mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-17 23:13:46 +01:00
workers can now be specified as multiple asgs of different flavors. BYO security group now possible for both workers and cluster
This commit is contained in:
brandoconnor
18
cluster.tf
18
cluster.tf
@@ -4,7 +4,7 @@ resource "aws_eks_cluster" "this" {
|
|||||||
version = "${var.cluster_version}"
|
version = "${var.cluster_version}"
|
||||||
|
|
||||||
vpc_config {
|
vpc_config {
|
||||||
security_group_ids = ["${aws_security_group.cluster.id}"]
|
security_group_ids = ["${local.cluster_security_group_id}"]
|
||||||
subnet_ids = ["${var.subnets}"]
|
subnet_ids = ["${var.subnets}"]
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -16,39 +16,43 @@ resource "aws_eks_cluster" "this" {
|
|||||||
|
|
||||||
resource "aws_security_group" "cluster" {
|
resource "aws_security_group" "cluster" {
|
||||||
name_prefix = "${var.cluster_name}"
|
name_prefix = "${var.cluster_name}"
|
||||||
description = "Cluster communication with workers nodes"
|
description = "EKS cluster security group."
|
||||||
vpc_id = "${var.vpc_id}"
|
vpc_id = "${var.vpc_id}"
|
||||||
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_cluster_sg"))}"
|
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_cluster_sg"))}"
|
||||||
|
count = "${var.cluster_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group_rule" "cluster_egress_internet" {
|
resource "aws_security_group_rule" "cluster_egress_internet" {
|
||||||
description = "Allow cluster egress to the Internet."
|
description = "Allow cluster egress access to the Internet."
|
||||||
protocol = "-1"
|
protocol = "-1"
|
||||||
security_group_id = "${aws_security_group.cluster.id}"
|
security_group_id = "${aws_security_group.cluster.id}"
|
||||||
cidr_blocks = ["0.0.0.0/0"]
|
cidr_blocks = ["0.0.0.0/0"]
|
||||||
from_port = 0
|
from_port = 0
|
||||||
to_port = 0
|
to_port = 0
|
||||||
type = "egress"
|
type = "egress"
|
||||||
|
count = "${var.cluster_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
|
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
|
||||||
description = "Allow pods to communicate with the cluster API Server."
|
description = "Allow pods to communicate with the EKS cluster API."
|
||||||
protocol = "tcp"
|
protocol = "tcp"
|
||||||
security_group_id = "${aws_security_group.cluster.id}"
|
security_group_id = "${aws_security_group.cluster.id}"
|
||||||
source_security_group_id = "${aws_security_group.workers.id}"
|
source_security_group_id = "${local.worker_security_group_id}"
|
||||||
from_port = 443
|
from_port = 443
|
||||||
to_port = 443
|
to_port = 443
|
||||||
type = "ingress"
|
type = "ingress"
|
||||||
|
count = "${var.cluster_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group_rule" "cluster_https_cidr_ingress" {
|
resource "aws_security_group_rule" "cluster_https_cidr_ingress" {
|
||||||
cidr_blocks = ["${var.cluster_ingress_cidrs}"]
|
cidr_blocks = ["${local.workstation_external_cidr}"]
|
||||||
description = "Allow communication with the cluster API Server."
|
description = "Allow kubectl communication with the EKS cluster API."
|
||||||
protocol = "tcp"
|
protocol = "tcp"
|
||||||
security_group_id = "${aws_security_group.cluster.id}"
|
security_group_id = "${aws_security_group.cluster.id}"
|
||||||
from_port = 443
|
from_port = 443
|
||||||
to_port = 443
|
to_port = 443
|
||||||
type = "ingress"
|
type = "ingress"
|
||||||
|
count = "${var.cluster_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_iam_role" "cluster" {
|
resource "aws_iam_role" "cluster" {
|
||||||
|
|||||||
28
data.tf
28
data.tf
@@ -1,5 +1,9 @@
|
|||||||
data "aws_region" "current" {}
|
data "aws_region" "current" {}
|
||||||
|
|
||||||
|
data "http" "workstation_external_ip" {
|
||||||
|
url = "http://icanhazip.com"
|
||||||
|
}
|
||||||
|
|
||||||
data "aws_iam_policy_document" "workers_assume_role_policy" {
|
data "aws_iam_policy_document" "workers_assume_role_policy" {
|
||||||
statement {
|
statement {
|
||||||
sid = "EKSWorkerAssumeRole"
|
sid = "EKSWorkerAssumeRole"
|
||||||
@@ -15,6 +19,16 @@ data "aws_iam_policy_document" "workers_assume_role_policy" {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
data "aws_ami" "eks_worker" {
|
||||||
|
filter {
|
||||||
|
name = "name"
|
||||||
|
values = ["eks-worker-*"]
|
||||||
|
}
|
||||||
|
|
||||||
|
most_recent = true
|
||||||
|
owners = ["602401143452"] # Amazon
|
||||||
|
}
|
||||||
|
|
||||||
data "aws_iam_policy_document" "cluster_assume_role_policy" {
|
data "aws_iam_policy_document" "cluster_assume_role_policy" {
|
||||||
statement {
|
statement {
|
||||||
sid = "EKSClusterAssumeRole"
|
sid = "EKSClusterAssumeRole"
|
||||||
@@ -48,3 +62,17 @@ data template_file config_map_aws_auth {
|
|||||||
role_arn = "${aws_iam_role.workers.arn}"
|
role_arn = "${aws_iam_role.workers.arn}"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
data template_file userdata {
|
||||||
|
template = "${file("${path.module}/templates/userdata.sh.tpl")}"
|
||||||
|
count = "${length(var.worker_groups)}"
|
||||||
|
|
||||||
|
vars {
|
||||||
|
region = "${data.aws_region.current.name}"
|
||||||
|
cluster_name = "${var.cluster_name}"
|
||||||
|
endpoint = "${aws_eks_cluster.this.endpoint}"
|
||||||
|
cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
|
||||||
|
max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}"
|
||||||
|
additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
@@ -11,18 +11,16 @@ provider "random" {
|
|||||||
version = "= 1.3.1"
|
version = "= 1.3.1"
|
||||||
}
|
}
|
||||||
|
|
||||||
provider "http" {}
|
|
||||||
provider "local" {}
|
|
||||||
|
|
||||||
data "aws_availability_zones" "available" {}
|
data "aws_availability_zones" "available" {}
|
||||||
|
|
||||||
data "http" "workstation_external_ip" {
|
|
||||||
url = "http://icanhazip.com"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
locals {
|
||||||
workstation_external_cidr = "${chomp(data.http.workstation_external_ip.body)}/32"
|
cluster_name = "test-eks-${random_string.suffix.result}"
|
||||||
cluster_name = "test-eks-${random_string.suffix.result}"
|
|
||||||
|
worker_groups = "${list(
|
||||||
|
map("instance_type","t2.small",
|
||||||
|
"additional_userdata","echo foo bar"
|
||||||
|
),
|
||||||
|
)}"
|
||||||
|
|
||||||
tags = "${map("Environment", "test",
|
tags = "${map("Environment", "test",
|
||||||
"GithubRepo", "terraform-aws-eks",
|
"GithubRepo", "terraform-aws-eks",
|
||||||
@@ -50,13 +48,10 @@ module "vpc" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
module "eks" {
|
module "eks" {
|
||||||
source = "../.."
