mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-05-01 21:04:27 +02:00
feat!: Removed support for launch configuration and replace count with for_each (#1680)
This commit is contained in:
Bryant Biggs
@@ -1,75 +0,0 @@
|
||||
# AWS EKS cluster running Bottlerocket AMI
|
||||
|
||||
Configuration in this directory creates EKS cluster with workers group running [AWS Bottlerocket OS](https://github.com/bottlerocket-os/bottlerocket)
|
||||
|
||||
This is a minimalistic example which shows what knobs to turn to make Bottlerocket work.
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami-bottlerocket.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 2.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 2.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_iam_role_policy_attachment.ssm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
|
||||
| [aws_key_pair.nodes](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [tls_private_key.nodes](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
|
||||
| [aws_ami.bottlerocket_ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
| <a name="output_node_groups"></a> [node\_groups](#output\_node\_groups) | Outputs from node groups |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,159 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "bottlerocket-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = [module.vpc.private_subnets[0], module.vpc.public_subnets[1]]
|
||||
fargate_subnets = [module.vpc.private_subnets[2]]
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
write_kubeconfig = false
|
||||
manage_aws_auth = true
|
||||
|
||||
worker_groups_launch_template = [
|
||||
{
|
||||
name = "bottlerocket-nodes"
|
||||
ami_id = data.aws_ami.bottlerocket_ami.id
|
||||
instance_type = "t3a.small"
|
||||
asg_desired_capacity = 2
|
||||
key_name = aws_key_pair.nodes.key_name
|
||||
|
||||
# Since we are using default VPC there is no NAT gateway so we need to
|
||||
# attach public ip to nodes so they can reach k8s API server
|
||||
# do not repeat this at home (i.e. production)
|
||||
public_ip = true
|
||||
|
||||
# This section overrides default userdata template to pass bottlerocket
|
||||
# specific user data
|
||||
userdata_template_file = "${path.module}/userdata.toml"
|
||||
# we are using this section to pass additional arguments for
|
||||
# userdata template rendering
|
||||
userdata_template_extra_args = {
|
||||
enable_admin_container = false
|
||||
enable_control_container = true
|
||||
aws_region = data.aws_region.current.name
|
||||
}
|
||||
# example of k8s/kubelet configuration via additional_userdata
|
||||
additional_userdata = <<EOT
|
||||
[settings.kubernetes.node-labels]
|
||||
ingress = "allowed"
|
||||
EOT
|
||||
}
|
||||
]
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
# SSM policy for bottlerocket control container access
|
||||
# https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md#enabling-ssm
|
||||
resource "aws_iam_role_policy_attachment" "ssm" {
|
||||
role = module.eks.worker_iam_role_name
|
||||
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_region" "current" {}
|
||||
|
||||
data "aws_ami" "bottlerocket_ami" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["bottlerocket-aws-k8s-${local.cluster_version}-x86_64-*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "tls_private_key" "nodes" {
|
||||
algorithm = "RSA"
|
||||
}
|
||||
|
||||
resource "aws_key_pair" "nodes" {
|
||||
key_name = "bottlerocket-nodes-${random_string.suffix.result}"
|
||||
public_key = tls_private_key.nodes.public_key_openssh
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
|
||||
output "node_groups" {
|
||||
description = "Outputs from node groups"
|
||||
value = module.eks.node_groups
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
# https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md#description-of-settings
|
||||
[settings.kubernetes]
|
||||
api-server = "${endpoint}"
|
||||
cluster-certificate = "${cluster_auth_base64}"
|
||||
cluster-name = "${cluster_name}"
|
||||
${additional_userdata}
|
||||
|
||||
# Hardening based on https://github.com/bottlerocket-os/bottlerocket/blob/develop/SECURITY_GUIDANCE.md
|
||||
|
||||
# Enable kernel lockdown in "integrity" mode.
|
||||
# This prevents modifications to the running kernel, even by privileged users.
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
|
||||
# The admin host container provides SSH access and runs with "superpowers".
|
||||
# It is disabled by default, but can be disabled explicitly.
|
||||
[settings.host-containers.admin]
|
||||
enabled = ${enable_admin_container}
|
||||
|
||||
# The control host container provides out-of-band access via SSM.
|
||||
# It is enabled by default, and can be disabled if you do not expect to use SSM.
|
||||
# This could leave you with no way to access the API and change settings on an existing node!
|
||||
[settings.host-containers.control]
|
||||
enabled = ${enable_control_container}
|
||||
@@ -1,26 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
tls = {
|
||||
source = "hashicorp/tls"
|
||||
version = ">= 2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,10 +1,20 @@
|
||||
# Complete AWS EKS Cluster
|
||||
|
||||
Configuration in this directory creates EKS cluster with different features shown all-in-one cluster (e.g. Managed Node Groups, Worker Groups, Fargate, Spot instances, AWS Auth enabled).
|
||||
Configuration in this directory creates an AWS EKS cluster with a broad mix of various features and settings provided by this module:
|
||||
|
||||
This example can be used to do smoke test.
|
||||
|
||||
See configurations in other `examples` directories for more specific cases.
|
||||
- AWS EKS cluster
|
||||
- Disabled EKS cluster
|
||||
- Self managed node group
|
||||
- Externally attached self managed node group
|
||||
- Disabled self managed node group
|
||||
- EKS managed node group
|
||||
- Externally attached EKS managed node group
|
||||
- Disabled self managed node group
|
||||
- Fargate profile
|
||||
- Externally attached Fargate profile
|
||||
- Disabled Fargate profile
|
||||
- Cluster addons: CoreDNS, Kube-Proxy, and VPC-CNI
|
||||
- IAM roles for service accounts
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -24,39 +34,38 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64 |
|
||||
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_disabled_eks"></a> [disabled\_eks](#module\_disabled\_eks) | ../.. | n/a |
|
||||
| <a name="module_disabled_fargate"></a> [disabled\_fargate](#module\_disabled\_fargate) | ../../modules/fargate | n/a |
|
||||
| <a name="module_disabled_node_groups"></a> [disabled\_node\_groups](#module\_disabled\_node\_groups) | ../../modules/node_groups | n/a |
|
||||
| <a name="module_disabled_eks_managed_node_group"></a> [disabled\_eks\_managed\_node\_group](#module\_disabled\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
|
||||
| <a name="module_disabled_fargate_profile"></a> [disabled\_fargate\_profile](#module\_disabled\_fargate\_profile) | ../../modules/fargate-profile | n/a |
|
||||
| <a name="module_disabled_self_managed_node_group"></a> [disabled\_self\_managed\_node\_group](#module\_disabled\_self\_managed\_node\_group) | ../../modules/self-managed-node-group | n/a |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_eks_managed_node_group"></a> [eks\_managed\_node\_group](#module\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
|
||||
| <a name="module_fargate_profile"></a> [fargate\_profile](#module\_fargate\_profile) | ../../modules/fargate-profile | n/a |
|
||||
| <a name="module_self_managed_node_group"></a> [self\_managed\_node\_group](#module\_self\_managed\_node\_group) | ../../modules/self-managed-node-group | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_security_group.all_worker_mgmt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [aws_security_group.worker_group_mgmt_one](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [aws_security_group.worker_group_mgmt_two](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_security_group.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [null_resource.patch](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
@@ -66,9 +75,25 @@ No inputs.
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
| <a name="output_node_groups"></a> [node\_groups](#output\_node\_groups) | Outputs from node groups |
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
|
||||
@@ -3,9 +3,15 @@ provider "aws" {
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "complete-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.21"
|
||||
region = "eu-west-1"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -15,87 +21,102 @@ locals {
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = [module.vpc.private_subnets[0], module.vpc.public_subnets[1]]
|
||||
fargate_subnets = [module.vpc.private_subnets[2]]
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
|
||||
|
||||
worker_additional_security_group_ids = [aws_security_group.all_worker_mgmt.id]
|
||||
|
||||
# Worker groups (using Launch Configurations)
|
||||
worker_groups = [
|
||||
{
|
||||
name = "worker-group-1"
|
||||
instance_type = "t3.small"
|
||||
additional_userdata = "echo foo bar"
|
||||
asg_desired_capacity = 2
|
||||
additional_security_group_ids = [aws_security_group.worker_group_mgmt_one.id]
|
||||
},
|
||||
{
|
||||
name = "worker-group-2"
|
||||
instance_type = "t3.medium"
|
||||
additional_userdata = "echo foo bar"
|
||||
additional_security_group_ids = [aws_security_group.worker_group_mgmt_two.id]
|
||||
asg_desired_capacity = 1
|
||||
},
|
||||
]
|
||||
|
||||
# Worker groups (using Launch Templates)
|
||||
worker_groups_launch_template = [
|
||||
{
|
||||
name = "spot-1"
|
||||
override_instance_types = ["m5.large", "m5a.large", "m5d.large", "m5ad.large"]
|
||||
spot_instance_pools = 4
|
||||
asg_max_size = 5
|
||||
asg_desired_capacity = 5
|
||||
kubelet_extra_args = "--node-labels=node.kubernetes.io/lifecycle=spot"
|
||||
public_ip = true
|
||||
},
|
||||
]
|
||||
|
||||
# Managed Node Groups
|
||||
node_groups_defaults = {
|
||||
ami_type = "AL2_x86_64"
|
||||
disk_size = 50
|
||||
cluster_addons = {
|
||||
coredns = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
kube-proxy = {}
|
||||
vpc-cni = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
}
|
||||
|
||||
node_groups = {
|
||||
example = {
|
||||
desired_capacity = 1
|
||||
max_capacity = 10
|
||||
min_capacity = 1
|
||||
cluster_encryption_config = [{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
# Self Managed Node Group(s)
|
||||
self_managed_node_group_defaults = {
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
iam_role_additional_policies = ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"]
|
||||
}
|
||||
|
||||
self_managed_node_groups = {
|
||||
spot = {
|
||||
instance_type = "m5.large"
|
||||
instance_market_options = {
|
||||
market_type = "spot"
|
||||
}
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
cd /tmp
|
||||
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
|
||||
sudo systemctl enable amazon-ssm-agent
|
||||
sudo systemctl start amazon-ssm-agent
|
||||
EOT
|
||||
}
|
||||
}
|
||||
|
||||
# EKS Managed Node Group(s)
|
||||
eks_managed_node_group_defaults = {
|
||||
ami_type = "AL2_x86_64"
|
||||
disk_size = 50
|
||||
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
}
|
||||
|
||||
eks_managed_node_groups = {
|
||||
blue = {}
|
||||
green = {
|
||||
min_size = 1
|
||||
max_size = 10
|
||||
desired_size = 1
|
||||
|
||||
instance_types = ["t3.large"]
|
||||
capacity_type = "SPOT"
|
||||
k8s_labels = {
|
||||
labels = {
|
||||
Environment = "test"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
additional_tags = {
|
||||
ExtraTag = "example"
|
||||
}
|
||||
taints = [
|
||||
{
|
||||
|
||||
taints = {
|
||||
dedicated = {
|
||||
key = "dedicated"
|
||||
value = "gpuGroup"
|
||||
effect = "NO_SCHEDULE"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
|
||||
tags = {
|
||||
ExtraTag = "example"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Fargate
|
||||
# Fargate Profile(s)
|
||||
fargate_profiles = {
|
||||
default = {
|
||||
name = "default"
|
||||
@@ -122,38 +143,59 @@ module "eks" {
|
||||
}
|
||||
}
|
||||
|
||||
# AWS Auth (kubernetes_config_map)
|
||||
map_roles = [
|
||||
{
|
||||
rolearn = "arn:aws:iam::66666666666:role/role1"
|
||||
username = "role1"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Sub-Module Usage on Existing/Separate Cluster
|
||||
################################################################################
|
||||
|
||||
module "eks_managed_node_group" {
|
||||
source = "../../modules/eks-managed-node-group"
|
||||
|
||||
name = "separate-eks-mng"
|
||||
cluster_name = module.eks.cluster_id
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
tags = merge(local.tags, { Separate = "eks-managed-node-group" })
|
||||
}
|
||||
|
||||
module "self_managed_node_group" {
|
||||
source = "../../modules/self-managed-node-group"
|
||||
|
||||
name = "separate-self-mng"
|
||||
cluster_name = module.eks.cluster_id
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint = module.eks.cluster_endpoint
|
||||
cluster_auth_base64 = module.eks.cluster_certificate_authority_data
|
||||
|
||||
instance_type = "m5.large"
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
vpc_security_group_ids = [
|
||||
module.eks.cluster_primary_security_group_id,
|
||||
module.eks.cluster_security_group_id,
|
||||
]
|
||||
|
||||
map_users = [
|
||||
{
|
||||
userarn = "arn:aws:iam::66666666666:user/user1"
|
||||
username = "user1"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
{
|
||||
userarn = "arn:aws:iam::66666666666:user/user2"
|
||||
username = "user2"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
]
|
||||
tags = merge(local.tags, { Separate = "self-managed-node-group" })
|
||||
}
|
||||
|
||||
map_accounts = [
|
||||
"777777777777",
|
||||
"888888888888",
|
||||
]
|
||||
module "fargate_profile" {
|
||||
source = "../../modules/fargate-profile"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
name = "separate-fargate-profile"
|
||||
cluster_name = module.eks.cluster_id
|
||||
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
selectors = [{
|
||||
namespace = "kube-system"
|
||||
}]
|
||||
|
||||
tags = merge(local.tags, { Separate = "fargate-profile" })
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -163,87 +205,98 @@ module "eks" {
|
||||
module "disabled_eks" {
|
||||
source = "../.."
