mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-01-19 10:08:00 +01:00
chore: Remove outposts example (#3154)
This commit is contained in:
Bryant Biggs
@@ -1,6 +1,6 @@
|
||||
repos:
|
||||
- repo: https://github.com/antonbabenko/pre-commit-terraform
|
||||
rev: v1.92.2
|
||||
rev: v1.95.0
|
||||
hooks:
|
||||
- id: terraform_fmt
|
||||
- id: terraform_docs
|
||||
|
||||
@@ -160,7 +160,6 @@ module "eks" {
|
||||
|
||||
- [EKS Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks-managed-node-group): EKS Cluster using EKS managed node groups
|
||||
- [Karpenter](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/karpenter): EKS Cluster with [Karpenter](https://karpenter.sh/) provisioned for intelligent data plane management
|
||||
- [Outposts](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/outposts): EKS local cluster provisioned on [AWS Outposts](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts.html)
|
||||
- [Self Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/self-managed-node-group): EKS Cluster using self-managed node groups
|
||||
|
||||
## Contributing
|
||||
@@ -170,7 +169,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
|
||||
- [Code of Conduct](https://github.com/terraform-aws-modules/.github/blob/master/CODE_OF_CONDUCT.md)
|
||||
- [Contributing Guide](https://github.com/terraform-aws-modules/.github/blob/master/CONTRIBUTING.md)
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
<!-- BEGIN_TF_DOCS -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
@@ -365,7 +364,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
| <a name="output_self_managed_node_groups_autoscaling_group_names"></a> [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
<!-- END_TF_DOCS -->
|
||||
|
||||
## License
|
||||
|
||||
|
||||
@@ -1,122 +0,0 @@
|
||||
# EKS on Outposts Example
|
||||
|
||||
Configuration in this directory creates an AWS EKS local cluster on AWS Outposts
|
||||
|
||||
See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts.html) for further details.
|
||||
|
||||
Note: This example requires an an AWS Outpost to provision.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to:
|
||||
|
||||
1. Deploy the remote host where the cluster will be provisioned from. The remote host is required since only private access is permitted to clusters created on Outposts. If you have access to the network where Outposts are provisioned (VPN, etc.), you can skip this step:
|
||||
|
||||
```bash
|
||||
$ cd prerequisites
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply --auto-approve
|
||||
```
|
||||
|
||||
2. If provisioning using the remote host deployed in step 1, connect to the remote host using SSM. Note, you will need to have the [SSM plugin for the AWS CLI installed](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html). You can use the output generated by step 1 to connect:
|
||||
|
||||
```bash
|
||||
$ aws ssm start-session --region <REGION> --target <INSTANCE_ID>
|
||||
```
|
||||
|
||||
3. Once connected to the remote host, navigate to the cloned project example directory and deploy the example:
|
||||
|
||||
```bash
|
||||
$ cd $HOME/terraform-aws-eks/examples/outposts
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply --auto-approve
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
```bash
|
||||
terraform destroy --auto-approve
|
||||
```
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.20 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
|
||||
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.20 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [kubernetes_storage_class_v1.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/storage_class_v1) | resource |
|
||||
| [aws_outposts_outpost_instance_types.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/outposts_outpost_instance_types) | data source |
|
||||
| [aws_outposts_outposts.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/outposts_outposts) | data source |
|
||||
| [aws_subnet.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |
|
||||
| [aws_subnets.lookup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
|
||||
| [aws_subnets.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
|
||||
| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_region"></a> [region](#input\_region) | The AWS region to deploy into (e.g. us-east-1) | `string` | `"us-west-2"` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_access_entries"></a> [access\_entries](#output\_access\_entries) | Map of access entries created and their attributes |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_dualstack_oidc_issuer_url"></a> [cluster\_dualstack\_oidc\_issuer\_url](#output\_cluster\_dualstack\_oidc\_issuer\_url) | Dual-stack compatible URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_ip_family"></a> [cluster\_ip\_family](#output\_cluster\_ip\_family) | The IP family used by the cluster (e.g. `ipv4` or `ipv6`) |
|
||||
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_service_cidr"></a> [cluster\_service\_cidr](#output\_cluster\_service\_cidr) | The CIDR block where Kubernetes pod and service IP addresses are assigned from |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_cluster_tls_certificate_sha1_fingerprint"></a> [cluster\_tls\_certificate\_sha1\_fingerprint](#output\_cluster\_tls\_certificate\_sha1\_fingerprint) | The SHA1 fingerprint of the public key of the cluster's certificate |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_eks_managed_node_groups_autoscaling_group_names"></a> [eks\_managed\_node\_groups\_autoscaling\_group\_names](#output\_eks\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by EKS managed node groups |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_kms_key_arn"></a> [kms\_key\_arn](#output\_kms\_key\_arn) | The Amazon Resource Name (ARN) of the key |
|
||||
| <a name="output_kms_key_id"></a> [kms\_key\_id](#output\_kms\_key\_id) | The globally unique identifier for the key |
|
||||
| <a name="output_kms_key_policy"></a> [kms\_key\_policy](#output\_kms\_key\_policy) | The IAM resource policy set on the key |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider"></a> [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
| <a name="output_self_managed_node_groups_autoscaling_group_names"></a> [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,133 +0,0 @@
|
||||
provider "aws" {
|
||||
region = var.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${basename(path.cwd)}"
|
||||
cluster_version = "1.30"
|
||||
|
||||
outpost_arn = element(tolist(data.aws_outposts_outposts.this.arns), 0)
|
||||
instance_type = element(tolist(data.aws_outposts_outpost_instance_types.this.instance_types), 0)
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
cluster_endpoint_public_access = false # Not available on Outpost
|
||||
cluster_endpoint_private_access = true
|
||||
|
||||
# Gives Terraform identity admin access to cluster which will
|
||||
# allow deploying resources (EBS storage class) into the cluster
|
||||
enable_cluster_creator_admin_permissions = true
|
||||
|
||||
vpc_id = data.aws_vpc.this.id
|
||||
subnet_ids = data.aws_subnets.this.ids
|
||||
|
||||
outpost_config = {
|
||||
control_plane_instance_type = local.instance_type
|
||||
outpost_arns = [local.outpost_arn]
|
||||
}
|
||||
|
||||
# Extend cluster security group rules
|
||||
cluster_security_group_additional_rules = {
|
||||
ingress_vpc_https = {
|
||||
description = "Remote host to control plane"
|
||||
protocol = "tcp"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "ingress"
|
||||
cidr_blocks = [data.aws_vpc.this.cidr_block]
|
||||
}
|
||||
}
|
||||
|
||||
self_managed_node_groups = {
|
||||
outpost = {
|
||||
name = local.name
|
||||
|
||||
min_size = 2
|
||||
max_size = 5
|
||||
desired_size = 3
|
||||
instance_type = local.instance_type
|
||||
|
||||
# Additional information is required to join local clusters to EKS
|
||||
bootstrap_extra_args = <<-EOT
|
||||
--enable-local-outpost true --cluster-id ${module.eks.cluster_id} --container-runtime containerd
|
||||
EOT
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "kubernetes_storage_class_v1" "this" {
|
||||
metadata {
|
||||
name = "ebs-sc"
|
||||
annotations = {
|
||||
"storageclass.kubernetes.io/is-default-class" = "true"
|
||||
}
|
||||
}
|
||||
|
||||
storage_provisioner = "ebs.csi.aws.com"
|
||||
volume_binding_mode = "WaitForFirstConsumer"
|
||||
allow_volume_expansion = true
|
||||
|
||||
parameters = {
|
||||
type = "gp2"
|
||||
encrypted = "true"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_outposts_outposts" "this" {}
|
||||
|
||||
data "aws_outposts_outpost_instance_types" "this" {
|
||||
arn = local.outpost_arn
|
||||
}
|
||||
|
||||