|
source = "../.."
|
||||||
cluster_name = "${local.cluster_name}"
|
cluster_name = "${local.cluster_name}"
|
||||||
subnets = "${module.vpc.public_subnets}"
|
subnets = "${module.vpc.public_subnets}"
|
||||||
tags = "${local.tags}"
|
tags = "${local.tags}"
|
||||||
vpc_id = "${module.vpc.vpc_id}"
|
vpc_id = "${module.vpc.vpc_id}"
|
||||||
cluster_ingress_cidrs = ["${local.workstation_external_cidr}"]
|
worker_groups = "${local.worker_groups}"
|
||||||
workers_instance_type = "t2.small"
|
|
||||||
additional_userdata = "echo hello world"
|
|
||||||
configure_kubectl_session = true
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,9 +3,9 @@ output "cluster_endpoint" {
|
|||||||
value = "${module.eks.cluster_endpoint}"
|
value = "${module.eks.cluster_endpoint}"
|
||||||
}
|
}
|
||||||
|
|
||||||
output "cluster_security_group_ids" {
|
output "cluster_security_group_id" {
|
||||||
description = "Security group ids attached to the cluster control plane."
|
description = "Security group ids attached to the cluster control plane."
|
||||||
value = "${module.eks.cluster_security_group_ids}"
|
value = "${module.eks.cluster_security_group_id}"
|
||||||
}
|
}
|
||||||
|
|
||||||
output "kubectl_config" {
|
output "kubectl_config" {
|
||||||
|
|||||||
24
kubectl.tf
Normal file
24
kubectl.tf
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
resource "local_file" "kubeconfig" {
|
||||||
|
content = "${data.template_file.kubeconfig.rendered}"
|
||||||
|
filename = "${var.config_output_path}/kubeconfig"
|
||||||
|
count = "${var.configure_kubectl_session ? 1 : 0}"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "local_file" "config_map_aws_auth" {
|
||||||
|
content = "${data.template_file.config_map_aws_auth.rendered}"
|
||||||
|
filename = "${var.config_output_path}/config-map-aws-auth.yaml"
|
||||||
|
count = "${var.configure_kubectl_session ? 1 : 0}"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "null_resource" "configure_kubectl" {
|
||||||
|
provisioner "local-exec" {
|
||||||
|
command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
|
||||||
|
}
|
||||||
|
|
||||||
|
triggers {
|
||||||
|
config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
|
||||||
|
kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
|
||||||
|
}
|
||||||
|
|
||||||
|
count = "${var.configure_kubectl_session ? 1 : 0}"
|
||||||
|
}
|
||||||
210
local.tf
210
local.tf
@@ -1,44 +1,174 @@
|
|||||||
locals {
|
locals {
|
||||||
# More information: https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
# More information: https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
||||||
config_map_aws_auth = <<CONFIGMAPAWSAUTH
|
asg_tags = ["${null_resource.tags_as_list_of_maps.*.triggers}"]
|
||||||
apiVersion: v1
|
cluster_security_group_id = "${var.cluster_security_group_id == "" ? aws_security_group.cluster.id : var.cluster_security_group_id}"
|
||||||
kind: ConfigMap
|
worker_security_group_id = "${var.worker_security_group_id == "" ? aws_security_group.workers.id : var.worker_security_group_id}"
|
||||||
metadata:
|
workstation_external_cidr = "${chomp(data.http.workstation_external_ip.body)}/32"
|
||||||
name: aws-auth
|
|
||||||
namespace: kube-system
|
|
||||||
data:
|
|
||||||
mapRoles: |
|
|
||||||
- rolearn: ${aws_iam_role.workers.arn}
|
|
||||||
username: system:node:{{EC2PrivateDNSName}}
|
|
||||||
groups:
|
|
||||||
- system:bootstrappers
|
|
||||||
- system:nodes
|
|
||||||
CONFIGMAPAWSAUTH
|
|
||||||
|
|
||||||
kubeconfig = <<KUBECONFIG
|
# Mapping from the node type that we selected and the max number of pods that it can run
|
||||||
apiVersion: v1
|
# Taken from https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
||||||
clusters:
|
max_pod_per_node = {
|
||||||
- cluster:
|
c4.large = 29
|
||||||
server: ${aws_eks_cluster.this.endpoint}
|
c4.xlarge = 58
|
||||||
certificate-authority-data: ${aws_eks_cluster.this.certificate_authority.0.data}
|
c4.2xlarge = 58
|
||||||
name: kubernetes
|
c4.4xlarge = 234
|
||||||
contexts:
|
c4.8xlarge = 234
|
||||||
- context:
|
c5.large = 29
|
||||||
cluster: kubernetes
|
c5.xlarge = 58
|
||||||
user: aws
|
c5.2xlarge = 58
|
||||||
name: aws
|
c5.4xlarge = 234
|
||||||
current-context: aws
|
c5.9xlarge = 234
|
||||||
kind: Config
|
c5.18xlarge = 737
|
||||||
preferences: {}
|
i3.large = 29
|
||||||
users:
|
i3.xlarge = 58
|
||||||
- name: aws
|
i3.2xlarge = 58
|
||||||
user:
|
i3.4xlarge = 234
|
||||||
exec:
|
i3.8xlarge = 234
|
||||||
apiVersion: client.authentication.k8s.io/v1alpha1
|