|
||||
|
||||
create_eks = false
|
||||
create = false
|
||||
}
|
||||
|
||||
module "disabled_fargate" {
|
||||
source = "../../modules/fargate"
|
||||
module "disabled_fargate_profile" {
|
||||
source = "../../modules/fargate-profile"
|
||||
|
||||
create_fargate_pod_execution_role = false
|
||||
create = false
|
||||
}
|
||||
|
||||
module "disabled_node_groups" {
|
||||
source = "../../modules/node_groups"
|
||||
module "disabled_eks_managed_node_group" {
|
||||
source = "../../modules/eks-managed-node-group"
|
||||
|
||||
create_eks = false
|
||||
create = false
|
||||
}
|
||||
|
||||
module "disabled_self_managed_node_group" {
|
||||
source = "../../modules/self-managed-node-group"
|
||||
|
||||
create = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
# aws-auth configmap
|
||||
# Only EKS managed node groups automatically add roles to aws-auth configmap
|
||||
# so we need to ensure fargate profiles and self-managed node roles are added
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
data "aws_eks_cluster_auth" "this" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
locals {
|
||||
kubeconfig = yamlencode({
|
||||
apiVersion = "v1"
|
||||
kind = "Config"
|
||||
current-context = "terraform"
|
||||
clusters = [{
|
||||
name = module.eks.cluster_id
|
||||
cluster = {
|
||||
certificate-authority-data = module.eks.cluster_certificate_authority_data
|
||||
server = module.eks.cluster_endpoint
|
||||
}
|
||||
}]
|
||||
contexts = [{
|
||||
name = "terraform"
|
||||
context = {
|
||||
cluster = module.eks.cluster_id
|
||||
user = "terraform"
|
||||
}
|
||||
}]
|
||||
users = [{
|
||||
name = "terraform"
|
||||
user = {
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
}]
|
||||
})
|
||||
|
||||
# we have to combine the configmap created by the eks module with the externally created node group/profile sub-modules
|
||||
aws_auth_configmap_yaml = <<-EOT
|
||||
${chomp(module.eks.aws_auth_configmap_yaml)}
|
||||
- rolearn: ${module.eks_managed_node_group.iam_role_arn}
|
||||
username: system:node:{{EC2PrivateDNSName}}
|
||||
groups:
|
||||
- system:bootstrappers
|
||||
- system:nodes
|
||||
- rolearn: ${module.self_managed_node_group.iam_role_arn}
|
||||
username: system:node:{{EC2PrivateDNSName}}
|
||||
groups:
|
||||
- system:bootstrappers
|
||||
- system:nodes
|
||||
- rolearn: ${module.fargate_profile.fargate_profile_arn}
|
||||
username: system:node:{{SessionName}}
|
||||
groups:
|
||||
- system:bootstrappers
|
||||
- system:nodes
|
||||
- system:node-proxier
|
||||
EOT
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional security groups for workers
|
||||
################################################################################
|
||||
|
||||
resource "aws_security_group" "worker_group_mgmt_one" {
|
||||
name_prefix = "worker_group_mgmt_one"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
|
||||
cidr_blocks = [
|
||||
"10.0.0.0/8",
|
||||
]
|
||||
resource "null_resource" "patch" {
|
||||
triggers = {
|
||||
kubeconfig = base64encode(local.kubeconfig)
|
||||
cmd_patch = "kubectl patch configmap/aws-auth --patch \"${local.aws_auth_configmap_yaml}\" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group" "worker_group_mgmt_two" {
|
||||
name_prefix = "worker_group_mgmt_two"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
|
||||
cidr_blocks = [
|
||||
"192.168.0.0/16",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group" "all_worker_mgmt" {
|
||||
name_prefix = "all_worker_management"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
|
||||
cidr_blocks = [
|
||||
"10.0.0.0/8",
|
||||
"172.16.0.0/12",
|
||||
"192.168.0.0/16",
|
||||
]
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["/bin/bash", "-c"]
|
||||
environment = {
|
||||
KUBECONFIG = self.triggers.kubeconfig
|
||||
}
|
||||
command = self.triggers.cmd_patch
|
||||
}
|
||||
}
|
||||
|
||||
@@ -251,40 +304,60 @@ resource "aws_security_group" "all_worker_mgmt" {
|
||||
# Supporting resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
enable_flow_log = true
|
||||
create_flow_log_cloudwatch_iam_role = true
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_security_group" "additional" {
|
||||
name_prefix = "${local.name}-additional"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = [
|
||||
"10.0.0.0/8",
|
||||
"172.16.0.0/12",
|
||||
"192.168.0.0/16",
|
||||
]
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
@@ -1,24 +1,148 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
output "node_groups" {
|
||||
description = "Outputs from node groups"
|
||||
value = module.eks.node_groups
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
|
||||
@@ -4,19 +4,11 @@ terraform {
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
null = {
|
||||
source = "hashicorp/null"
|
||||
version = ">= 3.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
95
examples/eks_managed_node_group/README.md
Normal file
95
examples/eks_managed_node_group/README.md
Normal file
@@ -0,0 +1,95 @@
|
||||
# EKS Managed Node Group Example
|
||||
|
||||
Configuration in this directory creates an AWS EKS cluster with various EKS Managed Node Groups demonstrating the various methods of configuring/customizing:
|
||||
|
||||
- A default, "out of the box" EKS managed node group as supplied by AWS EKS
|
||||
- A default, "out of the box" Bottlerocket EKS managed node group as supplied by AWS EKS
|
||||
- A Bottlerocket EKS managed node group that supplies additional bootstrap settings
|
||||
- A Bottlerocket EKS managed node group that demonstrates many of the configuration/customizations offered by the `eks-managed-node-group` sub-module for the Bottlerocket OS
|
||||
- An EKS managed node group created from a launch template created outside of the module
|
||||
- An EKS managed node group that utilizes a custom AMI that is an EKS optimized AMI derivative
|
||||
- An EKS managed node group that demonstrates nearly all of the configurations/customizations offered by the `eks-managed-node-group` sub-module
|
||||
|
||||
See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) for further details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64 |
|
||||
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_kms_key.ebs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_launch_template.external](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
|
||||
| [aws_security_group.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [null_resource.patch](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.ebs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
490
examples/eks_managed_node_group/main.tf
Normal file
490
examples/eks_managed_node_group/main.tf
Normal file
@@ -0,0 +1,490 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.21"
|
||||
region = "eu-west-1"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_service_ipv4_cidr = "172.16.0.0/16"
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
cluster_addons = {
|
||||
coredns = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
kube-proxy = {}
|
||||
vpc-cni = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
}
|
||||
|
||||
cluster_encryption_config = [{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
eks_managed_node_group_defaults = {
|
||||
ami_type = "AL2_x86_64"
|
||||
disk_size = 50
|
||||
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
|
||||
}
|
||||
|
||||
eks_managed_node_groups = {
|
||||
# Default node group - as provided by AWS EKS
|
||||
default_node_group = {}
|
||||
|
||||
# Default node group - as provided by AWS EKS using Bottlerocket
|
||||
bottlerocket_default = {
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
platform = "bottlerocket"
|
||||
}
|
||||
|
||||
# Adds to the AWS provided user data
|
||||
bottlerocket_add = {
|
||||
ami_type = "BOTTLEROCKET_x86_64"
|
||||
platform = "bottlerocket"
|
||||
|
||||
# this will get added to what AWS provides
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Custom AMI, using module provided bootstrap data
|
||||
bottlerocket_custom = {
|
||||
# Current bottlerocket AMI
|
||||
ami_id = "ami-0ff61e0bcfc81dc94"
|
||||
platform = "bottlerocket"
|
||||
|
||||
# use module user data template to boostrap
|
||||
enable_bootstrap_user_data = true
|
||||
# this will get added to the template
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
|
||||
[settings.kubernetes.node-labels]
|
||||
"label1" = "foo"
|
||||
"label2" = "bar"
|
||||
|
||||
[settings.kubernetes.node-taints]
|
||||
"dedicated" = "experimental:PreferNoSchedule"
|
||||
"special" = "true:NoSchedule"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Use existing/external launch template
|
||||
external_lt = {
|
||||
create_launch_template = false
|
||||
launch_template_name = aws_launch_template.external.name
|
||||
launch_template_version = aws_launch_template.external.default_version
|
||||
}
|
||||
|
||||
# Use a custom AMI
|
||||
custom_ami = {
|
||||
# Current default AMI used by managed node groups - pseudo "custom"
|
||||
ami_id = "ami-0caf35bc73450c396"
|
||||
|
||||
# This will ensure the boostrap user data is used to join the node
|
||||
# By default, EKS managed node groups will not append bootstrap script;
|
||||
# this adds it back in using the default template provided by the module
|
||||
# Note: this assumes the AMI provided is an EKS optimized AMI derivative
|
||||
enable_bootstrap_user_data = true
|
||||
}
|
||||
|
||||
# Complete
|
||||
complete = {
|
||||
name = "complete-eks-mng"
|
||||
use_name_prefix = false
|
||||
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
min_size = 1
|
||||
max_size = 7
|
||||
desired_size = 1
|
||||
|
||||
ami_id = "ami-0caf35bc73450c396"
|
||||
enable_bootstrap_user_data = true
|
||||
bootstrap_extra_args = "--container-runtime containerd --kubelet-extra-args '--max-pods=20'"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
export CONTAINER_RUNTIME="containerd"
|
||||
export USE_MAX_PODS=false
|
||||
EOT
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "you are free little kubelet!"