# This just grabs the first Outpost and returns its subnets
|
||||
data "aws_subnets" "lookup" {
|
||||
filter {
|
||||
name = "outpost-arn"
|
||||
values = [local.outpost_arn]
|
||||
}
|
||||
}
|
||||
|
||||
# This grabs a single subnet to reverse lookup those that belong to same VPC
|
||||
# This is whats used for the cluster
|
||||
data "aws_subnet" "this" {
|
||||
id = element(tolist(data.aws_subnets.lookup.ids), 0)
|
||||
}
|
||||
|
||||
# These are subnets for the Outpost and restricted to the same VPC
|
||||
# This is whats used for the cluster
|
||||
data "aws_subnets" "this" {
|
||||
filter {
|
||||
name = "outpost-arn"
|
||||
values = [local.outpost_arn]
|
||||
}
|
||||
|
||||
filter {
|
||||
name = "vpc-id"
|
||||
values = [data.aws_subnet.this.vpc_id]
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_vpc" "this" {
|
||||
id = data.aws_subnet.this.vpc_id
|
||||
}
|
||||
@@ -1,226 +0,0 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_name" {
|
||||
description = "The name of the EKS cluster"
|
||||
value = module.eks.cluster_name
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_dualstack_oidc_issuer_url" {
|
||||
description = "Dual-stack compatible URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_dualstack_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
output "cluster_service_cidr" {
|
||||
description = "The CIDR block where Kubernetes pod and service IP addresses are assigned from"
|
||||
value = module.eks.cluster_service_cidr
|
||||
}
|
||||
|
||||
output "cluster_ip_family" {
|
||||
description = "The IP family used by the cluster (e.g. `ipv4` or `ipv6`)"
|
||||
value = module.eks.cluster_ip_family
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Access Entry
|
||||
################################################################################
|
||||
|
||||
output "access_entries" {
|
||||
description = "Map of access entries created and their attributes"
|
||||
value = module.eks.access_entries
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# KMS Key
|
||||
################################################################################
|
||||
|
||||
output "kms_key_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the key"
|
||||
value = module.eks.kms_key_arn
|
||||
}
|
||||
|
||||
output "kms_key_id" {
|
||||
description = "The globally unique identifier for the key"
|
||||
value = module.eks.kms_key_id
|
||||
}
|
||||
|
||||
output "kms_key_policy" {
|
||||
description = "The IAM resource policy set on the key"
|
||||
value = module.eks.kms_key_policy
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider" {
|
||||
description = "The OpenID Connect identity provider (issuer URL without leading `https://`)"
|
||||
value = module.eks.oidc_provider
|
||||
}
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
output "cluster_tls_certificate_sha1_fingerprint" {
|
||||
description = "The SHA1 fingerprint of the public key of the cluster's certificate"
|
||||
value = module.eks.cluster_tls_certificate_sha1_fingerprint
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
output "eks_managed_node_groups_autoscaling_group_names" {
|
||||
description = "List of the autoscaling group names created by EKS managed node groups"
|
||||
value = module.eks.eks_managed_node_groups_autoscaling_group_names
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
output "self_managed_node_groups_autoscaling_group_names" {
|
||||
description = "List of the autoscaling group names created by self-managed node groups"
|
||||
value = module.eks.self_managed_node_groups_autoscaling_group_names
|
||||
}
|
||||
@@ -1,149 +0,0 @@
|
||||
provider "aws" {
|
||||
region = var.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${basename(path.cwd)}"
|
||||
|
||||
terraform_version = "1.3.6"
|
||||
|
||||
outpost_arn = element(tolist(data.aws_outposts_outposts.this.arns), 0)
|
||||
instance_type = element(tolist(data.aws_outposts_outpost_instance_types.this.instance_types), 0)
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Pre-Requisites
|
||||
################################################################################
|
||||
|
||||
module "ssm_bastion_ec2" {
|
||||
source = "terraform-aws-modules/ec2-instance/aws"
|
||||
version = "~> 5.5"
|
||||
|
||||
name = "${local.name}-bastion"
|
||||
|
||||
create_iam_instance_profile = true
|
||||
iam_role_policies = {
|
||||
AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
|
||||
}
|
||||
|
||||
instance_type = local.instance_type
|
||||
|
||||
user_data = <<-EOT
|
||||
#!/bin/bash
|
||||
|
||||
# Add ssm-user since it won't exist until first login
|
||||
adduser -m ssm-user
|
||||
tee /etc/sudoers.d/ssm-agent-users <<'EOF'
|
||||
# User rules for ssm-user
|
||||
ssm-user ALL=(ALL) NOPASSWD:ALL
|
||||
EOF
|
||||
chmod 440 /etc/sudoers.d/ssm-agent-users
|
||||
|
||||
cd /home/ssm-user
|
||||
|
||||
# Install git to clone repo
|
||||
yum install git -y
|
||||
|
||||
# Install Terraform
|
||||
curl -sSO https://releases.hashicorp.com/terraform/${local.terraform_version}/terraform_${local.terraform_version}_linux_amd64.zip
|
||||
sudo unzip -qq terraform_${local.terraform_version}_linux_amd64.zip terraform -d /usr/bin/
|
||||
rm terraform_${local.terraform_version}_linux_amd64.zip 2> /dev/null
|
||||
|
||||
# Install kubectl
|
||||
curl -LO https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl
|
||||
install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
|
||||
|
||||
# Remove default awscli which is v1 - we want latest v2
|
||||
yum remove awscli -y
|
||||
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
|
||||
unzip -qq awscliv2.zip
|
||||
./aws/install
|
||||
|
||||
# Clone repo
|
||||
git clone https://github.com/terraform-aws-modules/terraform-aws-eks.git \
|
||||
&& cd /home/ssm-user/terraform-aws-eks
|
||||
|
||||
chown -R ssm-user:ssm-user /home/ssm-user/
|
||||
EOT
|
||||
|
||||
vpc_security_group_ids = [module.bastion_security_group.security_group_id]
|
||||
subnet_id = element(data.aws_subnets.this.ids, 0)
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
module "bastion_security_group" {
|
||||
source = "terraform-aws-modules/security-group/aws"
|
||||
version = "~> 5.0"
|
||||
|
||||
name = "${local.name}-bastion"
|
||||
description = "Security group to allow provisioning ${local.name} EKS local cluster on Outposts"
|
||||
vpc_id = data.aws_vpc.this.id
|
||||
|
||||
ingress_with_cidr_blocks = [
|
||||
{
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
protocol = "tcp"
|
||||
cidr_blocks = data.aws_vpc.this.cidr_block
|
||||
},
|
||||
]
|
||||
egress_with_cidr_blocks = [
|
||||
{
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = "0.0.0.0/0"
|
||||
},
|
||||
]
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_outposts_outposts" "this" {}
|
||||
|
||||
data "aws_outposts_outpost_instance_types" "this" {
|
||||
arn = local.outpost_arn
|
||||
}
|
||||
|
||||
# This just grabs the first Outpost and returns its subnets
|
||||
data "aws_subnets" "lookup" {
|
||||
filter {
|
||||
name = "outpost-arn"
|
||||
values = [local.outpost_arn]
|
||||
}
|
||||
}
|
||||
|
||||
# This grabs a single subnet to reverse lookup those that belong to same VPC
|
||||
# This is whats used for the cluster
|
||||
data "aws_subnet" "this" {
|
||||
id = element(tolist(data.aws_subnets.lookup.ids), 0)
|
||||
}
|
||||
|
||||
# These are subnets for the Outpost and restricted to the same VPC
|
||||
# This is whats used for the cluster
|
||||
data "aws_subnets" "this" {
|
||||
filter {
|
||||
name = "outpost-arn"
|
||||
values = [local.outpost_arn]
|
||||
}
|
||||
|
||||
filter {
|
||||
name = "vpc-id"
|
||||
values = [data.aws_subnet.this.vpc_id]
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_vpc" "this" {
|
||||
id = data.aws_subnet.this.vpc_id
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
output "ssm_start_session" {
|
||||
description = "SSM start session command to connect to remote host created"
|
||||
value = "aws ssm start-session --region ${var.region} --target ${module.ssm_bastion_ec2.id}"
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
variable "region" {
|
||||
description = "The AWS region to deploy into (e.g. us-east-1)"
|
||||
type = string
|
||||
default = "us-west-2"
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.3.2"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 5.61"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
variable "region" {
|
||||
description = "The AWS region to deploy into (e.g. us-east-1)"
|
||||
type = string
|
||||
default = "us-west-2"
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.3.2"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 5.61"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 2.20"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user