i3.16xlarge = 737
|
||||||
command: heptio-authenticator-aws
|
m3.medium = 12
|
||||||
args:
|
m3.large = 29
|
||||||
- "token"
|
m3.xlarge = 58
|
||||||
- "-i"
|
m3.2xlarge = 118
|
||||||
- "${var.cluster_name}"
|
m4.large = 20
|
||||||
KUBECONFIG
|
m4.xlarge = 58
|
||||||
|
m4.2xlarge = 58
|
||||||
|
m4.4xlarge = 234
|
||||||
|
m4.10xlarge = 234
|
||||||
|
m5.large = 29
|
||||||
|
m5.xlarge = 58
|
||||||
|
m5.2xlarge = 58
|
||||||
|
m5.4xlarge = 234
|
||||||
|
m5.12xlarge = 234
|
||||||
|
m5.24xlarge = 737
|
||||||
|
p2.xlarge = 58
|
||||||
|
p2.8xlarge = 234
|
||||||
|
p2.16xlarge = 234
|
||||||
|
p3.2xlarge = 58
|
||||||
|
p3.8xlarge = 234
|
||||||
|
p3.16xlarge = 234
|
||||||
|
r3.xlarge = 58
|
||||||
|
r3.2xlarge = 58
|
||||||
|
r3.4xlarge = 234
|
||||||
|
r3.8xlarge = 234
|
||||||
|
r4.large = 29
|
||||||
|
r4.xlarge = 58
|
||||||
|
r4.2xlarge = 58
|
||||||
|
r4.4xlarge = 234
|
||||||
|
r4.8xlarge = 234
|
||||||
|
r4.16xlarge = 737
|
||||||
|
t2.small = 8
|
||||||
|
t2.medium = 17
|
||||||
|
t2.large = 35
|
||||||
|
t2.xlarge = 44
|
||||||
|
t2.2xlarge = 44
|
||||||
|
x1.16xlarge = 234
|
||||||
|
x1.32xlarge = 234
|
||||||
|
}
|
||||||
|
|
||||||
|
ebs_optimized_types = {
|
||||||
|
"c4.large" = true
|
||||||
|
"c4.xlarge" = true
|
||||||
|
"c4.2xlarge" = true
|
||||||
|
"c4.4xlarge" = true
|
||||||
|
"c4.8xlarge" = true
|
||||||
|
"c5.large" = true
|
||||||
|
"c5.xlarge" = true
|
||||||
|
"c5.2xlarge" = true
|
||||||
|
"c5.4xlarge" = true
|
||||||
|
"c5.9xlarge" = true
|
||||||
|
"c5.18xlarge" = true
|
||||||
|
"c5d.large" = true
|
||||||
|
"c5d.xlarge" = true
|
||||||
|
"c5d.2xlarge" = true
|
||||||
|
"c5d.4xlarge" = true
|
||||||
|
"c5d.9xlarge" = true
|
||||||
|
"c5d.18xlarge" = true
|
||||||
|
"d2.xlarge" = true
|
||||||
|
"d2.2xlarge" = true
|
||||||
|
"d2.4xlarge" = true
|
||||||
|
"d2.8xlarge" = true
|
||||||
|
"f1.2xlarge" = true
|
||||||
|
"f1.16xlarge" = true
|
||||||
|
"g3.4xlarge" = true
|
||||||
|
"g3.8xlarge" = true
|
||||||
|
"g3.16xlarge" = true
|
||||||
|
"h1.2xlarge" = true
|
||||||
|
"h1.4xlarge" = true
|
||||||
|
"h1.8xlarge" = true
|
||||||
|
"h1.16xlarge" = true
|
||||||
|
"i3.large" = true
|
||||||
|
"i3.xlarge" = true
|
||||||
|
"i3.2xlarge" = true
|
||||||
|
"i3.4xlarge" = true
|
||||||
|
"i3.8xlarge" = true
|
||||||
|
"i3.16xlarge" = true
|
||||||
|
"i3.metal" = true
|
||||||
|
"m4.large" = true
|
||||||
|
"m4.xlarge" = true
|
||||||
|
"m4.2xlarge" = true
|
||||||
|
"m4.4xlarge" = true
|
||||||
|
"m4.10xlarge" = true
|
||||||
|
"m4.16xlarge" = true
|
||||||
|
"m5.large" = true
|
||||||
|
"m5.xlarge" = true
|
||||||
|
"m5.2xlarge" = true
|
||||||
|
"m5.4xlarge" = true
|
||||||
|
"m5.12xlarge" = true
|
||||||
|
"m5.24xlarge" = true
|
||||||
|
"m5d.large" = true
|
||||||
|
"m5d.xlarge" = true
|
||||||
|
"m5d.2xlarge" = true
|
||||||
|
"m5d.4xlarge" = true
|
||||||
|
"m5d.12xlarge" = true
|
||||||
|
"m5d.24xlarge" = true
|
||||||
|
"p2.xlarge" = true
|
||||||
|
"p2.8xlarge" = true
|
||||||
|
"p2.16xlarge" = true
|
||||||
|
"p3.2xlarge" = true
|
||||||
|
"p3.8xlarge" = true
|
||||||
|
"p3.16xlarge" = true
|
||||||
|
"r4.large" = true
|
||||||
|
"r4.xlarge" = true
|
||||||
|
"r4.2xlarge" = true
|
||||||
|
"r4.4xlarge" = true
|
||||||
|
"r4.8xlarge" = true
|
||||||
|
"r4.16xlarge" = true
|
||||||
|
"x1.16xlarge" = true
|
||||||
|
"x1.32xlarge" = true
|
||||||
|
"x1e.xlarge" = true
|
||||||
|
"x1e.2xlarge" = true
|
||||||
|
"x1e.4xlarge" = true
|
||||||
|
"x1e.8xlarge" = true
|
||||||
|
"x1e.16xlarge" = true
|
||||||
|
"x1e.32xlarge" = true
|
||||||
|
"c5.large" = true
|
||||||
|
"c5.xlarge" = true
|
||||||
|
"c5.2xlarge" = true
|
||||||
|
"c5d.large" = true
|
||||||
|
"c5d.xlarge" = true
|
||||||
|
"c5d.2xlarge" = true
|
||||||
|
"m5.large" = true
|
||||||
|
"m5.xlarge" = true
|
||||||
|
"m5.2xlarge" = true
|
||||||
|
"m5d.large" = true
|
||||||
|
"m5d.xlarge" = true
|
||||||
|
"m5d.2xlarge" = true
|
||||||
|
"c1.xlarge" = true
|
||||||
|
"c3.xlarge" = true
|
||||||
|
"c3.2xlarge" = true
|
||||||
|
"c3.4xlarge" = true
|
||||||
|
"g2.2xlarge" = true
|
||||||
|
"i2.xlarge" = true
|
||||||
|
"i2.2xlarge" = true
|
||||||
|
"i2.4xlarge" = true
|
||||||
|
"m1.large" = true
|
||||||
|
"m1.xlarge" = true
|
||||||
|
"m2.2xlarge" = true
|
||||||
|
"m2.4xlarge" = true
|
||||||
|
"m3.xlarge" = true
|
||||||
|
"m3.2xlarge" = true
|
||||||
|
"r3.xlarge" = true
|
||||||
|
"r3.2xlarge" = true
|
||||||
|
"r3.4xlarge" = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
32
main.tf
32
main.tf
@@ -29,7 +29,6 @@
|
|||||||
* subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
* subnets = ["subnet-abcde012", "subnet-bcde012a"]
|
||||||
* tags = "${map("Environment", "test")}"
|
* tags = "${map("Environment", "test")}"
|
||||||
* vpc_id = "vpc-abcde012"
|
* vpc_id = "vpc-abcde012"
|
||||||
* cluster_ingress_cidrs = ["24.18.23.91/32"]
|
|
||||||
* }
|
* }
|
||||||
* ```
|
* ```
|
||||||
|
|
||||||
@@ -53,8 +52,9 @@ are installed and on your shell's PATH.
|
|||||||
* 3. Ensure your AWS environment is configured (i.e. credentials and region) for test.
|
* 3. Ensure your AWS environment is configured (i.e. credentials and region) for test.
|
||||||
* 4. Test using `bundle exec kitchen test` from the root of the repo.
|
* 4. Test using `bundle exec kitchen test` from the root of the repo.
|
||||||
|
|
||||||
For now, connectivity to the kubernetes cluster is not tested but will be in the future.
|
* For now, connectivity to the kubernetes cluster is not tested but will be in the
|
||||||
To test your kubectl connection manually, see the [eks_test_fixture README](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks_test_fixture/README.md).
|
* future. If `configure_kubectl_session` is set `true`, once the test fixture has
|
||||||
|
* converged, you can query the test cluster with `kubectl get nodes --watch --kubeconfig kubeconfig`.
|
||||||
|
|
||||||
* ## Doc generation
|
* ## Doc generation
|
||||||
|
|
||||||
@@ -93,28 +93,4 @@ To test your kubectl connection manually, see the [eks_test_fixture README](http
|
|||||||
|
|
||||||
provider "null" {}
|
provider "null" {}
|
||||||
provider "template" {}
|
provider "template" {}
|
||||||
|
provider "http" {}
|
||||||
resource "local_file" "kubeconfig" {
|
|
||||||
content = "${data.template_file.kubeconfig.rendered}"
|
|
||||||
filename = "${var.config_output_path}/kubeconfig"
|
|
||||||
count = "${var.configure_kubectl_session ? 1 : 0}"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "local_file" "config_map_aws_auth" {
|
|
||||||
content = "${data.template_file.config_map_aws_auth.rendered}"
|
|
||||||
filename = "${var.config_output_path}/config-map-aws-auth.yaml"
|
|
||||||
count = "${var.configure_kubectl_session ? 1 : 0}"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "null_resource" "configure_kubectl" {
|
|
||||||
provisioner "local-exec" {
|
|
||||||
command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
|
|
||||||
}
|
|
||||||
|
|
||||||
triggers {
|
|
||||||
config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
|
|
||||||
kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
|
|
||||||
}
|
|
||||||
|
|
||||||
count = "${var.configure_kubectl_session ? 1 : 0}"
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,9 +0,0 @@
|
|||||||
data "aws_ami" "eks_worker" {
|
|
||||||
filter {
|
|
||||||
name = "name"
|
|
||||||
values = ["eks-worker-*"]
|
|
||||||
}
|
|
||||||
|
|
||||||
most_recent = true
|
|
||||||
owners = ["602401143452"] # Amazon
|
|
||||||
}
|
|
||||||
@@ -1,170 +0,0 @@
|
|||||||
locals {
|
|
||||||
asg_tags = ["${null_resource.tags_as_list_of_maps.*.triggers}"]
|
|
||||||
|
|
||||||
# Mapping from the node type that we selected and the max number of pods that it can run
|
|
||||||
# Taken from https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml
|
|
||||||
max_pod_per_node = {
|
|
||||||
c4.large = 29
|
|
||||||
c4.xlarge = 58
|
|
||||||
c4.2xlarge = 58
|
|
||||||
c4.4xlarge = 234
|
|
||||||
c4.8xlarge = 234
|
|
||||||
c5.large = 29
|
|
||||||
c5.xlarge = 58
|
|
||||||
c5.2xlarge = 58
|
|
||||||
c5.4xlarge = 234
|
|
||||||
c5.9xlarge = 234
|
|
||||||
c5.18xlarge = 737
|
|
||||||
i3.large = 29
|
|
||||||
i3.xlarge = 58
|
|
||||||
i3.2xlarge = 58
|
|
||||||
i3.4xlarge = 234
|
|
||||||
i3.8xlarge = 234
|
|
||||||
i3.16xlarge = 737
|
|
||||||
m3.medium = 12
|
|
||||||
m3.large = 29
|
|
||||||
m3.xlarge = 58
|
|
||||||
m3.2xlarge = 118
|
|
||||||
m4.large = 20
|
|
||||||
m4.xlarge = 58
|
|
||||||
m4.2xlarge = 58
|
|
||||||
m4.4xlarge = 234
|
|
||||||
m4.10xlarge = 234
|
|
||||||
m5.large = 29
|
|
||||||
m5.xlarge = 58
|
|
||||||
m5.2xlarge = 58
|
|
||||||
m5.4xlarge = 234
|
|
||||||
m5.12xlarge = 234
|
|
||||||
m5.24xlarge = 737
|
|
||||||
p2.xlarge = 58
|
|
||||||
p2.8xlarge = 234
|
|
||||||
p2.16xlarge = 234
|
|
||||||
p3.2xlarge = 58
|
|
||||||
p3.8xlarge = 234
|
|
||||||
p3.16xlarge = 234
|
|
||||||
r3.xlarge = 58
|
|
||||||
r3.2xlarge = 58
|
|
||||||
r3.4xlarge = 234
|
|
||||||
r3.8xlarge = 234
|
|
||||||
r4.large = 29
|
|
||||||
r4.xlarge = 58
|
|
||||||
r4.2xlarge = 58