|
||||
EOT
|
||||
|
||||
capacity_type = "SPOT"
|
||||
disk_size = 256
|
||||
force_update_version = true
|
||||
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large", "m3.large", "m4.large"]
|
||||
labels = {
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
|
||||
taints = [
|
||||
{
|
||||
key = "dedicated"
|
||||
value = "gpuGroup"
|
||||
effect = "NO_SCHEDULE"
|
||||
}
|
||||
]
|
||||
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
|
||||
description = "EKS managed node group example launch template"
|
||||
|
||||
ebs_optimized = true
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
disable_api_termination = false
|
||||
enable_monitoring = true
|
||||
|
||||
block_device_mappings = {
|
||||
xvda = {
|
||||
device_name = "/dev/xvda"
|
||||
ebs = {
|
||||
volume_size = 75
|
||||
volume_type = "gp3"
|
||||
iops = 3000
|
||||
throughput = 150
|
||||
encrypted = true
|
||||
kms_key_id = aws_kms_key.ebs.arn
|
||||
delete_on_termination = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
metadata_options = {
|
||||
http_endpoint = "enabled"
|
||||
http_tokens = "required"
|
||||
http_put_response_hop_limit = 2
|
||||
}
|
||||
|
||||
create_iam_role = true
|
||||
iam_role_name = "eks-managed-node-group-complete-example"
|
||||
iam_role_use_name_prefix = false
|
||||
iam_role_description = "EKS managed node group complete example role"
|
||||
iam_role_tags = {
|
||||
Purpose = "Protector of the kubelet"
|
||||
}
|
||||
iam_role_additional_policies = [
|
||||
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||
]
|
||||
|
||||
create_security_group = true
|
||||
security_group_name = "eks-managed-node-group-complete-example"
|
||||
security_group_use_name_prefix = false
|
||||
security_group_description = "EKS managed node group complete example security group"
|
||||
security_group_rules = {
|
||||
phoneOut = {
|
||||
description = "Hello CloudFlare"
|
||||
protocol = "udp"
|
||||
from_port = 53
|
||||
to_port = 53
|
||||
type = "egress"
|
||||
cidr_blocks = ["1.1.1.1/32"]
|
||||
}
|
||||
phoneHome = {
|
||||
description = "Hello cluster"
|
||||
protocol = "udp"
|
||||
from_port = 53
|
||||
to_port = 53
|
||||
type = "egress"
|
||||
source_cluster_security_group = true # bit of reflection lookup
|
||||
}
|
||||
}
|
||||
security_group_tags = {
|
||||
Purpose = "Protector of the kubelet"
|
||||
}
|
||||
|
||||
tags = {
|
||||
ExtraTag = "EKS managed node group complete example"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# aws-auth configmap
|
||||
# Only EKS managed node groups automatically add roles to aws-auth configmap
|
||||
# so we need to ensure fargate profiles and self-managed node roles are added
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster_auth" "this" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
locals {
|
||||
kubeconfig = yamlencode({
|
||||
apiVersion = "v1"
|
||||
kind = "Config"
|
||||
current-context = "terraform"
|
||||
clusters = [{
|
||||
name = module.eks.cluster_id
|
||||
cluster = {
|
||||
certificate-authority-data = module.eks.cluster_certificate_authority_data
|
||||
server = module.eks.cluster_endpoint
|
||||
}
|
||||
}]
|
||||
contexts = [{
|
||||
name = "terraform"
|
||||
context = {
|
||||
cluster = module.eks.cluster_id
|
||||
user = "terraform"
|
||||
}
|
||||
}]
|
||||
users = [{
|
||||
name = "terraform"
|
||||
user = {
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
}]
|
||||
})
|
||||
}
|
||||
|
||||
resource "null_resource" "patch" {
|
||||
triggers = {
|
||||
kubeconfig = base64encode(local.kubeconfig)
|
||||
cmd_patch = "kubectl patch configmap/aws-auth --patch \"${module.eks.aws_auth_configmap_yaml}\" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)"
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["/bin/bash", "-c"]
|
||||
environment = {
|
||||
KUBECONFIG = self.triggers.kubeconfig
|
||||
}
|
||||
command = self.triggers.cmd_patch
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
enable_flow_log = true
|
||||
create_flow_log_cloudwatch_iam_role = true
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_security_group" "additional" {
|
||||
name_prefix = "${local.name}-additional"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = [
|
||||
"10.0.0.0/8",
|
||||
"172.16.0.0/12",
|
||||
"192.168.0.0/16",
|
||||
]
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "ebs" {
|
||||
description = "Customer managed key to encrypt EKS managed node group volumes"
|
||||
deletion_window_in_days = 7
|
||||
policy = data.aws_iam_policy_document.ebs.json
|
||||
}
|
||||
|
||||
# This policy is required for the KMS key used for EKS root volumes, so the cluster is allowed to enc/dec/attach encrypted EBS volumes
|
||||
data "aws_iam_policy_document" "ebs" {
|
||||
# Copy of default KMS policy that lets you manage it
|
||||
statement {
|
||||
sid = "Enable IAM User Permissions"
|
||||
actions = ["kms:*"]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
||||
}
|
||||
}
|
||||
|
||||
# Required for EKS
|
||||
statement {
|
||||
sid = "Allow service-linked role use of the CMK"
|
||||
actions = [
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt",
|
||||
"kms:ReEncrypt*",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:DescribeKey"
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = [
|
||||
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "Allow attachment of persistent resources"
|
||||
actions = ["kms:CreateGrant"]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = [
|
||||
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "Bool"
|
||||
variable = "kms:GrantIsForAWSResource"
|
||||
values = ["true"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# This is based on the LT that EKS would create if no custom one is specified (aws ec2 describe-launch-template-versions --launch-template-id xxx)
|
||||
# there are several more options one could set but you probably dont need to modify them
|
||||
# you can take the default and add your custom AMI and/or custom tags
|
||||
#
|
||||
# Trivia: AWS transparently creates a copy of your LaunchTemplate and actually uses that copy then for the node group. If you DONT use a custom AMI,
|
||||
# then the default user-data for bootstrapping a cluster is merged in the copy.
|
||||
|
||||
resource "aws_launch_template" "external" {
|
||||
name_prefix = "external-eks-ex-"
|
||||
description = "EKS managed node group external launch template"
|
||||
update_default_version = true
|
||||
|
||||
block_device_mappings {
|
||||
device_name = "/dev/xvda"
|
||||
|
||||
ebs {
|
||||
volume_size = 100
|
||||
volume_type = "gp2"
|
||||
delete_on_termination = true
|
||||
}
|
||||
}
|
||||
|
||||
monitoring {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
network_interfaces {
|
||||
associate_public_ip_address = false
|
||||
delete_on_termination = true
|
||||
}
|
||||
|
||||
# if you want to use a custom AMI
|
||||
# image_id = var.ami_id
|
||||
|
||||
# If you use a custom AMI, you need to supply via user-data, the bootstrap script as EKS DOESNT merge its managed user-data then
|
||||
# you can add more than the minimum code you see in the template, e.g. install SSM agent, see https://github.com/aws/containers-roadmap/issues/593#issuecomment-577181345
|
||||
# (optionally you can use https://registry.terraform.io/providers/hashicorp/cloudinit/latest/docs/data-sources/cloudinit_config to render the script, example: https://github.com/terraform-aws-modules/terraform-aws-eks/pull/997#issuecomment-705286151)
|
||||
# user_data = base64encode(data.template_file.launch_template_userdata.rendered)
|
||||
|
||||
tag_specifications {
|
||||
resource_type = "instance"
|
||||
|
||||
tags = {
|
||||
CustomTag = "Instance custom tag"
|
||||
}
|
||||
}
|
||||
|
||||
tag_specifications {
|
||||
resource_type = "volume"
|
||||
|
||||
tags = {
|
||||
CustomTag = "Volume custom tag"
|
||||
}
|
||||
}
|
||||
|
||||
tag_specifications {
|
||||
resource_type = "network-interface"
|
||||
|
||||
tags = {
|
||||
CustomTag = "EKS example"
|
||||
}
|
||||
}
|
||||
|
||||
tags = {
|
||||
CustomTag = "Launch template custom tag"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
167
examples/eks_managed_node_group/outputs.tf
Normal file
167
examples/eks_managed_node_group/outputs.tf
Normal file
@@ -0,0 +1,167 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
14
examples/eks_managed_node_group/versions.tf
Normal file
14
examples/eks_managed_node_group/versions.tf
Normal file
@@ -0,0 +1,14 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
null = {
|
||||
source = "hashicorp/null"
|
||||
version = ">= 3.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,69 +0,0 @@
|
||||
# AWS EKS Cluster with Fargate profiles
|
||||
|
||||
Configuration in this directory creates EKS cluster with Fargate profiles in two different ways:
|
||||
|
||||
- Using a root module, where EKS Cluster and Fargate profiles should be created at once. This is the default behaviour for most users.
|
||||
- Using `modules/fargate` submodule where Fargate profiles should be attached to the existing EKS Cluster.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 2.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_fargate_profile_existing_cluster"></a> [fargate\_profile\_existing\_cluster](#module\_fargate\_profile\_existing\_cluster) | ../../modules/fargate | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_fargate_profile_arns"></a> [fargate\_profile\_arns](#output\_fargate\_profile\_arns) | Outputs from node groups |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,235 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "fargate-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = [module.vpc.private_subnets[0], module.vpc.public_subnets[1]]
|
||||
fargate_subnets = [module.vpc.private_subnets[2]]
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
# You require a node group to schedule coredns which is critical for running correctly internal DNS.
|
||||
# If you want to use only fargate you must follow docs `(Optional) Update CoreDNS`
|
||||
# available under https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html
|
||||
node_groups = {
|
||||
example = {
|
||||
desired_capacity = 1
|
||||
|
||||
instance_types = ["t3.large"]
|
||||
k8s_labels = {
|
||||
Example = "managed_node_groups"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
additional_tags = {
|
||||
ExtraTag = "example"
|
||||
}
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fargate_profiles = {
|
||||
default = {
|
||||
name = "default"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "kube-system"
|
||||
labels = {
|
||||
k8s-app = "kube-dns"
|
||||
}
|
||||
},
|
||||
{
|
||||
namespace = "default"
|
||||
labels = {
|
||||
WorkerType = "fargate"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
tags = {
|
||||
Owner = "default"
|
||||
}
|
||||
|
||||
timeouts = {
|
||||
create = "20m"
|
||||
delete = "20m"
|
||||
}
|
||||
}
|
||||
|
||||
secondary = {
|
||||
name = "secondary"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "default"
|
||||
labels = {
|
||||
Environment = "test"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
# Using specific subnets instead of the ones configured in EKS (`subnets` and `fargate_subnets`)
|
||||
subnets = [module.vpc.private_subnets[1]]
|
||||
|
||||
tags = {
|
||||
Owner = "secondary"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
manage_aws_auth = false
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
##############################################
|
||||
# Calling submodule with existing EKS cluster
|
||||
##############################################
|
||||
|
||||
module "fargate_profile_existing_cluster" {
|
||||
source = "../../modules/fargate"
|
||||
|
||||
cluster_name = module.eks.cluster_id
|
||||
subnets = [module.vpc.private_subnets[0], module.vpc.private_subnets[2]]
|
||||
|
||||
fargate_profiles = {
|
||||
profile1 = {
|
||||
name = "profile1"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "kube-system"
|
||||
labels = {
|
||||
k8s-app = "kube-dns"
|
||||
}
|
||||
},
|
||||
{
|
||||
namespace = "profile"
|
||||
labels = {
|
||||
WorkerType = "fargate"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
tags = {
|
||||
Owner = "profile1"
|
||||
submodule = "true"
|
||||
}
|
||||
}
|
||||
|
||||
profile2 = {
|
||||
name = "profile2"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "default"
|
||||
labels = {
|
||||
Fargate = "profile2"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
# Using specific subnets instead of the ones configured in EKS (`subnets` and `fargate_subnets`)
|
||||
subnets = [module.vpc.private_subnets[0]]
|
||||
|
||||
tags = {
|
||||
Owner = "profile2"
|
||||
submodule = "true"
|
||||
}
|
||||
|
||||
timeouts = {
|
||||
delete = "20m"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
|
||||
output "fargate_profile_arns" {
|
||||
description = "Outputs from node groups"
|
||||
value = module.eks.fargate_profile_arns
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
tls = {
|
||||
source = "hashicorp/tls"
|
||||
version = ">= 2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
76
examples/fargate_profile/README.md
Normal file
76
examples/fargate_profile/README.md
Normal file
@@ -0,0 +1,76 @@
|
||||
# AWS EKS Cluster with Fargate profiles
|
||||
|
||||
Configuration in this directory creates an AWS EKS cluster utilizing Fargate profiles.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
164
examples/fargate_profile/main.tf
Normal file
164
examples/fargate_profile/main.tf
Normal file
@@ -0,0 +1,164 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.21"
|
||||
region = "eu-west-1"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
cluster_addons = {
|
||||
# Note: https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html#fargate-gs-coredns
|
||||
coredns = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
kube-proxy = {}
|
||||
vpc-cni = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
}
|
||||
|
||||
cluster_encryption_config = [{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
# You require a node group to schedule coredns which is critical for running correctly internal DNS.
|
||||
# If you want to use only fargate you must follow docs `(Optional) Update CoreDNS`
|
||||
# available under https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html
|
||||
eks_managed_node_groups = {
|
||||
example = {
|
||||
desired_size = 1
|
||||
|
||||
instance_types = ["t3.large"]
|
||||
labels = {
|
||||
Example = "managed_node_groups"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
tags = {
|
||||
ExtraTag = "example"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fargate_profiles = {
|
||||
default = {
|
||||
name = "default"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "backend"
|
||||
labels = {
|
||||
Application = "backend"
|
||||
}
|
||||
},
|
||||
{
|
||||
namespace = "default"
|
||||
labels = {
|
||||
WorkerType = "fargate"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
tags = {
|
||||
Owner = "default"
|
||||
}
|
||||
|
||||
timeouts = {
|
||||
create = "20m"
|
||||
delete = "20m"
|
||||
}
|
||||
}
|
||||
|
||||
secondary = {
|
||||
name = "secondary"
|
||||
selectors = [
|
||||
{
|
||||
namespace = "default"
|
||||
labels = {
|
||||
Environment = "test"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
# Using specific subnets instead of the subnets supplied for the cluster itself
|
||||
subnet_ids = [module.vpc.private_subnets[1]]
|
||||
|
||||
tags = {
|
||||
Owner = "secondary"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
enable_flow_log = true
|
||||
create_flow_log_cloudwatch_iam_role = true
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
167
examples/fargate_profile/outputs.tf
Normal file
167
examples/fargate_profile/outputs.tf
Normal file
@@ -0,0 +1,167 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
10
examples/fargate_profile/versions.tf
Normal file
10
examples/fargate_profile/versions.tf
Normal file
@@ -0,0 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
# Instance refresh example
|
||||
|
||||
This is EKS example using [instance refresh](https://aws.amazon.com/blogs/compute/introducing-instance-refresh-for-ec2-auto-scaling/) feature for worker groups.
