mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-25 19:01:04 +01:00
feat!: Replace the use of aws-auth configmap with EKS cluster access entry (#2858)
* feat: Replace `resolve_conflicts` with `resolve_conflicts_on_create`/`delete`; raise MSV of AWS provider to `v5.0` to support * fix: Replace dynamic DNS suffix for `sts:AssumeRole` API calls for static suffix * feat: Add module tag * feat: Align Karpenter permissions with Karpenter v1beta1/v0.32 permissions from upstream * refactor: Move `aws-auth` ConfigMap functionality to its own sub-module * chore: Update examples * feat: Add state `moved` block for Karpenter Pod Identity role re-name * fix: Correct variable `create` description * feat: Add support for cluster access entries * chore: Bump MSV of Terraform to `1.3` * fix: Replace defunct kubectl provider with an updated forked equivalent * chore: Update and validate examples for access entry; clean up provider usage * docs: Correct double redundant variable descriptions * feat: Add support for Cloudwatch log group class argument * fix: Update usage tag placement, fix Karpenter event spelling, add upcoming changes section to upgrade guide * feat: Update Karpenter module to generalize naming used and align policy with the upstream Karpenter policy * feat: Add native support for Windows based managed nodegroups similar to AL2 and Bottlerocket * feat: Update self-managed nodegroup module to use latest features of ASG * docs: Update and simplify docs * fix: Correct variable description for AMI types * fix: Update upgrade guide with changes; rename Karpenter controller resource names to support migrating for users * docs: Complete upgrade guide docs for migration and changes applied * Update examples/karpenter/README.md Co-authored-by: Anton Babenko <anton@antonbabenko.com> * Update examples/outposts/README.md Co-authored-by: Anton Babenko <anton@antonbabenko.com> * Update modules/karpenter/README.md Co-authored-by: Anton Babenko <anton@antonbabenko.com> --------- Co-authored-by: Anton Babenko <anton@antonbabenko.com>
This commit is contained in:
Bryant Biggs
@@ -19,23 +19,23 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.57 |
|
||||
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.7 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.34 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.57 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.34 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_disabled_fargate_profile"></a> [disabled\_fargate\_profile](#module\_disabled\_fargate\_profile) | ../../modules/fargate-profile | n/a |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 4.0 |
|
||||
| <a name="module_fargate_profile"></a> [fargate\_profile](#module\_fargate\_profile) | ../../modules/fargate-profile | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
@@ -52,7 +52,7 @@ No inputs.
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_access_entries"></a> [access\_entries](#output\_access\_entries) | Map of access entries created and their attributes |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
|
||||
@@ -6,7 +6,7 @@ data "aws_availability_zones" "available" {}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.27"
|
||||
cluster_version = "1.29"
|
||||
region = "eu-west-1"
|
||||
|
||||
vpc_cidr = "10.0.0.0/16"
|
||||
@@ -54,59 +54,72 @@ module "eks" {
|
||||
}
|
||||
}
|
||||
|
||||
fargate_profiles = merge(
|
||||
{
|
||||
example = {
|
||||
name = "example"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "backend"
|
||||
labels = {
|
||||
Application = "backend"
|
||||
}
|
||||
},
|
||||
{
|
||||
namespace = "app-*"
|
||||
labels = {
|
||||
Application = "app-wildcard"
|
||||
}
|
||||
fargate_profiles = {
|
||||
example = {
|
||||
name = "example"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "backend"
|
||||
labels = {
|
||||
Application = "backend"
|
||||
}
|
||||
},
|
||||
{
|
||||
namespace = "app-*"
|
||||
labels = {
|
||||
Application = "app-wildcard"
|
||||
}
|
||||
]
|
||||
|
||||
# Using specific subnets instead of the subnets supplied for the cluster itself
|
||||
subnet_ids = [module.vpc.private_subnets[1]]
|
||||
|
||||
tags = {
|
||||
Owner = "secondary"
|
||||
}
|
||||
]
|
||||
|
||||
timeouts = {
|
||||
create = "20m"
|
||||
delete = "20m"
|
||||
}
|
||||
}
|
||||
},
|
||||
{ for i in range(3) :
|
||||
"kube-system-${element(split("-", local.azs[i]), 2)}" => {
|
||||
selectors = [
|
||||
{ namespace = "kube-system" }
|
||||
]
|
||||
# We want to create a profile per AZ for high availability
|
||||
subnet_ids = [element(module.vpc.private_subnets, i)]
|
||||
# Using specific subnets instead of the subnets supplied for the cluster itself
|
||||
subnet_ids = [module.vpc.private_subnets[1]]
|
||||
|
||||
tags = {
|
||||
Owner = "secondary"
|
||||
}
|
||||
}
|
||||
)
|
||||
kube-system = {
|
||||
selectors = [
|
||||
{ namespace = "kube-system" }
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Sub-Module Usage on Existing/Separate Cluster
|
||||
################################################################################
|
||||
|
||||
module "fargate_profile" {
|
||||
source = "../../modules/fargate-profile"
|
||||
|
||||
name = "separate-fargate-profile"
|
||||
cluster_name = module.eks.cluster_name
|
||||
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
selectors = [{
|
||||
namespace = "kube-system"
|
||||
}]
|
||||
|
||||
tags = merge(local.tags, { Separate = "fargate-profile" })
|
||||
}
|
||||
|
||||
module "disabled_fargate_profile" {
|
||||
source = "../../modules/fargate-profile"
|
||||
|
||||
create = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 4.0"
|
||||
version = "~> 5.0"
|
||||
|
||||
name = local.name
|
||||
cidr = local.vpc_cidr
|
||||
|
||||
@@ -47,6 +47,15 @@ output "cluster_primary_security_group_id" {
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Access Entry
|
||||
################################################################################
|
||||
|
||||
output "access_entries" {
|
||||
description = "Map of access entries created and their attributes"
|
||||
value = module.eks.access_entries
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# KMS Key
|
||||
################################################################################
|
||||
@@ -200,12 +209,3 @@ output "self_managed_node_groups_autoscaling_group_names" {
|
||||
description = "List of the autoscaling group names created by self-managed node groups"
|
||||
value = module.eks.self_managed_node_groups_autoscaling_group_names
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
|
||||
@@ -1,18 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
required_version = ">= 1.3"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 4.57"
|
||||
}
|
||||
helm = {
|
||||
source = "hashicorp/helm"
|
||||
version = ">= 2.7"
|
||||
}
|
||||
null = {
|
||||
source = "hashicorp/null"
|
||||
version = ">= 3.0"
|
||||
version = ">= 5.34"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user