|
|
||||||
r4.4xlarge = 234
|
|
||||||
r4.8xlarge = 234
|
|
||||||
r4.16xlarge = 737
|
|
||||||
t2.small = 8
|
|
||||||
t2.medium = 17
|
|
||||||
t2.large = 35
|
|
||||||
t2.xlarge = 44
|
|
||||||
t2.2xlarge = 44
|
|
||||||
x1.16xlarge = 234
|
|
||||||
x1.32xlarge = 234
|
|
||||||
}
|
|
||||||
|
|
||||||
ebs_optimized_types = {
|
|
||||||
"c4.large" = true
|
|
||||||
"c4.xlarge" = true
|
|
||||||
"c4.2xlarge" = true
|
|
||||||
"c4.4xlarge" = true
|
|
||||||
"c4.8xlarge" = true
|
|
||||||
"c5.large" = true
|
|
||||||
"c5.xlarge" = true
|
|
||||||
"c5.2xlarge" = true
|
|
||||||
"c5.4xlarge" = true
|
|
||||||
"c5.9xlarge" = true
|
|
||||||
"c5.18xlarge" = true
|
|
||||||
"c5d.large" = true
|
|
||||||
"c5d.xlarge" = true
|
|
||||||
"c5d.2xlarge" = true
|
|
||||||
"c5d.4xlarge" = true
|
|
||||||
"c5d.9xlarge" = true
|
|
||||||
"c5d.18xlarge" = true
|
|
||||||
"d2.xlarge" = true
|
|
||||||
"d2.2xlarge" = true
|
|
||||||
"d2.4xlarge" = true
|
|
||||||
"d2.8xlarge" = true
|
|
||||||
"f1.2xlarge" = true
|
|
||||||
"f1.16xlarge" = true
|
|
||||||
"g3.4xlarge" = true
|
|
||||||
"g3.8xlarge" = true
|
|
||||||
"g3.16xlarge" = true
|
|
||||||
"h1.2xlarge" = true
|
|
||||||
"h1.4xlarge" = true
|
|
||||||
"h1.8xlarge" = true
|
|
||||||
"h1.16xlarge" = true
|
|
||||||
"i3.large" = true
|
|
||||||
"i3.xlarge" = true
|
|
||||||
"i3.2xlarge" = true
|
|
||||||
"i3.4xlarge" = true
|
|
||||||
"i3.8xlarge" = true
|
|
||||||
"i3.16xlarge" = true
|
|
||||||
"i3.metal" = true
|
|
||||||
"m4.large" = true
|
|
||||||
"m4.xlarge" = true
|
|
||||||
"m4.2xlarge" = true
|
|
||||||
"m4.4xlarge" = true
|
|
||||||
"m4.10xlarge" = true
|
|
||||||
"m4.16xlarge" = true
|
|
||||||
"m5.large" = true
|
|
||||||
"m5.xlarge" = true
|
|
||||||
"m5.2xlarge" = true
|
|
||||||
"m5.4xlarge" = true
|
|
||||||
"m5.12xlarge" = true
|
|
||||||
"m5.24xlarge" = true
|
|
||||||
"m5d.large" = true
|
|
||||||
"m5d.xlarge" = true
|
|
||||||
"m5d.2xlarge" = true
|
|
||||||
"m5d.4xlarge" = true
|
|
||||||
"m5d.12xlarge" = true
|
|
||||||
"m5d.24xlarge" = true
|
|
||||||
"p2.xlarge" = true
|
|
||||||
"p2.8xlarge" = true
|
|
||||||
"p2.16xlarge" = true
|
|
||||||
"p3.2xlarge" = true
|
|
||||||
"p3.8xlarge" = true
|
|
||||||
"p3.16xlarge" = true
|
|
||||||
"r4.large" = true
|
|
||||||
"r4.xlarge" = true
|
|
||||||
"r4.2xlarge" = true
|
|
||||||
"r4.4xlarge" = true
|
|
||||||
"r4.8xlarge" = true
|
|
||||||
"r4.16xlarge" = true
|
|
||||||
"x1.16xlarge" = true
|
|
||||||
"x1.32xlarge" = true
|
|
||||||
"x1e.xlarge" = true
|
|
||||||
"x1e.2xlarge" = true
|
|
||||||
"x1e.4xlarge" = true
|
|
||||||
"x1e.8xlarge" = true
|
|
||||||
"x1e.16xlarge" = true
|
|
||||||
"x1e.32xlarge" = true
|
|
||||||
"c5.large" = true
|
|
||||||
"c5.xlarge" = true
|
|
||||||
"c5.2xlarge" = true
|
|
||||||
"c5d.large" = true
|
|
||||||
"c5d.xlarge" = true
|
|
||||||
"c5d.2xlarge" = true
|
|
||||||
"m5.large" = true
|
|
||||||
"m5.xlarge" = true
|
|
||||||
"m5.2xlarge" = true
|
|
||||||
"m5d.large" = true
|
|
||||||
"m5d.xlarge" = true
|
|
||||||
"m5d.2xlarge" = true
|
|
||||||
"c1.xlarge" = true
|
|
||||||
"c3.xlarge" = true
|
|
||||||
"c3.2xlarge" = true
|
|
||||||
"c3.4xlarge" = true
|
|
||||||
"g2.2xlarge" = true
|
|
||||||
"i2.xlarge" = true
|
|
||||||
"i2.2xlarge" = true
|
|
||||||
"i2.4xlarge" = true
|
|
||||||
"m1.large" = true
|
|
||||||
"m1.xlarge" = true
|
|
||||||
"m2.2xlarge" = true
|
|
||||||
"m2.4xlarge" = true
|
|
||||||
"m3.xlarge" = true
|
|
||||||
"m3.2xlarge" = true
|
|
||||||
"r3.xlarge" = true
|
|
||||||
"r3.2xlarge" = true
|
|
||||||
"r3.4xlarge" = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,61 +0,0 @@
|
|||||||
resource "aws_autoscaling_group" "workers" {
|
|
||||||
name_prefix = "${lookup(var.worker_groups[count.index], "name")}.${var.cluster_name}"
|
|
||||||
launch_configuration = "${element(aws_launch_configuration.workers.*.id, count.index)}"
|
|
||||||
desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity")}"
|
|
||||||
max_size = "${lookup(var.worker_groups[count.index], "asg_max_size")}"
|
|
||||||
min_size = "${lookup(var.worker_groups[count.index], "asg_min_size")}"
|
|
||||||
vpc_zone_identifier = ["${var.subnets}"]
|
|
||||||
count = "${length(var.worker_groups)}"
|
|
||||||
|
|
||||||
tags = ["${concat(
|
|
||||||
list(
|
|
||||||
map("key", "Name", "value", "${lookup(var.worker_groups[count.index], "name")}.${var.cluster_name}-eks_asg", "propagate_at_launch", true),
|
|
||||||
map("key", "kubernetes.io/cluster/${var.cluster_name}", "value", "owned", "propagate_at_launch", true),