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.0 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.0 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_aws_node_termination_handler_role"></a> [aws\_node\_termination\_handler\_role](#module\_aws\_node\_termination\_handler\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | 4.1.0 |
|
||||
| <a name="module_aws_node_termination_handler_sqs"></a> [aws\_node\_termination\_handler\_sqs](#module\_aws\_node\_termination\_handler\_sqs) | terraform-aws-modules/sqs/aws | ~> 3.0.0 |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_autoscaling_lifecycle_hook.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_lifecycle_hook) | resource |
|
||||
| [aws_cloudwatch_event_rule.aws_node_termination_handler_asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
| [aws_cloudwatch_event_rule.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_iam_policy.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [helm_release.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
| <a name="output_sqs_queue_asg_notification_arn"></a> [sqs\_queue\_asg\_notification\_arn](#output\_sqs\_queue\_asg\_notification\_arn) | SQS queue ASG notification ARN |
|
||||
| <a name="output_sqs_queue_asg_notification_url"></a> [sqs\_queue\_asg\_notification\_url](#output\_sqs\_queue\_asg\_notification\_url) | SQS queue ASG notification URL |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,306 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "instance_refresh-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
# Based on the official aws-node-termination-handler setup guide at https://github.com/aws/aws-node-termination-handler#infrastructure-setup
|
||||
|
||||
provider "helm" {
|
||||
kubernetes {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
data "aws_iam_policy_document" "aws_node_termination_handler" {
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"ec2:DescribeInstances",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeTags",
|
||||
]
|
||||
resources = [
|
||||
"*",
|
||||
]
|
||||
}
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"autoscaling:CompleteLifecycleAction",
|
||||
]
|
||||
resources = module.eks.workers_asg_arns
|
||||
}
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"sqs:DeleteMessage",
|
||||
"sqs:ReceiveMessage"
|
||||
]
|
||||
resources = [
|
||||
module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "aws_node_termination_handler" {
|
||||
name = "${local.name}-aws-node-termination-handler"
|
||||
policy = data.aws_iam_policy_document.aws_node_termination_handler.json
|
||||
}
|
||||
|
||||
data "aws_region" "current" {}
|
||||
|
||||
data "aws_iam_policy_document" "aws_node_termination_handler_events" {
|
||||
statement {
|
||||
effect = "Allow"
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = [
|
||||
"events.amazonaws.com",
|
||||
"sqs.amazonaws.com",
|
||||
]
|
||||
}
|
||||
actions = [
|
||||
"sqs:SendMessage",
|
||||
]
|
||||
resources = [
|
||||
"arn:aws:sqs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${local.name}",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_sqs" {
|
||||
source = "terraform-aws-modules/sqs/aws"
|
||||
version = "~> 3.0.0"
|
||||
name = local.name
|
||||
message_retention_seconds = 300
|
||||
policy = data.aws_iam_policy_document.aws_node_termination_handler_events.json
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_asg" {
|
||||
name = "${local.name}-asg-termination"
|
||||
description = "Node termination event rule"
|
||||
event_pattern = jsonencode(
|
||||
{
|
||||
"source" : [
|
||||
"aws.autoscaling"
|
||||
],
|
||||
"detail-type" : [
|
||||
"EC2 Instance-terminate Lifecycle Action"
|
||||
]
|
||||
"resources" : module.eks.workers_asg_arns
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_target" "aws_node_termination_handler_asg" {
|
||||
target_id = "${local.name}-asg-termination"
|
||||
rule = aws_cloudwatch_event_rule.aws_node_termination_handler_asg.name
|
||||
arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_spot" {
|
||||
name = "${local.name}-spot-termination"
|
||||
description = "Node termination event rule"
|
||||
event_pattern = jsonencode(
|
||||
{
|
||||
"source" : [
|
||||
"aws.ec2"
|
||||
],
|
||||
"detail-type" : [
|
||||
"EC2 Spot Instance Interruption Warning"
|
||||
]
|
||||
"resources" : module.eks.workers_asg_arns
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_target" "aws_node_termination_handler_spot" {
|
||||
target_id = "${local.name}-spot-termination"
|
||||
rule = aws_cloudwatch_event_rule.aws_node_termination_handler_spot.name
|
||||
arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_role" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "4.1.0"
|
||||
create_role = true
|
||||
role_description = "IRSA role for ANTH, cluster ${local.name}"
|
||||
role_name_prefix = local.name
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.aws_node_termination_handler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:aws-node-termination-handler"]
|
||||
}
|
||||
|
||||
resource "helm_release" "aws_node_termination_handler" {
|
||||
depends_on = [
|
||||
module.eks
|
||||
]
|
||||
|
||||
name = "aws-node-termination-handler"
|
||||
namespace = "kube-system"
|
||||
repository = "https://aws.github.io/eks-charts"
|
||||
chart = "aws-node-termination-handler"
|
||||
version = "0.15.0"
|
||||
create_namespace = true
|
||||
|
||||
set {
|
||||
name = "awsRegion"
|
||||
value = data.aws_region.current.name
|
||||
}
|
||||
set {
|
||||
name = "serviceAccount.name"
|
||||
value = "aws-node-termination-handler"
|
||||
}
|
||||
set {
|
||||
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.aws_node_termination_handler_role.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
set {
|
||||
name = "enableSqsTerminationDraining"
|
||||
value = "true"
|
||||
}
|
||||
set {
|
||||
name = "enableSpotInterruptionDraining"
|
||||
value = "true"
|
||||
}
|
||||
set {
|
||||
name = "queueURL"
|
||||
value = module.aws_node_termination_handler_sqs.sqs_queue_id
|
||||
}
|
||||
set {
|
||||
name = "logLevel"
|
||||
value = "debug"
|
||||
}
|
||||
}
|
||||
|
||||
# Creating the lifecycle-hook outside of the ASG resource's `initial_lifecycle_hook`
|
||||
# ensures that node termination does not require the lifecycle action to be completed,
|
||||
# and thus allows the ASG to be destroyed cleanly.
|
||||
resource "aws_autoscaling_lifecycle_hook" "aws_node_termination_handler" {
|
||||
count = length(module.eks.workers_asg_names)
|
||||
name = "aws-node-termination-handler"
|
||||
autoscaling_group_name = module.eks.workers_asg_names[count.index]
|
||||
lifecycle_transition = "autoscaling:EC2_INSTANCE_TERMINATING"
|
||||
heartbeat_timeout = 300
|
||||
default_result = "CONTINUE"
|
||||
}
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
enable_irsa = true
|
||||
worker_groups_launch_template = [
|
||||
{
|
||||
name = "refresh"
|
||||
asg_max_size = 2
|
||||
asg_desired_capacity = 2
|
||||
instance_refresh_enabled = true
|
||||
instance_refresh_instance_warmup = 60
|
||||
public_ip = true
|
||||
metadata_http_put_response_hop_limit = 3
|
||||
update_default_version = true
|
||||
instance_refresh_triggers = ["tag"]
|
||||
tags = [
|
||||
{
|
||||
key = "aws-node-termination-handler/managed"
|
||||
value = ""
|
||||
propagate_at_launch = true
|
||||
},
|
||||
{
|
||||
key = "foo"
|
||||
value = "buzz"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
|
||||
output "sqs_queue_asg_notification_arn" {
|
||||
description = "SQS queue ASG notification ARN"
|
||||
value = module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
}
|
||||
|
||||
output "sqs_queue_asg_notification_url" {
|
||||
description = "SQS queue ASG notification URL"
|
||||
value = module.aws_node_termination_handler_sqs.sqs_queue_id
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
helm = {
|
||||
source = "hashicorp/helm"
|
||||
version = ">= 2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
# IAM Roles for Service Accounts
|
||||
|
||||
This example shows how to create an IAM role to be used for a Kubernetes `ServiceAccount`. It will create a policy and role to be used by the [cluster-autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler) using the [public Helm chart](https://github.com/kubernetes/autoscaler/tree/master/charts/cluster-autoscaler).
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.0 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.0 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_iam_assumable_role_admin"></a> [iam\_assumable\_role\_admin](#module\_iam\_assumable\_role\_admin) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 4.0 |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_iam_policy.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [helm_release.cluster-autoscaler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_account_id"></a> [aws\_account\_id](#output\_aws\_account\_id) | IAM AWS account id |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,114 +0,0 @@
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
data "aws_region" "current" {}
|
||||
|
||||
locals {
|
||||
k8s_service_account_namespace = "kube-system"
|
||||
k8s_service_account_name = "cluster-autoscaler-aws"
|
||||
}
|
||||
|
||||
provider "helm" {
|
||||
kubernetes {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
}
|
||||
|
||||
resource "helm_release" "cluster-autoscaler" {
|
||||
depends_on = [
|
||||
module.eks
|
||||
]
|
||||
|
||||
name = "cluster-autoscaler"
|
||||
namespace = local.k8s_service_account_namespace
|
||||
repository = "https://kubernetes.github.io/autoscaler"
|
||||
chart = "cluster-autoscaler"
|
||||
version = "9.10.7"
|
||||
create_namespace = false
|
||||
|
||||
set {
|
||||
name = "awsRegion"
|
||||
value = data.aws_region.current.name
|
||||
}
|
||||
set {
|
||||
name = "rbac.serviceAccount.name"
|
||||
value = local.k8s_service_account_name
|
||||
}
|
||||
set {
|
||||
name = "rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.iam_assumable_role_admin.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
set {
|
||||
name = "autoDiscovery.clusterName"
|
||||
value = local.name
|
||||
}
|
||||
set {
|
||||
name = "autoDiscovery.enabled"
|
||||
value = "true"
|
||||
}
|
||||
set {
|
||||
name = "rbac.create"
|
||||
value = "true"
|
||||
}
|
||||
}
|
||||
|
||||
module "iam_assumable_role_admin" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "~> 4.0"
|
||||
|
||||
create_role = true
|
||||
role_name = "cluster-autoscaler"
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:${local.k8s_service_account_namespace}:${local.k8s_service_account_name}"]
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "cluster_autoscaler" {
|
||||
name_prefix = "cluster-autoscaler"
|
||||
description = "EKS cluster-autoscaler policy for cluster ${module.eks.cluster_id}"
|
||||
policy = data.aws_iam_policy_document.cluster_autoscaler.json
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "cluster_autoscaler" {
|
||||
statement {
|
||||
sid = "clusterAutoscalerAll"
|
||||
effect = "Allow"
|
||||
|
||||
actions = [
|
||||
"autoscaling:DescribeAutoScalingGroups",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeLaunchConfigurations",
|
||||
"autoscaling:DescribeTags",
|
||||
"ec2:DescribeLaunchTemplateVersions",
|
||||
]
|
||||
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "clusterAutoscalerOwn"
|
||||
effect = "Allow"
|
||||
|
||||
actions = [
|
||||
"autoscaling:SetDesiredCapacity",
|
||||
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
||||
"autoscaling:UpdateAutoScalingGroup",
|
||||
]
|
||||
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/${module.eks.cluster_id}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
|
||||
values = ["true"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,115 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "irsa-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
worker_groups = [
|
||||
{
|
||||
name = "worker-group-1"
|
||||
instance_type = "t3.medium"
|
||||
asg_desired_capacity = 1
|
||||
asg_max_size = 4
|
||||
tags = [
|
||||
{
|
||||
"key" = "k8s.io/cluster-autoscaler/enabled"
|
||||
"propagate_at_launch" = "false"
|
||||
"value" = "true"
|
||||
},
|
||||
{
|
||||
"key" = "k8s.io/cluster-autoscaler/${local.name}"
|
||||
"propagate_at_launch" = "false"
|
||||
"value" = "owned"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
output "aws_account_id" {
|
||||
description = "IAM AWS account id"
|
||||
value = data.aws_caller_identity.current.account_id
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
helm = {
|
||||
source = "hashicorp/helm"
|
||||
version = ">= 2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
102
examples/irsa_autoscale_refresh/README.md
Normal file
102
examples/irsa_autoscale_refresh/README.md
Normal file
@@ -0,0 +1,102 @@
|
||||
# IRSA, Cluster Autoscaler, and Instance Refresh example
|
||||
|
||||
Configuration in this directory creates an AWS EKS cluster with:
|
||||
- [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) enabled
|
||||
- [Cluster Autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md) provisioned via a Helm Chart manifest
|
||||
- [Instance Refresh](https://aws.amazon.com/blogs/compute/introducing-instance-refresh-for-ec2-auto-scaling/) feature for self managed node groups
|
||||
- [Node Termination Handler](https://github.com/aws/aws-node-termination-handler) provisioned via a Helm Chart manifest
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.0 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64 |
|
||||
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.0 |
|
||||
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_aws_node_termination_handler_role"></a> [aws\_node\_termination\_handler\_role](#module\_aws\_node\_termination\_handler\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 4.0 |
