster (e.g. `ipv4` or `ipv6`)"
|
||||
value = module.eks.cluster_ip_family
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Access Entry
|
||||
################################################################################
|
||||
|
||||
output "access_entries" {
|
||||
description = "Map of access entries created and their attributes"
|
||||
value = module.eks.access_entries
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# KMS Key
|
||||
################################################################################
|
||||
|
||||
output "kms_key_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the key"
|
||||
value = module.eks.kms_key_arn
|
||||
}
|
||||
|
||||
output "kms_key_id" {
|
||||
description = "The globally unique identifier for the key"
|
||||
value = module.eks.kms_key_id
|
||||
}
|
||||
|
||||
output "kms_key_policy" {
|
||||
description = "The IAM resource policy set on the key"
|
||||
value = module.eks.kms_key_policy
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider" {
|
||||
description = "The OpenID Connect identity provider (issuer URL without leading `https://`)"
|
||||
value = module.eks.oidc_provider
|
||||
}
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
output "cluster_tls_certificate_sha1_fingerprint" {
|
||||
description = "The SHA1 fingerprint of the public key of the cluster's certificate"
|
||||
value = module.eks.cluster_tls_certificate_sha1_fingerprint
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
output "eks_managed_node_groups_autoscaling_group_names" {
|
||||
description = "List of the autoscaling group names created by EKS managed node groups"
|
||||
value = module.eks.eks_managed_node_groups_autoscaling_group_names
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
output "self_managed_node_groups_autoscaling_group_names" {
|
||||
description = "List of the autoscaling group names created by self-managed node groups"
|
||||
value = module.eks.self_managed_node_groups_autoscaling_group_names
|
||||
}
|
||||
0
tests/eks-managed-node-group/variables.tf
Normal file
0
tests/eks-managed-node-group/variables.tf
Normal file
10
tests/eks-managed-node-group/versions.tf
Normal file
10
tests/eks-managed-node-group/versions.tf
Normal file
@@ -0,0 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 1.3.2"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 5.40"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user