|
|
||||||
),
|
|
||||||
local.asg_tags)
|
|
||||||
}"]
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "aws_launch_configuration" "workers" {
|
|
||||||
name_prefix = "${lookup(var.worker_groups[count.index], "name")}.${lookup(var.worker_groups[count.index], "name")}.${var.cluster_name}"
|
|
||||||
associate_public_ip_address = true
|
|
||||||
iam_instance_profile = "${var.iam_instance_profile}"
|
|
||||||
image_id = "${lookup(var.worker_groups[count.index], "ami_id") == "" ? data.aws_ami.eks_worker.id : lookup(var.worker_groups[count.index], "ami_id")}"
|
|
||||||
instance_type = "${lookup(var.worker_groups[count.index], "instance_type")}"
|
|
||||||
security_groups = ["${var.security_group_id}"]
|
|
||||||
user_data_base64 = "${base64encode(element(data.template_file.userdata.*.rendered, count.index))}"
|
|
||||||
ebs_optimized = "${var.ebs_optimized_workers ? lookup(local.ebs_optimized_types, lookup(var.worker_groups[count.index], "instance_type"), false) : false}"
|
|
||||||
count = "${length(var.worker_groups)}"
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
create_before_destroy = true
|
|
||||||
}
|
|
||||||
|
|
||||||
root_block_device {
|
|
||||||
delete_on_termination = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
data template_file userdata {
|
|
||||||
template = "${file("${path.module}/templates/userdata.sh.tpl")}"
|
|
||||||
count = "${length(var.worker_groups)}"
|
|
||||||
|
|
||||||
vars {
|
|
||||||
region = "${var.aws_region}"
|
|
||||||
max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type"))}"
|
|
||||||
cluster_name = "${var.cluster_name}"
|
|
||||||
endpoint = "${var.endpoint}"
|
|
||||||
cluster_auth_base64 = "${var.certificate_authority}"
|
|
||||||
additional_userdata = "${var.additional_userdata}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "null_resource" "tags_as_list_of_maps" {
|
|
||||||
count = "${length(keys(var.tags))}"
|
|
||||||
|
|
||||||
triggers = "${map(
|
|
||||||
"key", "${element(keys(var.tags), count.index)}",
|
|
||||||
"value", "${element(values(var.tags), count.index)}",
|
|
||||||
"propagate_at_launch", "true"
|
|
||||||
)}"
|
|
||||||
}
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
variable "additional_userdata" {
|
|
||||||
description = "Extra lines of userdata (bash) which are appended to the default userdata code."
|
|
||||||
default = ""
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "aws_region" {
|
|
||||||
description = "The AWS region where the cluster resides."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "certificate_authority" {
|
|
||||||
description = "Base64 encoded certificate authority of the cluster."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "cluster_name" {
|
|
||||||
description = "Name of the EKS cluster which is also used as a prefix in names of related resources."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "ebs_optimized_workers" {
|
|
||||||
description = "If left at default of true, will use ebs optimization if available on the given instance type."
|
|
||||||
default = true
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "endpoint" {
|
|
||||||
description = "API endpoint of the cluster."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "iam_instance_profile" {
|
|
||||||
description = "Worker IAM instance profile name."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "security_group_id" {
|
|
||||||
description = "Worker security group ID."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "subnets" {
|
|
||||||
description = "A list of subnets to associate with the cluster's underlying instances."
|
|
||||||
type = "list"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "tags" {
|
|
||||||
description = "A map of tags to add to all resources."
|
|
||||||
default = {}
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "workers_ami_id" {
|
|
||||||
description = "AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI."
|
|
||||||
default = ""
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "worker_groups" {
|
|
||||||
description = "A list of maps defining worker group configurations."
|
|
||||||
type = "list"
|
|
||||||
|
|
||||||
default = [
|
|
||||||
{
|
|
||||||
name = "nodes" # Name of the worker group.
|
|
||||||
ami_id = "" # AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI.
|
|
||||||
asg_desired_capacity = "1" # Desired worker capacity in the autoscaling group.
|
|
||||||
asg_max_size = "3" # Maximum worker capacity in the autoscaling group.