|
||||
| <a name="module_aws_node_termination_handler_sqs"></a> [aws\_node\_termination\_handler\_sqs](#module\_aws\_node\_termination\_handler\_sqs) | terraform-aws-modules/sqs/aws | ~> 3.0 |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_iam_assumable_role_cluster_autoscaler"></a> [iam\_assumable\_role\_cluster\_autoscaler](#module\_iam\_assumable\_role\_cluster\_autoscaler) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 4.0 |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_autoscaling_lifecycle_hook.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_lifecycle_hook) | resource |
|
||||
| [aws_cloudwatch_event_rule.aws_node_termination_handler_asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
| [aws_cloudwatch_event_rule.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_iam_policy.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_policy.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [helm_release.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [helm_release.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [null_resource.apply](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler_sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
294
examples/irsa_autoscale_refresh/charts.tf
Normal file
294
examples/irsa_autoscale_refresh/charts.tf
Normal file
@@ -0,0 +1,294 @@
|
||||
provider "helm" {
|
||||
kubernetes {
|
||||
host = module.eks.cluster_endpoint
|
||||
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Cluster Autoscaler
|
||||
# Based on the official docs at
|
||||
# https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler
|
||||
################################################################################
|
||||
|
||||
resource "helm_release" "cluster_autoscaler" {
|
||||
name = "cluster-autoscaler"
|
||||
namespace = "kube-system"
|
||||
repository = "https://kubernetes.github.io/autoscaler"
|
||||
chart = "cluster-autoscaler"
|
||||
version = "9.10.8"
|
||||
create_namespace = false
|
||||
|
||||
set {
|
||||
name = "awsRegion"
|
||||
value = local.region
|
||||
}
|
||||
|
||||
set {
|
||||
name = "rbac.serviceAccount.name"
|
||||
value = "cluster-autoscaler-aws"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.iam_assumable_role_cluster_autoscaler.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "autoDiscovery.clusterName"
|
||||
value = local.name
|
||||
}
|
||||
|
||||
set {
|
||||
name = "autoDiscovery.enabled"
|
||||
value = "true"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "rbac.create"
|
||||
value = "true"
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
module.eks.cluster_id,
|
||||
null_resource.apply,
|
||||
]
|
||||
}
|
||||
|
||||
module "iam_assumable_role_cluster_autoscaler" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "~> 4.0"
|
||||
|
||||
create_role = true
|
||||
role_name_prefix = "cluster-autoscaler"
|
||||
role_description = "IRSA role for cluster autoscaler"
|
||||
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:cluster-autoscaler-aws"]
|
||||
oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "cluster_autoscaler" {
|
||||
name = "KarpenterControllerPolicy-refresh"
|
||||
policy = data.aws_iam_policy_document.cluster_autoscaler.json
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "cluster_autoscaler" {
|
||||
statement {
|
||||
sid = "clusterAutoscalerAll"
|
||||
actions = [
|
||||
"autoscaling:DescribeAutoScalingGroups",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeLaunchConfigurations",
|
||||
"autoscaling:DescribeTags",
|
||||
"ec2:DescribeLaunchTemplateVersions",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "clusterAutoscalerOwn"
|
||||
actions = [
|
||||
"autoscaling:SetDesiredCapacity",
|
||||
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
||||
"autoscaling:UpdateAutoScalingGroup",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/${module.eks.cluster_id}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
|
||||
values = ["true"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Termination Handler
|
||||
# Based on the official docs at
|
||||
# https://github.com/aws/aws-node-termination-handler
|
||||
################################################################################
|
||||
|
||||
resource "helm_release" "aws_node_termination_handler" {
|
||||
name = "aws-node-termination-handler"
|
||||
namespace = "kube-system"
|
||||
repository = "https://aws.github.io/eks-charts"
|
||||
chart = "aws-node-termination-handler"
|
||||
version = "0.16.0"
|
||||
create_namespace = false
|
||||
|
||||
set {
|
||||
name = "awsRegion"
|
||||
value = local.region
|
||||
}
|
||||
|
||||
set {
|
||||
name = "serviceAccount.name"
|
||||
value = "aws-node-termination-handler"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.aws_node_termination_handler_role.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "enableSqsTerminationDraining"
|
||||
value = "true"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "enableSpotInterruptionDraining"
|
||||
value = "true"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "queueURL"
|
||||
value = module.aws_node_termination_handler_sqs.sqs_queue_id
|
||||
}
|
||||
|
||||
set {
|
||||
name = "logLevel"
|
||||
value = "debug"
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
module.eks.cluster_id,
|
||||
null_resource.apply,
|
||||
]
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_role" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "~> 4.0"
|
||||
|
||||
create_role = true
|
||||
role_name_prefix = "node-termination-handler"
|
||||
role_description = "IRSA role for node termination handler"
|
||||
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.aws_node_termination_handler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:aws-node-termination-handler"]
|
||||
oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "aws_node_termination_handler" {
|
||||
name = "${local.name}-aws-node-termination-handler"
|
||||
policy = data.aws_iam_policy_document.aws_node_termination_handler.json
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "aws_node_termination_handler" {
|
||||
statement {
|
||||
actions = [
|
||||
"ec2:DescribeInstances",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeTags",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
actions = ["autoscaling:CompleteLifecycleAction"]
|
||||
resources = [for group in module.eks.self_managed_node_groups : group.autoscaling_group_arn]
|
||||
}
|
||||
|
||||
statement {
|
||||
actions = [
|
||||
"sqs:DeleteMessage",
|
||||
"sqs:ReceiveMessage"
|
||||
]
|
||||
resources = [module.aws_node_termination_handler_sqs.sqs_queue_arn]
|
||||
}
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_sqs" {
|
||||
source = "terraform-aws-modules/sqs/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
message_retention_seconds = 300
|
||||
policy = data.aws_iam_policy_document.aws_node_termination_handler_sqs.json
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "aws_node_termination_handler_sqs" {
|
||||
statement {
|
||||
actions = ["sqs:SendMessage"]
|
||||
resources = ["arn:aws:sqs:${local.region}:${data.aws_caller_identity.current.account_id}:${local.name}"]
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = [
|
||||
"events.amazonaws.com",
|
||||
"sqs.amazonaws.com",
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_asg" {
|
||||
name = "${local.name}-asg-termination"
|
||||
description = "Node termination event rule"
|
||||
|
||||
event_pattern = jsonencode({
|
||||
"source" : ["aws.autoscaling"],
|
||||
"detail-type" : ["EC2 Instance-terminate Lifecycle Action"]
|
||||
"resources" : [for group in module.eks.self_managed_node_groups : group.autoscaling_group_arn]
|
||||
})
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_target" "aws_node_termination_handler_asg" {
|
||||
target_id = "${local.name}-asg-termination"
|
||||
rule = aws_cloudwatch_event_rule.aws_node_termination_handler_asg.name
|
||||
arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_spot" {
|
||||
name = "${local.name}-spot-termination"
|
||||
description = "Node termination event rule"
|
||||
event_pattern = jsonencode({
|
||||
"source" : ["aws.ec2"],
|
||||
"detail-type" : ["EC2 Spot Instance Interruption Warning"]
|
||||
"resources" : [for group in module.eks.self_managed_node_groups : group.autoscaling_group_arn]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_cloudwatch_event_target" "aws_node_termination_handler_spot" {
|
||||
target_id = "${local.name}-spot-termination"
|
||||
rule = aws_cloudwatch_event_rule.aws_node_termination_handler_spot.name
|
||||
arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
|
||||
}
|
||||
|
||||
# Creating the lifecycle-hook outside of the ASG resource's `initial_lifecycle_hook`
|
||||
# ensures that node termination does not require the lifecycle action to be completed,
|
||||
# and thus allows the ASG to be destroyed cleanly.
|
||||
resource "aws_autoscaling_lifecycle_hook" "aws_node_termination_handler" {
|
||||
for_each = module.eks.self_managed_node_groups
|
||||
|
||||
name = "aws-node-termination-handler-${each.value.autoscaling_group_name}"
|
||||
autoscaling_group_name = each.value.autoscaling_group_name
|
||||
lifecycle_transition = "autoscaling:EC2_INSTANCE_TERMINATING"
|
||||
heartbeat_timeout = 300
|
||||
default_result = "CONTINUE"
|
||||
}
|
||||
203
examples/irsa_autoscale_refresh/main.tf
Normal file
203
examples/irsa_autoscale_refresh/main.tf
Normal file
@@ -0,0 +1,203 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.21"
|
||||
region = "eu-west-1"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
# Self Managed Node Group(s)
|
||||
self_managed_node_groups = {
|
||||
refresh = {
|
||||
max_size = 5
|
||||
desired_size = 1
|
||||
|
||||
instance_type = "m5.large"
|
||||
|
||||
instance_refresh = {
|
||||
strategy = "Rolling"
|
||||
preferences = {
|
||||
checkpoint_delay = 600
|
||||
checkpoint_percentages = [35, 70, 100]
|
||||
instance_warmup = 300
|
||||
min_healthy_percentage = 50
|
||||
}
|
||||
triggers = ["tag"]
|
||||
}
|
||||
|
||||
propogate_tags = [{
|
||||
key = "aws-node-termination-handler/managed"
|
||||
value = true
|
||||
propagate_at_launch = true
|
||||
}]
|
||||
}
|
||||
|
||||
mixed_instance = {
|
||||
use_mixed_instances_policy = true
|
||||
mixed_instances_policy = {
|
||||
instances_distribution = {
|
||||
on_demand_base_capacity = 0
|
||||
on_demand_percentage_above_base_capacity = 10
|
||||
spot_allocation_strategy = "capacity-optimized"
|
||||
}
|
||||
|
||||
override = [
|
||||
{
|
||||
instance_type = "m5.large"
|
||||
weighted_capacity = "1"
|
||||
},
|
||||
{
|
||||
instance_type = "m6i.large"
|
||||
weighted_capacity = "2"
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
propogate_tags = [{
|
||||
key = "aws-node-termination-handler/managed"
|
||||
value = true
|
||||
propagate_at_launch = true
|
||||
}]
|
||||
}
|
||||
|
||||
spot = {
|
||||
instance_type = "m5.large"
|
||||
instance_market_options = {
|
||||
market_type = "spot"
|
||||
}
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
propogate_tags = [{
|
||||
key = "aws-node-termination-handler/managed"
|
||||
value = true
|
||||
propagate_at_launch = true
|
||||
}]
|
||||
}
|
||||
}
|
||||
|
||||
tags = merge(local.tags, { Foo = "bar" })
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# aws-auth configmap
|
||||
# Only EKS managed node groups automatically add roles to aws-auth configmap
|
||||
# so we need to ensure fargate profiles and self-managed node roles are added
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster_auth" "this" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
locals {
|
||||
kubeconfig = yamlencode({
|
||||
apiVersion = "v1"
|
||||
kind = "Config"
|
||||
current-context = "terraform"
|
||||
clusters = [{
|
||||
name = module.eks.cluster_id
|
||||
cluster = {
|
||||
certificate-authority-data = module.eks.cluster_certificate_authority_data
|
||||
server = module.eks.cluster_endpoint
|
||||
}
|
||||
}]
|
||||
contexts = [{
|
||||
name = "terraform"
|
||||
context = {
|
||||
cluster = module.eks.cluster_id
|
||||
user = "terraform"
|
||||
}
|
||||
}]
|
||||
users = [{
|
||||
name = "terraform"
|
||||
user = {
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
}]
|
||||
})
|
||||
}
|
||||
|
||||
resource "null_resource" "apply" {
|
||||
triggers = {
|
||||
kubeconfig = base64encode(local.kubeconfig)
|
||||
cmd_patch = <<-EOT
|
||||
kubectl create configmap aws-auth -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)
|
||||
kubectl patch configmap/aws-auth --patch "${module.eks.aws_auth_configmap_yaml}" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)
|
||||
EOT
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["/bin/bash", "-c"]
|
||||
environment = {
|
||||
KUBECONFIG = self.triggers.kubeconfig
|
||||
}
|
||||
command = self.triggers.cmd_patch
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
enable_flow_log = true
|
||||
create_flow_log_cloudwatch_iam_role = true
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
167
examples/irsa_autoscale_refresh/outputs.tf
Normal file
167
examples/irsa_autoscale_refresh/outputs.tf
Normal file
@@ -0,0 +1,167 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
18
examples/irsa_autoscale_refresh/versions.tf
Normal file
18
examples/irsa_autoscale_refresh/versions.tf
Normal file
@@ -0,0 +1,18 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
null = {
|
||||
source = "hashicorp/null"
|
||||
version = ">= 3.0"
|
||||
}
|
||||
helm = {
|
||||
source = "hashicorp/helm"
|
||||
version = ">= 2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
# Launch templates example
|
||||
|
||||
This is EKS example using workers launch template with worker groups feature.
