mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-20 08:33:46 +01:00
feat!: Add support for Outposts, remove node security group, add support for addon preserve and most_recent configurations (#2250)
Co-authored-by: Anton Babenko <anton@antonbabenko.com> Resolves undefined
This commit is contained in:
Bryant Biggs
@@ -14,10 +14,15 @@ provider "kubernetes" {
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
region = "eu-west-1"
|
||||
|
||||
vpc_cidr = "10.0.0.0/16"
|
||||
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
@@ -32,46 +37,56 @@ locals {
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
cluster_name = local.name
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
cluster_addons = {
|
||||
coredns = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
preserve = true
|
||||
most_recent = true
|
||||
|
||||
timeouts = {
|
||||
create = "25m"
|
||||
delete = "10m"
|
||||
}
|
||||
}
|
||||
kube-proxy = {
|
||||
most_recent = true
|
||||
}
|
||||
kube-proxy = {}
|
||||
vpc-cni = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
most_recent = true
|
||||
}
|
||||
}
|
||||
|
||||
# Encryption key
|
||||
create_kms_key = true
|
||||
cluster_encryption_config = [{
|
||||
cluster_encryption_config = {
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
}
|
||||
kms_key_deletion_window_in_days = 7
|
||||
enable_kms_key_rotation = true
|
||||
|
||||
iam_role_additional_policies = {
|
||||
additional = aws_iam_policy.additional.arn
|
||||
}
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
control_plane_subnet_ids = module.vpc.intra_subnets
|
||||
|
||||
# Extend cluster security group rules
|
||||
cluster_security_group_additional_rules = {
|
||||
egress_nodes_ephemeral_ports_tcp = {
|
||||
description = "To node 1025-65535"
|
||||
ingress_nodes_ephemeral_ports_tcp = {
|
||||
description = "Nodes on ephemeral ports"
|
||||
protocol = "tcp"
|
||||
from_port = 1025
|
||||
to_port = 65535
|
||||
type = "egress"
|
||||
type = "ingress"
|
||||
source_node_security_group = true
|
||||
}
|
||||
}
|
||||
|
||||
# Extend node-to-node security group rules
|
||||
node_security_group_ntp_ipv4_cidr_block = ["169.254.169.123/32"]
|
||||
node_security_group_additional_rules = {
|
||||
ingress_self_all = {
|
||||
description = "Node to node all ports/protocols"
|
||||
@@ -81,21 +96,21 @@ module "eks" {
|
||||
type = "ingress"
|
||||
self = true
|
||||
}
|
||||
egress_all = {
|
||||
description = "Node all egress"
|
||||
protocol = "-1"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
type = "egress"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
ipv6_cidr_blocks = ["::/0"]
|
||||
}
|
||||
}
|
||||
|
||||
# Self Managed Node Group(s)
|
||||
self_managed_node_group_defaults = {
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
iam_role_additional_policies = ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"]
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
iam_role_additional_policies = {
|
||||
additional = aws_iam_policy.additional.arn
|
||||
}
|
||||
|
||||
instance_refresh = {
|
||||
strategy = "Rolling"
|
||||
preferences = {
|
||||
min_healthy_percentage = 66
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
self_managed_node_groups = {
|
||||
@@ -106,17 +121,17 @@ module "eks" {
|
||||
}
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
cd /tmp
|
||||
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
|
||||
sudo systemctl enable amazon-ssm-agent
|
||||
sudo systemctl start amazon-ssm-agent
|
||||
cd /tmp
|
||||
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
|
||||
sudo systemctl enable amazon-ssm-agent
|
||||
sudo systemctl start amazon-ssm-agent
|
||||
EOT
|
||||
}
|
||||
}
|
||||
@@ -128,6 +143,9 @@ module "eks" {
|
||||
|
||||
attach_cluster_primary_security_group = true
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
iam_role_additional_policies = {
|
||||
additional = aws_iam_policy.additional.arn
|
||||
}
|
||||
}
|
||||
|
||||
eks_managed_node_groups = {
|
||||
@@ -154,7 +172,7 @@ module "eks" {
|
||||
}
|
||||
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
max_unavailable_percentage = 33 # or set `max_unavailable`
|
||||
}
|
||||
|
||||
tags = {
|
||||
@@ -270,7 +288,6 @@ module "eks_managed_node_group" {
|
||||
cluster_name = module.eks.cluster_name
|
||||
cluster_version = module.eks.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id
|
||||
vpc_security_group_ids = [
|
||||
@@ -305,7 +322,6 @@ module "self_managed_node_group" {
|
||||
|
||||
instance_type = "m5.large"
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
vpc_security_group_ids = [
|
||||
module.eks.cluster_primary_security_group_id,
|
||||
@@ -366,12 +382,12 @@ module "vpc" {
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
cidr = local.vpc_cidr
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
intra_subnets = ["10.0.7.0/28", "10.0.7.16/28", "10.0.7.32/28"]
|
||||
azs = local.azs
|
||||
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
|
||||
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
|
||||
intra_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 52)]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
@@ -382,13 +398,11 @@ module "vpc" {
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
@@ -409,5 +423,22 @@ resource "aws_security_group" "additional" {
|
||||
]
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
tags = merge(local.tags, { Name = "${local.name}-additional" })
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "additional" {
|
||||
name = "${local.name}-additional"
|
||||
|
||||
policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = [
|
||||
"ec2:Describe*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Resource = "*"
|
||||
},
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user