|
|
||||||
asg_min_size = "1" # Minimum worker capacity in the autoscaling group.
|
|
||||||
instance_type = "m4.large" # Size of the workers instances.
|
|
||||||
},
|
|
||||||
]
|
|
||||||
}
|
|
||||||
37
outputs.tf
37
outputs.tf
@@ -1,15 +1,5 @@
|
|||||||
output "config_map_aws_auth" {
|
|
||||||
description = "A kubernetes configuration to authenticate to this cluster."
|
|
||||||
value = "${data.template_file.config_map_aws_auth.rendered}"
|
|
||||||
}
|
|
||||||
|
|
||||||
output "kubeconfig" {
|
|
||||||
description = "kubectl config file contents for this cluster."
|
|
||||||
value = "${data.template_file.kubeconfig.rendered}"
|
|
||||||
}
|
|
||||||
|
|
||||||
output "cluster_id" {
|
output "cluster_id" {
|
||||||
description = "The name/id of the cluster."
|
description = "The name/id of the EKS cluster."
|
||||||
value = "${aws_eks_cluster.this.id}"
|
value = "${aws_eks_cluster.this.id}"
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -25,16 +15,31 @@ output "cluster_certificate_authority_data" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
output "cluster_endpoint" {
|
output "cluster_endpoint" {
|
||||||
description = "The endpoint for your Kubernetes API server."
|
description = "The endpoint for your EKS Kubernetes API."
|
||||||
value = "${aws_eks_cluster.this.endpoint}"
|
value = "${aws_eks_cluster.this.endpoint}"
|
||||||
}
|
}
|
||||||
|
|
||||||
output "cluster_version" {
|
output "cluster_version" {
|
||||||
description = "The Kubernetes server version for the cluster."
|
description = "The Kubernetes server version for the EKS cluster."
|
||||||
value = "${aws_eks_cluster.this.version}"
|
value = "${aws_eks_cluster.this.version}"
|
||||||
}
|
}
|
||||||
|
|
||||||
output "cluster_security_group_ids" {
|
output "cluster_security_group_id" {
|
||||||
description = "description"
|
description = "Security group ID attached to the EKS cluster."
|
||||||
value = "${aws_eks_cluster.this.vpc_config.0.security_group_ids}"
|
value = "${local.cluster_security_group_id}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "config_map_aws_auth" {
|
||||||
|
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||||
|
value = "${data.template_file.config_map_aws_auth.rendered}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "kubeconfig" {
|
||||||
|
description = "kubectl config file contents for this EKS cluster."
|
||||||
|
value = "${data.template_file.kubeconfig.rendered}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "worker_security_group_id" {
|
||||||
|
description = "Security group ID attached to the EKS workers."
|
||||||
|
value = "${local.worker_security_group_id}"
|
||||||
}
|
}
|
||||||
|
|||||||
66
variables.tf
66
variables.tf
@@ -1,19 +1,14 @@
|
|||||||
variable "additional_userdata" {
|
variable "cluster_name" {
|
||||||
description = "Extra lines of userdata (bash) which are appended to the default userdata code."
|
description = "Name of the EKS cluster. Also used as a prefix in names of related resources."
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "cluster_security_group_id" {
|
||||||
|
description = "If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32."
|
||||||
default = ""
|
default = ""
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "cluster_ingress_cidrs" {
|
|
||||||
description = "The CIDRs from which we can execute kubectl commands."
|
|
||||||
type = "list"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "cluster_name" {
|
|
||||||
description = "Name of the EKS cluster which is also used as a prefix in names of related resources."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "cluster_version" {
|
variable "cluster_version" {
|
||||||
description = "Kubernetes version to use for the cluster."
|
description = "Kubernetes version to use for the EKS cluster."
|
||||||
default = "1.10"
|
default = "1.10"
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -23,17 +18,12 @@ variable "config_output_path" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
variable "configure_kubectl_session" {
|
variable "configure_kubectl_session" {
|
||||||
description = "Configure the current session's kubectl to use the instantiated cluster."
|
description = "Configure the current session's kubectl to use the instantiated EKS cluster."
|
||||||
default = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "ebs_optimized_workers" {
|
|
||||||
description = "If left at default of true, will use ebs optimization if available on the given instance type."
|
|
||||||
default = true
|
default = true
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "subnets" {
|
variable "subnets" {
|
||||||
description = "A list of subnets to associate with the cluster's underlying instances."
|
description = "A list of subnets to place the EKS cluster and workers within."
|
||||||
type = "list"
|
type = "list"
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -43,21 +33,35 @@ variable "tags" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
variable "vpc_id" {
|
variable "vpc_id" {
|
||||||
description = "VPC id where the cluster and other resources will be deployed."
|
description = "VPC where the cluster and workers will be deployed."
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "worker_groups" {
|
variable "worker_groups" {
|
||||||
description = "A list of maps defining worker group configurations."
|
description = "A list of maps defining worker group configurations. See workers_group_defaults for valid keys."
|
||||||
type = "list"
|
type = "list"
|
||||||
|
|
||||||
default = [
|
default = [{
|
||||||
{
|
"name" = "default"
|
||||||
name = "nodes" # Name of the worker group.
|
}]
|
||||||
ami_id = "" # AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI.
|
}
|
||||||
asg_desired_capacity = "1" # Desired worker capacity in the autoscaling group.
|
|
||||||
asg_max_size = "3" # Maximum worker capacity in the autoscaling group.
|
variable "workers_group_defaults" {
|
||||||
asg_min_size = "1" # Minimum worker capacity in the autoscaling group.
|
description = "Default values for target groups as defined by the list of maps."
|
||||||
instance_type = "m4.large" # Size of the workers instances.
|
type = "map"
|
||||||
},
|
|
||||||
]
|
default = {
|
||||||
|
name = "count.index" # Name of the worker group. Literal count.index will never be used but if name is not set, the count.index interpolation will be used.
|
||||||
|
ami_id = "" # AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI.
|
||||||
|
asg_desired_capacity = "1" # Desired worker capacity in the autoscaling group.
|
||||||
|
asg_max_size = "3" # Maximum worker capacity in the autoscaling group.
|
||||||
|
asg_min_size = "1" # Minimum worker capacity in the autoscaling group.
|
||||||
|
instance_type = "m4.large" # Size of the workers instances.
|
||||||
|
additional_userdata = "" # userdata to append to the default userdata.
|
||||||
|
ebs_optimized = true # sets whether to use ebs optimization on supported types.