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/worker.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,134 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "launch_template-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
worker_groups_launch_template = [
|
||||
{
|
||||
name = "worker-group-1"
|
||||
instance_type = "t3.small"
|
||||
asg_desired_capacity = 2
|
||||
public_ip = true
|
||||
tags = [{
|
||||
key = "ExtraTag"
|
||||
value = "TagValue"
|
||||
propagate_at_launch = true
|
||||
}]
|
||||
},
|
||||
{
|
||||
name = "worker-group-2"
|
||||
instance_type = "t3.medium"
|
||||
asg_desired_capacity = 1
|
||||
public_ip = true
|
||||
ebs_optimized = true
|
||||
},
|
||||
{
|
||||
name = "worker-group-3"
|
||||
instance_type = "t2.large"
|
||||
asg_desired_capacity = 1
|
||||
public_ip = true
|
||||
elastic_inference_accelerator = "eia2.medium"
|
||||
},
|
||||
{
|
||||
name = "worker-group-4"
|
||||
instance_type = "t3.small"
|
||||
asg_desired_capacity = 1
|
||||
public_ip = true
|
||||
root_volume_size = 150
|
||||
root_volume_type = "gp3"
|
||||
root_volume_throughput = 300
|
||||
additional_ebs_volumes = [
|
||||
{
|
||||
block_device_name = "/dev/xvdb"
|
||||
volume_size = 100
|
||||
volume_type = "gp3"
|
||||
throughput = 150
|
||||
},
|
||||
]
|
||||
},
|
||||
]
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
yum update -y
|
||||
@@ -1,22 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
# Launch template with managed groups example
|
||||
|
||||
This is EKS example using workers custom launch template with managed groups feature in two different ways:
|
||||
|
||||
- Using a defined existing launch template created outside module
|
||||
- Using dlaunch template which will be created by module with user customization
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_iam_service_linked_role.autoscaling](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
|
||||
| [aws_launch_template.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,78 +0,0 @@
|
||||
# if you have used ASGs before, that role got auto-created already and you need to import to TF state
|
||||
resource "aws_iam_service_linked_role" "autoscaling" {
|
||||
aws_service_name = "autoscaling.amazonaws.com"
|
||||
description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
|
||||
custom_suffix = "lt_with_managed_node_groups" # the full name is "AWSServiceRoleForAutoScaling_lt_with_managed_node_groups" < 64 characters
|
||||
}
|
||||
|
||||
#data "aws_caller_identity" "current" {}
|
||||
#
|
||||
## This policy is required for the KMS key used for EKS root volumes, so the cluster is allowed to enc/dec/attach encrypted EBS volumes
|
||||
#data "aws_iam_policy_document" "ebs_decryption" {
|
||||
# # Copy of default KMS policy that lets you manage it
|
||||
# statement {
|
||||
# sid = "Enable IAM User Permissions"
|
||||
# effect = "Allow"
|
||||
#
|
||||
# principals {
|
||||
# type = "AWS"
|
||||
# identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
||||
# }
|
||||
#
|
||||
# actions = [
|
||||
# "kms:*"
|
||||
# ]
|
||||
#
|
||||
# resources = ["*"]
|
||||
# }
|
||||
#
|
||||
# # Required for EKS
|
||||
# statement {
|
||||
# sid = "Allow service-linked role use of the CMK"
|
||||
# effect = "Allow"
|
||||
#
|
||||
# principals {
|
||||
# type = "AWS"
|
||||
# identifiers = [
|
||||
# "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
# module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
# ]
|
||||
# }
|
||||
#
|
||||
# actions = [
|
||||
# "kms:Encrypt",
|
||||
# "kms:Decrypt",
|
||||
# "kms:ReEncrypt*",
|
||||
# "kms:GenerateDataKey*",
|
||||
# "kms:DescribeKey"
|
||||
# ]
|
||||
#
|
||||
# resources = ["*"]
|
||||
# }
|
||||
#
|
||||
# statement {
|
||||
# sid = "Allow attachment of persistent resources"
|
||||
# effect = "Allow"
|
||||
#
|
||||
# principals {
|
||||
# type = "AWS"
|
||||
# identifiers = [
|
||||
# "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
# module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
# ]
|
||||
# }
|
||||
#
|
||||
# actions = [
|
||||
# "kms:CreateGrant"
|
||||
# ]
|
||||
#
|
||||
# resources = ["*"]
|
||||
#
|
||||
# condition {
|
||||
# test = "Bool"
|
||||
# variable = "kms:GrantIsForAWSResource"
|
||||
# values = ["true"]
|
||||
# }
|
||||
#
|
||||
# }
|
||||
#}
|
||||
@@ -1,98 +0,0 @@
|
||||
#data "template_file" "launch_template_userdata" {
|
||||
# template = file("${path.module}/templates/userdata.sh.tpl")
|
||||
#
|
||||
# vars = {
|
||||
# cluster_name = local.name
|
||||
# endpoint = module.eks.cluster_endpoint
|
||||
# cluster_auth_base64 = module.eks.cluster_certificate_authority_data
|
||||
#
|
||||
# bootstrap_extra_args = ""
|
||||
# kubelet_extra_args = ""
|
||||
# }
|
||||
#}
|
||||
|
||||
# This is based on the LT that EKS would create if no custom one is specified (aws ec2 describe-launch-template-versions --launch-template-id xxx)
|
||||
# there are several more options one could set but you probably dont need to modify them
|
||||
# you can take the default and add your custom AMI and/or custom tags
|
||||
#
|
||||
# Trivia: AWS transparently creates a copy of your LaunchTemplate and actually uses that copy then for the node group. If you DONT use a custom AMI,
|
||||
# then the default user-data for bootstrapping a cluster is merged in the copy.
|
||||
|
||||
resource "aws_launch_template" "default" {
|
||||
name_prefix = "eks-example-"
|
||||
description = "Default Launch-Template"
|
||||
update_default_version = true
|
||||
|
||||
block_device_mappings {
|
||||
device_name = "/dev/xvda"
|
||||
|
||||
ebs {
|
||||
volume_size = 100
|
||||
volume_type = "gp2"
|
||||
delete_on_termination = true
|
||||
# encrypted = true
|
||||
|
||||
# Enable this if you want to encrypt your node root volumes with a KMS/CMK. encryption of PVCs is handled via k8s StorageClass tho
|
||||
# you also need to attach data.aws_iam_policy_document.ebs_decryption.json from the disk_encryption_policy.tf to the KMS/CMK key then !!
|
||||
# kms_key_id = var.kms_key_arn
|
||||
}
|
||||
}
|
||||
|
||||
monitoring {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
network_interfaces {
|
||||
associate_public_ip_address = false
|
||||
delete_on_termination = true
|
||||
security_groups = [module.eks.worker_security_group_id]
|
||||
}
|
||||
|
||||
# if you want to use a custom AMI
|
||||
# image_id = var.ami_id
|
||||
|
||||
# If you use a custom AMI, you need to supply via user-data, the bootstrap script as EKS DOESNT merge its managed user-data then
|
||||
# you can add more than the minimum code you see in the template, e.g. install SSM agent, see https://github.com/aws/containers-roadmap/issues/593#issuecomment-577181345
|
||||
#
|
||||
# (optionally you can use https://registry.terraform.io/providers/hashicorp/cloudinit/latest/docs/data-sources/cloudinit_config to render the script, example: https://github.com/terraform-aws-modules/terraform-aws-eks/pull/997#issuecomment-705286151)
|
||||
|
||||
# user_data = base64encode(
|
||||
# data.template_file.launch_template_userdata.rendered,
|
||||
# )
|
||||
|
||||
# Supplying custom tags to EKS instances is another use-case for LaunchTemplates
|
||||
tag_specifications {
|
||||
resource_type = "instance"
|
||||
|
||||
tags = {
|
||||
CustomTag = "Instance custom tag"
|
||||
}
|
||||
}
|
||||
|
||||
# Supplying custom tags to EKS instances root volumes is another use-case for LaunchTemplates. (doesnt add tags to dynamically provisioned volumes via PVC)
|
||||
tag_specifications {
|
||||
resource_type = "volume"
|
||||
|
||||
tags = {
|
||||
CustomTag = "Volume custom tag"
|
||||
}
|
||||
}
|
||||
|
||||
# Supplying custom tags to EKS instances ENI's is another use-case for LaunchTemplates
|
||||
tag_specifications {
|
||||
resource_type = "network-interface"
|
||||
|
||||
tags = {
|
||||
CustomTag = "EKS example"
|
||||
}
|
||||
}
|
||||
|
||||
# Tag the LT itself
|
||||
tags = {
|
||||
CustomTag = "Launch template custom tag"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
@@ -1,149 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "lt_with_mng-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
node_groups = {
|
||||
# use arleady defined launch template
|
||||
example1 = {
|
||||
name_prefix = "example1"
|
||||
desired_capacity = 1
|
||||
max_capacity = 15
|
||||
min_capacity = 1
|
||||
|
||||
launch_template_id = aws_launch_template.default.id
|
||||
launch_template_version = aws_launch_template.default.default_version
|
||||
|
||||
instance_types = ["t3.small"]
|
||||
|
||||
additional_tags = {
|
||||
ExtraTag = "example1"
|
||||
}
|
||||
}
|
||||
# create launch template
|
||||
example2 = {
|
||||
create_launch_template = true
|
||||
desired_capacity = 1
|
||||
max_capacity = 10
|
||||
min_capacity = 1
|
||||
|
||||
disk_size = 50
|
||||
disk_type = "gp3"
|
||||
disk_throughput = 150
|
||||
disk_iops = 3000
|
||||
|
||||
instance_types = ["t3.large"]
|
||||
capacity_type = "SPOT"
|
||||
|
||||
bootstrap_env = {
|
||||
CONTAINER_RUNTIME = "containerd"
|
||||
USE_MAX_PODS = false
|
||||
}
|
||||
kubelet_extra_args = "--max-pods=110"
|
||||
k8s_labels = {
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
additional_tags = {
|
||||
ExtraTag = "example2"
|
||||
}
|
||||
taints = [
|
||||
{
|
||||
key = "dedicated"
|
||||
value = "gpuGroup"
|
||||
effect = "NO_SCHEDULE"
|
||||
}
|
||||
]
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
MIME-Version: 1.0
|
||||
Content-Type: multipart/mixed; boundary="//"
|
||||
|
||||
--//
|
||||
Content-Type: text/x-shellscript; charset="us-ascii"
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Bootstrap and join the cluster
|
||||
/etc/eks/bootstrap.sh --b64-cluster-ca '${cluster_auth_base64}' --apiserver-endpoint '${endpoint}' ${bootstrap_extra_args} --kubelet-extra-args "${kubelet_extra_args}" '${cluster_name}'
|
||||
|
||||
--//--
|
||||
@@ -1,22 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,73 +0,0 @@
|
||||
# Managed groups example
|
||||
|
||||
This is EKS example using managed groups feature in two different ways:
|
||||
|
||||
- Using SPOT instances in node group
|
||||
- Using ON_DEMAND instance in node group
|
||||
|
||||
See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_map_accounts"></a> [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. | `list(string)` | <pre>[<br> "777777777777",<br> "888888888888"<br>]</pre> | no |
|
||||
| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. | <pre>list(object({<br> rolearn = string<br> username = string<br> groups = list(string)<br> }))</pre> | <pre>[<br> {<br> "groups": [<br> "system:masters"<br> ],<br> "rolearn": "arn:aws:iam::66666666666:role/role1",<br> "username": "role1"<br> }<br>]</pre> | no |
|
||||
| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. | <pre>list(object({<br> userarn = string<br> username = string<br> groups = list(string)<br> }))</pre> | <pre>[<br> {<br> "groups": [<br> "system:masters"<br> ],<br> "userarn": "arn:aws:iam::66666666666:user/user1",<br> "username": "user1"<br> },<br> {<br> "groups": [<br> "system:masters"<br> ],<br> "userarn": "arn:aws:iam::66666666666:user/user2",<br> "username": "user2"<br> }<br>]</pre> | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
| <a name="output_node_groups"></a> [node\_groups](#output\_node\_groups) | Outputs from node groups |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,148 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "managed_node_groups-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
node_groups_defaults = {
|
||||
ami_type = "AL2_x86_64"
|
||||
disk_size = 50
|
||||
}
|
||||
|
||||
node_groups = {
|
||||
example = {
|
||||
desired_capacity = 1
|
||||
max_capacity = 10
|
||||
min_capacity = 1
|
||||
|
||||
instance_types = ["t3.large"]
|
||||
capacity_type = "SPOT"
|
||||
k8s_labels = {
|
||||
Example = "managed_node_groups"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
additional_tags = {
|
||||
ExtraTag = "example"
|
||||
}
|
||||
taints = [
|
||||
{
|
||||
key = "dedicated"
|
||||
value = "gpuGroup"
|
||||
effect = "NO_SCHEDULE"
|
||||
}
|
||||
]
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
}
|
||||
example2 = {
|
||||
desired_capacity = 1
|
||||
max_capacity = 10
|
||||
min_capacity = 1
|
||||
|
||||
instance_types = ["t3.medium"]
|
||||
k8s_labels = {
|
||||
Example = "managed_node_groups"
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
additional_tags = {
|
||||
ExtraTag = "example2"
|
||||
}
|
||||
update_config = {
|
||||
max_unavailable_percentage = 50 # or set `max_unavailable`
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
map_roles = var.map_roles
|
||||
map_users = var.map_users
|
||||
map_accounts = var.map_accounts
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
|
||||
output "node_groups" {
|
||||
description = "Outputs from node groups"
|
||||
value = module.eks.node_groups
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
variable "map_accounts" {
|
||||
description = "Additional AWS account numbers to add to the aws-auth configmap."
