mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-25 02:41:03 +01:00
feat!: Add support for Outposts, remove node security group, add support for addon preserve and most_recent configurations (#2250)
Co-authored-by: Anton Babenko <anton@antonbabenko.com> Resolves undefined
This commit is contained in:
Bryant Biggs
@@ -19,8 +19,8 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.45 |
|
||||
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.7 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
|
||||
@@ -28,7 +28,7 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.45 |
|
||||
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.7 |
|
||||
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
|
||||
|
||||
@@ -43,10 +43,11 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_iam_policy.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [helm_release.coredns](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [null_resource.modify_kube_dns](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [null_resource.remove_default_coredns_deployment](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_addon_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_addon_version) | data source |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
@@ -68,9 +69,9 @@ No inputs.
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
|
||||
@@ -16,11 +16,16 @@ provider "helm" {
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.24"
|
||||
region = "eu-west-1"
|
||||
|
||||
vpc_cidr = "10.0.0.0/16"
|
||||
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
@@ -35,28 +40,29 @@ locals {
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
cluster_addons = {
|
||||
kube-proxy = {}
|
||||
vpc-cni = {}
|
||||
}
|
||||
|
||||
cluster_encryption_config = [{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
control_plane_subnet_ids = module.vpc.intra_subnets
|
||||
|
||||
# Fargate profiles use the cluster primary security group so these are not utilized
|
||||
create_cluster_security_group = false
|
||||
create_node_security_group = false
|
||||
|
||||
fargate_profile_defaults = {
|
||||
iam_role_additional_policies = {
|
||||
additional = aws_iam_policy.additional.arn
|
||||
}
|
||||
}
|
||||
|
||||
fargate_profiles = {
|
||||
example = {
|
||||
name = "example"
|
||||
@@ -231,11 +237,12 @@ module "vpc" {
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
cidr = local.vpc_cidr
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
azs = local.azs
|
||||
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
|
||||
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
|
||||
intra_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 52)]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
@@ -246,22 +253,29 @@ module "vpc" {
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
resource "aws_iam_policy" "additional" {
|
||||
name = "${local.name}-additional"
|
||||
|
||||
tags = local.tags
|
||||
policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = [
|
||||
"ec2:Describe*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Resource = "*"
|
||||
},
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
@@ -17,14 +17,14 @@ output "cluster_endpoint" {
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_name" {
|
||||
description = "The name of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_name
|
||||
output "cluster_id" {
|
||||
description = "The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
output "cluster_name" {
|
||||
description = "The name of the EKS cluster"
|
||||
value = module.eks.cluster_name
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.72"
|
||||
version = ">= 4.45"
|
||||
}
|
||||
helm = {
|
||||
source = "hashicorp/helm"
|
||||
|
||||
Reference in New Issue
Block a user