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "worker_security_group_id" {
|
||||||
|
description = "If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster."
|
||||||
|
default = ""
|
||||||
}
|
}
|
||||||
|
|||||||
63
workers.tf
63
workers.tf
@@ -1,20 +1,46 @@
|
|||||||
module "worker_groups" {
|
resource "aws_autoscaling_group" "workers" {
|
||||||
source = "./modules/worker_groups"
|
name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
|
||||||
aws_region = "{data.aws_region.current.name}"
|
desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}"
|
||||||
cluster_name = "${var.cluster_name}"
|
max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}"
|
||||||
certificate_authority = "${aws_eks_cluster.this.certificate_authority.0.data}"
|
min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}"
|
||||||
endpoint = "${aws_eks_cluster.this.endpoint}"
|
launch_configuration = "${element(aws_launch_configuration.workers.*.id, count.index)}"
|
||||||
iam_instance_profile = "${aws_iam_instance_profile.workers.name}"
|
vpc_zone_identifier = ["${var.subnets}"]
|
||||||
security_group_id = "${aws_security_group.workers.id}"
|
count = "${length(var.worker_groups)}"
|
||||||
subnets = "${var.subnets}"
|
|
||||||
tags = "${var.tags}"
|
tags = ["${concat(
|
||||||
worker_groups = "${var.worker_groups}"
|
list(
|
||||||
|
map("key", "Name", "value", "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true),
|
||||||
|
map("key", "kubernetes.io/cluster/${var.cluster_name}", "value", "owned", "propagate_at_launch", true),
|
||||||
|
),
|
||||||
|
local.asg_tags)
|
||||||
|
}"]
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_launch_configuration" "workers" {
|
||||||
|
name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}-"
|
||||||
|
associate_public_ip_address = true
|
||||||
|
security_groups = ["${local.worker_security_group_id}"]
|
||||||
|
iam_instance_profile = "${aws_iam_instance_profile.workers.id}"
|
||||||
|
image_id = "${lookup(var.worker_groups[count.index], "ami_id", data.aws_ami.eks_worker.id)}"
|
||||||
|
instance_type = "${lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type"))}"
|
||||||
|
user_data_base64 = "${base64encode(element(data.template_file.userdata.*.rendered, count.index))}"
|
||||||
|
ebs_optimized = "${lookup(var.worker_groups[count.index], "ebs_optimized", lookup(local.ebs_optimized_types, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")), false))}"
|
||||||
|
count = "${length(var.worker_groups)}"
|
||||||
|
|
||||||
|
lifecycle {
|
||||||
|
create_before_destroy = true
|
||||||
|
}
|
||||||
|
|
||||||
|
root_block_device {
|
||||||
|
delete_on_termination = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group" "workers" {
|
resource "aws_security_group" "workers" {
|
||||||
name_prefix = "${var.cluster_name}"
|
name_prefix = "${var.cluster_name}"
|
||||||
description = "Security group for all nodes in the cluster."
|
description = "Security group for all nodes in the cluster."
|
||||||
vpc_id = "${var.vpc_id}"
|
vpc_id = "${var.vpc_id}"
|
||||||
|
count = "${var.worker_security_group_id == "" ? 1 : 0}"
|
||||||
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg", "kubernetes.io/cluster/${var.cluster_name}", "owned"
|
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg", "kubernetes.io/cluster/${var.cluster_name}", "owned"
|
||||||
))}"
|
))}"
|
||||||
}
|
}
|
||||||
@@ -27,6 +53,7 @@ resource "aws_security_group_rule" "workers_egress_internet" {
|
|||||||
from_port = 0
|
from_port = 0
|
||||||
to_port = 0
|
to_port = 0
|
||||||
type = "egress"
|
type = "egress"
|
||||||
|
count = "${var.worker_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group_rule" "workers_ingress_self" {
|
resource "aws_security_group_rule" "workers_ingress_self" {
|
||||||
@@ -37,16 +64,18 @@ resource "aws_security_group_rule" "workers_ingress_self" {
|
|||||||
from_port = 0
|
from_port = 0
|
||||||
to_port = 65535
|
to_port = 65535
|
||||||
type = "ingress"
|
type = "ingress"
|
||||||
|
count = "${var.worker_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group_rule" "workers_ingress_cluster" {
|
resource "aws_security_group_rule" "workers_ingress_cluster" {
|
||||||
description = "Allow workers Kubelets and pods to receive communication from the cluster control plane."
|
description = "Allow workers Kubelets and pods to receive communication from the cluster control plane."
|
||||||
protocol = "tcp"
|
protocol = "tcp"
|
||||||
security_group_id = "${aws_security_group.workers.id}"
|
security_group_id = "${aws_security_group.workers.id}"
|
||||||
source_security_group_id = "${aws_security_group.cluster.id}"
|
source_security_group_id = "${local.cluster_security_group_id}"
|
||||||
from_port = 1025
|
from_port = 1025
|
||||||
to_port = 65535
|
to_port = 65535
|
||||||
type = "ingress"
|
type = "ingress"
|
||||||
|
count = "${var.worker_security_group_id == "" ? 1 : 0}"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_iam_role" "workers" {
|
resource "aws_iam_role" "workers" {
|
||||||
@@ -73,3 +102,13 @@ resource "aws_iam_role_policy_attachment" "workers_AmazonEC2ContainerRegistryRea
|
|||||||
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||||
role = "${aws_iam_role.workers.name}"
|
role = "${aws_iam_role.workers.name}"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
resource "null_resource" "tags_as_list_of_maps" {
|
||||||
|
count = "${length(keys(var.tags))}"
|
||||||
|
|
||||||
|
triggers = "${map(
|
||||||
|
"key", "${element(keys(var.tags), count.index)}",
|
||||||
|
"value", "${element(values(var.tags), count.index)}",
|
||||||
|
"propagate_at_launch", "true"
|
||||||
|
)}"
|
||||||
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user