|
||||
type = list(string)
|
||||
|
||||
default = [
|
||||
"777777777777",
|
||||
"888888888888",
|
||||
]
|
||||
}
|
||||
|
||||
variable "map_roles" {
|
||||
description = "Additional IAM roles to add to the aws-auth configmap."
|
||||
type = list(object({
|
||||
rolearn = string
|
||||
username = string
|
||||
groups = list(string)
|
||||
}))
|
||||
|
||||
default = [
|
||||
{
|
||||
rolearn = "arn:aws:iam::66666666666:role/role1"
|
||||
username = "role1"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
variable "map_users" {
|
||||
description = "Additional IAM users to add to the aws-auth configmap."
|
||||
type = list(object({
|
||||
userarn = string
|
||||
username = string
|
||||
groups = list(string)
|
||||
}))
|
||||
|
||||
default = [
|
||||
{
|
||||
userarn = "arn:aws:iam::66666666666:user/user1"
|
||||
username = "user1"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
{
|
||||
userarn = "arn:aws:iam::66666666666:user/user2"
|
||||
username = "user2"
|
||||
groups = ["system:masters"]
|
||||
},
|
||||
]
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,66 +0,0 @@
|
||||
# Managed groups example
|
||||
|
||||
This is EKS using [secrets encryption](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) feature.
|
||||
|
||||
See [the official blog](https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/) for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.11.1 |
|
||||
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.4 |
|
||||
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
|
||||
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
|
||||
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
|
||||
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
|
||||
| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
|
||||
| <a name="output_kubectl_config"></a> [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -1,126 +0,0 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "secrets_encryption-${random_string.suffix.result}"
|
||||
cluster_version = "1.20"
|
||||
region = "eu-west-1"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnets = module.vpc.private_subnets
|
||||
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
|
||||
cluster_encryption_config = [
|
||||
{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}
|
||||
]
|
||||
|
||||
worker_groups = [
|
||||
{
|
||||
name = "worker-group-1"
|
||||
instance_type = "t3.small"
|
||||
additional_userdata = "echo foo bar"
|
||||
asg_desired_capacity = 2
|
||||
},
|
||||
]
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Kubernetes provider configuration
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "cluster" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = data.aws_eks_cluster.cluster.endpoint
|
||||
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
|
||||
token = data.aws_eks_cluster_auth.cluster.token
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# KMS for encrypting secrets
|
||||
################################################################################
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
data "aws_availability_zones" "available" {
|
||||
}
|
||||
|
||||
resource "random_string" "suffix" {
|
||||
length = 8
|
||||
special = false
|
||||
}
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
azs = data.aws_availability_zones.available.names
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for EKS control plane."
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "Security group ids attached to the cluster control plane."
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
output "kubectl_config" {
|
||||
description = "kubectl config as generated by the module."
|
||||
value = module.eks.kubeconfig
|
||||
}
|
||||
|
||||
output "config_map_aws_auth" {
|
||||
description = "A kubernetes configuration to authenticate to this EKS cluster."
|
||||
value = module.eks.config_map_aws_auth
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.56"
|
||||
}
|
||||
local = {
|
||||
source = "hashicorp/local"
|
||||
version = ">= 1.4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 1.11.1"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = ">= 2.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
95
examples/self_managed_node_group/README.md
Normal file
95
examples/self_managed_node_group/README.md
Normal file
@@ -0,0 +1,95 @@
|
||||
# Self Managed Node Groups Example
|
||||
|
||||
Configuration in this directory creates an AWS EKS cluster with various Self Managed Node Groups (AutoScaling Groups) demonstrating the various methods of configuring/customizing:
|
||||
|
||||
- A default, "out of the box" self managed node group as supplied by the `self-managed-node-group` sub-module
|
||||
- A Bottlerocket self managed node group that demonstrates many of the configuration/customizations offered by the `self-manged-node-group` sub-module for the Bottlerocket OS
|
||||
- A self managed node group that demonstrates nearly all of the configurations/customizations offered by the `self-managed-node-group` sub-module
|
||||
|
||||
See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) for further details.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
|
||||
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 2.2 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64 |
|
||||
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
|
||||
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 2.2 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_key_pair.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource |
|
||||
| [aws_kms_key.ebs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_security_group.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
|
||||
| [null_resource.apply](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
|
||||
| [aws_ami.bottlerocket_ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.ebs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
|
||||
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
|
||||
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
|
||||
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
|
||||
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
|
||||
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
|
||||
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
|
||||
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
|
||||
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
|
||||
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready |
|
||||
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
|
||||
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
|
||||
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
|
||||
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
|
||||
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
|
||||
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
|
||||
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
|
||||
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
|
||||
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
|
||||
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
|
||||
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
|
||||
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
|
||||
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
392
examples/self_managed_node_group/main.tf
Normal file
392
examples/self_managed_node_group/main.tf
Normal file
@@ -0,0 +1,392 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
cluster_version = "1.21"
|
||||
region = "eu-west-1"
|
||||
|
||||
tags = {
|
||||
Example = local.name
|
||||
GithubRepo = "terraform-aws-eks"
|
||||
GithubOrg = "terraform-aws-modules"
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
################################################################################
|
||||
# EKS Module
|
||||
################################################################################
|
||||
|
||||
module "eks" {
|
||||
source = "../.."
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_version = local.cluster_version
|
||||
cluster_endpoint_private_access = true
|
||||
cluster_endpoint_public_access = true
|
||||
|
||||
cluster_addons = {
|
||||
coredns = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
kube-proxy = {}
|
||||
vpc-cni = {
|
||||
resolve_conflicts = "OVERWRITE"
|
||||
}
|
||||
}
|
||||
|
||||
cluster_encryption_config = [{
|
||||
provider_key_arn = aws_kms_key.eks.arn
|
||||
resources = ["secrets"]
|
||||
}]
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
|
||||
enable_irsa = true
|
||||
|
||||
self_managed_node_group_defaults = {
|
||||
disk_size = 50
|
||||
}
|
||||
|
||||
self_managed_node_groups = {
|
||||
# Default node group - as provisioned by the module defaults
|
||||
default_node_group = {}
|
||||
|
||||
# Bottlerocket node group
|
||||
bottlerocket = {
|
||||
name = "bottlerocket-self-mng"
|
||||
|
||||
platform = "bottlerocket"
|
||||
ami_id = data.aws_ami.bottlerocket_ami.id
|
||||
instance_type = "m5.large"
|
||||
desired_size = 2
|
||||
key_name = aws_key_pair.this.key_name
|
||||
|
||||
iam_role_additional_policies = ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"]
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# The admin host container provides SSH access and runs with "superpowers".
|
||||
# It is disabled by default, but can be disabled explicitly.
|
||||
[settings.host-containers.admin]
|
||||
enabled = false
|
||||
|
||||
# The control host container provides out-of-band access via SSM.
|
||||
# It is enabled by default, and can be disabled if you do not expect to use SSM.
|
||||
# This could leave you with no way to access the API and change settings on an existing node!
|
||||
[settings.host-containers.control]
|
||||
enabled = true
|
||||
|
||||
[settings.kubernetes.node-labels]
|
||||
ingress = "allowed"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Complete
|
||||
complete = {
|
||||
name = "complete-self-mng"
|
||||
use_name_prefix = false
|
||||
|
||||
subnet_ids = module.vpc.public_subnets
|
||||
|
||||
min_size = 1
|
||||
max_size = 7
|
||||
desired_size = 1
|
||||
|
||||
ami_id = "ami-0caf35bc73450c396"
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--max-pods=110'"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
export CONTAINER_RUNTIME="containerd"
|
||||
export USE_MAX_PODS=false
|
||||
EOT
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "you are free little kubelet!"
|
||||
EOT
|
||||
|
||||
disk_size = 256
|
||||
instance_type = "m6i.large"
|
||||
|
||||
launch_template_name = "self-managed-ex"
|
||||
launch_template_use_name_prefix = true
|
||||
launch_template_description = "Self managed node group example launch template"
|
||||
|
||||
ebs_optimized = true
|
||||
vpc_security_group_ids = [aws_security_group.additional.id]
|
||||
enable_monitoring = true
|
||||
|
||||
block_device_mappings = {
|
||||
xvda = {
|
||||
device_name = "/dev/xvda"
|
||||
ebs = {
|
||||
volume_size = 75
|
||||
volume_type = "gp3"
|
||||
iops = 3000
|
||||
throughput = 150
|
||||
encrypted = true
|
||||
kms_key_id = aws_kms_key.ebs.arn
|
||||
delete_on_termination = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
metadata_options = {
|
||||
http_endpoint = "enabled"
|
||||
http_tokens = "required"
|
||||
http_put_response_hop_limit = 2
|
||||
}
|
||||
|
||||
create_iam_role = true
|
||||
iam_role_name = "self-managed-node-group-complete-example"
|
||||
iam_role_use_name_prefix = false
|
||||
iam_role_description = "Self managed node group complete example role"
|
||||
iam_role_tags = {
|
||||
Purpose = "Protector of the kubelet"
|
||||
}
|
||||
iam_role_additional_policies = [
|
||||
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
|
||||
]
|
||||
|
||||
create_security_group = true
|
||||
security_group_name = "self-managed-node-group-complete-example"
|
||||
security_group_use_name_prefix = false
|
||||
security_group_description = "Self managed node group complete example security group"
|
||||
security_group_rules = {
|
||||
phoneOut = {
|
||||
description = "Hello CloudFlare"
|
||||
protocol = "udp"
|
||||
from_port = 53
|
||||
to_port = 53
|
||||
type = "egress"
|
||||
cidr_blocks = ["1.1.1.1/32"]
|
||||
}
|
||||
phoneHome = {
|
||||
description = "Hello cluster"
|
||||
protocol = "udp"
|
||||
from_port = 53
|
||||
to_port = 53
|
||||
type = "egress"
|
||||
source_cluster_security_group = true # bit of reflection lookup
|
||||
}
|
||||
}
|
||||
security_group_tags = {
|
||||
Purpose = "Protector of the kubelet"
|
||||
}
|
||||
|
||||
timeouts = {
|
||||
create = "80m"
|
||||
update = "80m"
|
||||
delete = "80m"
|
||||
}
|
||||
|
||||
tags = {
|
||||
ExtraTag = "Self managed node group complete example"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# aws-auth configmap
|
||||
# Only EKS managed node groups automatically add roles to aws-auth configmap
|
||||
# so we need to ensure fargate profiles and self-managed node roles are added
|
||||
################################################################################
|
||||
|
||||
data "aws_eks_cluster_auth" "this" {
|
||||
name = module.eks.cluster_id
|
||||
}
|
||||
|
||||
locals {
|
||||
kubeconfig = yamlencode({
|
||||
apiVersion = "v1"
|
||||
kind = "Config"
|
||||
current-context = "terraform"
|
||||
clusters = [{
|
||||
name = module.eks.cluster_id
|
||||
cluster = {
|
||||
certificate-authority-data = module.eks.cluster_certificate_authority_data
|
||||
server = module.eks.cluster_endpoint
|
||||
}
|
||||
}]
|
||||
contexts = [{
|
||||
name = "terraform"
|
||||
context = {
|
||||
cluster = module.eks.cluster_id
|
||||
user = "terraform"
|
||||
}
|
||||
}]
|
||||
users = [{
|
||||
name = "terraform"
|
||||
user = {
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
}]
|
||||
})
|
||||
}
|
||||
|
||||
resource "null_resource" "apply" {
|
||||
triggers = {
|
||||
kubeconfig = base64encode(local.kubeconfig)
|
||||
cmd_patch = <<-EOT
|
||||
kubectl create configmap aws-auth -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)
|
||||
kubectl patch configmap/aws-auth --patch "${module.eks.aws_auth_configmap_yaml}" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)
|
||||
EOT
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["/bin/bash", "-c"]
|
||||
environment = {
|
||||
KUBECONFIG = self.triggers.kubeconfig
|
||||
}
|
||||
command = self.triggers.cmd_patch
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Supporting Resources
|
||||
################################################################################
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
||||
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
enable_flow_log = true
|
||||
create_flow_log_cloudwatch_iam_role = true
|
||||
create_flow_log_cloudwatch_log_group = true
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_security_group" "additional" {
|
||||
name_prefix = "${local.name}-additional"
|
||||
vpc_id = module.vpc.vpc_id
|
||||
|
||||
ingress {
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = [
|
||||
"10.0.0.0/8",
|
||||
"172.16.0.0/12",
|
||||
"192.168.0.0/16",
|
||||
]
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "eks" {
|
||||
description = "EKS Secret Encryption Key"
|
||||
deletion_window_in_days = 7
|
||||
enable_key_rotation = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_ami" "bottlerocket_ami" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["bottlerocket-aws-k8s-${local.cluster_version}-x86_64-*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "tls_private_key" "this" {
|
||||
algorithm = "RSA"
|
||||
}
|
||||
|
||||
resource "aws_key_pair" "this" {
|
||||
key_name = local.name
|
||||
public_key = tls_private_key.this.public_key_openssh
|
||||
}
|
||||
|
||||
resource "aws_kms_key" "ebs" {
|
||||
description = "Customer managed key to encrypt self managed node group volumes"
|
||||
deletion_window_in_days = 7
|
||||
policy = data.aws_iam_policy_document.ebs.json
|
||||
}
|
||||
|
||||
# This policy is required for the KMS key used for EKS root volumes, so the cluster is allowed to enc/dec/attach encrypted EBS volumes
|
||||
data "aws_iam_policy_document" "ebs" {
|
||||
# Copy of default KMS policy that lets you manage it
|
||||
statement {
|
||||
sid = "Enable IAM User Permissions"
|
||||
actions = ["kms:*"]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
||||
}
|
||||
}
|
||||
|
||||
# Required for EKS
|
||||
statement {
|
||||
sid = "Allow service-linked role use of the CMK"
|
||||
actions = [
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt",
|
||||
"kms:ReEncrypt*",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:DescribeKey"
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = [
|
||||
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "Allow attachment of persistent resources"
|
||||
actions = ["kms:CreateGrant"]
|
||||
resources = ["*"]
|
||||
|
||||
principals {
|
||||
type = "AWS"
|
||||
identifiers = [
|
||||
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", # required for the ASG to manage encrypted volumes for nodes
|
||||
module.eks.cluster_iam_role_arn, # required for the cluster / persistentvolume-controller to create encrypted PVCs
|
||||
]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "Bool"
|
||||
variable = "kms:GrantIsForAWSResource"
|
||||
values = ["true"]
|
||||
}
|
||||
}
|
||||
}
|
||||
167
examples/self_managed_node_group/outputs.tf
Normal file
167
examples/self_managed_node_group/outputs.tf
Normal file
@@ -0,0 +1,167 @@
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
output "cluster_arn" {
|
||||
description = "The Amazon Resource Name (ARN) of the cluster"
|
||||
value = module.eks.cluster_arn
|
||||
}
|
||||
|
||||
output "cluster_certificate_authority_data" {
|
||||
description = "Base64 encoded certificate data required to communicate with the cluster"
|
||||
value = module.eks.cluster_certificate_authority_data
|
||||
}
|
||||
|
||||
output "cluster_endpoint" {
|
||||
description = "Endpoint for your Kubernetes API server"
|
||||
value = module.eks.cluster_endpoint
|
||||
}
|
||||
|
||||
output "cluster_id" {
|
||||
description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
|
||||
value = module.eks.cluster_id
|
||||
}
|
||||
|
||||
output "cluster_oidc_issuer_url" {
|
||||
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
|
||||
value = module.eks.cluster_oidc_issuer_url
|
||||
}
|
||||
|
||||
output "cluster_platform_version" {
|
||||
description = "Platform version for the cluster"
|
||||
value = module.eks.cluster_platform_version
|
||||
}
|
||||
|
||||
output "cluster_status" {
|
||||
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
|
||||
value = module.eks.cluster_status
|
||||
}
|
||||
|
||||
output "cluster_primary_security_group_id" {
|
||||
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
|
||||
value = module.eks.cluster_primary_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Security Group
|
||||
################################################################################
|
||||
|
||||
output "cluster_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the cluster security group"
|
||||
value = module.eks.cluster_security_group_arn
|
||||
}
|
||||
|
||||
output "cluster_security_group_id" {
|
||||
description = "ID of the cluster security group"
|
||||
value = module.eks.cluster_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Node Security Group
|
||||
################################################################################
|
||||
|
||||
output "node_security_group_arn" {
|
||||
description = "Amazon Resource Name (ARN) of the node shared security group"
|
||||
value = module.eks.node_security_group_arn
|
||||
}
|
||||
|
||||
output "node_security_group_id" {
|
||||
description = "ID of the node shared security group"
|
||||
value = module.eks.node_security_group_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IRSA
|
||||
################################################################################
|
||||
|
||||
output "oidc_provider_arn" {
|
||||
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
|
||||
value = module.eks.oidc_provider_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
output "cluster_iam_role_name" {
|
||||
description = "IAM role name of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_name
|
||||
}
|
||||
|
||||
output "cluster_iam_role_arn" {
|
||||
description = "IAM role ARN of the EKS cluster"
|
||||
value = module.eks.cluster_iam_role_arn
|
||||
}
|
||||
|
||||
output "cluster_iam_role_unique_id" {
|
||||
description = "Stable and unique string identifying the IAM role"
|
||||
value = module.eks.cluster_iam_role_unique_id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
output "cluster_addons" {
|
||||
description = "Map of attribute maps for all EKS cluster addons enabled"
|
||||
value = module.eks.cluster_addons
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
################################################################################
|
||||
|
||||
output "cluster_identity_providers" {
|
||||
description = "Map of attribute maps for all EKS identity providers enabled"
|
||||
value = module.eks.cluster_identity_providers
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# CloudWatch Log Group
|
||||
################################################################################
|
||||
|
||||
output "cloudwatch_log_group_name" {
|
||||
description = "Name of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_name
|
||||
}
|
||||
|
||||
output "cloudwatch_log_group_arn" {
|
||||
description = "Arn of cloudwatch log group created"
|
||||
value = module.eks.cloudwatch_log_group_arn
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Fargate Profile
|
||||
################################################################################
|
||||
|
||||
output "fargate_profiles" {
|
||||
description = "Map of attribute maps for all EKS Fargate Profiles created"
|
||||
value = module.eks.fargate_profiles
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "eks_managed_node_groups" {
|
||||
description = "Map of attribute maps for all EKS managed node groups created"
|
||||
value = module.eks.eks_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Self Managed Node Group
|
||||
################################################################################
|
||||
|
||||
output "self_managed_node_groups" {
|
||||
description = "Map of attribute maps for all self managed node groups created"
|
||||
value = module.eks.self_managed_node_groups
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Additional
|
||||
################################################################################
|
||||
|
||||
output "aws_auth_configmap_yaml" {
|
||||
description = "Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles"
|
||||
value = module.eks.aws_auth_configmap_yaml
|
||||
}
|
||||
18
examples/self_managed_node_group/versions.tf
Normal file
18
examples/self_managed_node_group/versions.tf
Normal file
@@ -0,0 +1,18 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
null = {
|
||||
source = "hashicorp/null"
|
||||
version = ">= 3.0"
|
||||
}
|
||||
tls = {
|
||||
source = "hashicorp/tls"
|
||||
version = ">= 2.2"
|
||||
}
|
||||
}
|
||||
}
|
||||
78
examples/user_data/README.md
Normal file
78
examples/user_data/README.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# Internal User Data Module
|
||||
|
||||
Configuration in this directory render various user data outputs used for testing and validating the internal `_user-data` sub-module.
|
||||
|
||||
## Usage
|
||||
|
||||
To run this example you need to execute:
|
||||
|
||||
```bash
|
||||
$ terraform init
|
||||
$ terraform plan
|
||||
$ terraform apply
|
||||
```
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64 |
|
||||
|
||||
## Providers
|
||||
|
||||
No providers.
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_eks_mng_bottlerocket_additional"></a> [eks\_mng\_bottlerocket\_additional](#module\_eks\_mng\_bottlerocket\_additional) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_bottlerocket_custom_ami"></a> [eks\_mng\_bottlerocket\_custom\_ami](#module\_eks\_mng\_bottlerocket\_custom\_ami) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_bottlerocket_custom_template"></a> [eks\_mng\_bottlerocket\_custom\_template](#module\_eks\_mng\_bottlerocket\_custom\_template) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_bottlerocket_no_op"></a> [eks\_mng\_bottlerocket\_no\_op](#module\_eks\_mng\_bottlerocket\_no\_op) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_linux_additional"></a> [eks\_mng\_linux\_additional](#module\_eks\_mng\_linux\_additional) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_linux_custom_ami"></a> [eks\_mng\_linux\_custom\_ami](#module\_eks\_mng\_linux\_custom\_ami) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_linux_custom_template"></a> [eks\_mng\_linux\_custom\_template](#module\_eks\_mng\_linux\_custom\_template) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_eks_mng_linux_no_op"></a> [eks\_mng\_linux\_no\_op](#module\_eks\_mng\_linux\_no\_op) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_bottlerocket_bootstrap"></a> [self\_mng\_bottlerocket\_bootstrap](#module\_self\_mng\_bottlerocket\_bootstrap) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_bottlerocket_custom_template"></a> [self\_mng\_bottlerocket\_custom\_template](#module\_self\_mng\_bottlerocket\_custom\_template) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_bottlerocket_no_op"></a> [self\_mng\_bottlerocket\_no\_op](#module\_self\_mng\_bottlerocket\_no\_op) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_linux_bootstrap"></a> [self\_mng\_linux\_bootstrap](#module\_self\_mng\_linux\_bootstrap) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_linux_custom_template"></a> [self\_mng\_linux\_custom\_template](#module\_self\_mng\_linux\_custom\_template) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_linux_no_op"></a> [self\_mng\_linux\_no\_op](#module\_self\_mng\_linux\_no\_op) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_windows_bootstrap"></a> [self\_mng\_windows\_bootstrap](#module\_self\_mng\_windows\_bootstrap) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_windows_custom_template"></a> [self\_mng\_windows\_custom\_template](#module\_self\_mng\_windows\_custom\_template) | ../../modules/_user_data | n/a |
|
||||
| <a name="module_self_mng_windows_no_op"></a> [self\_mng\_windows\_no\_op](#module\_self\_mng\_windows\_no\_op) | ../../modules/_user_data | n/a |
|
||||
|
||||
## Resources
|
||||
|
||||
No resources.
|
||||
|
||||
## Inputs
|
||||
|
||||
No inputs.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| <a name="output_eks_mng_bottlerocket_additional"></a> [eks\_mng\_bottlerocket\_additional](#output\_eks\_mng\_bottlerocket\_additional) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_bottlerocket_custom_ami"></a> [eks\_mng\_bottlerocket\_custom\_ami](#output\_eks\_mng\_bottlerocket\_custom\_ami) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_bottlerocket_custom_template"></a> [eks\_mng\_bottlerocket\_custom\_template](#output\_eks\_mng\_bottlerocket\_custom\_template) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_bottlerocket_no_op"></a> [eks\_mng\_bottlerocket\_no\_op](#output\_eks\_mng\_bottlerocket\_no\_op) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_linux_additional"></a> [eks\_mng\_linux\_additional](#output\_eks\_mng\_linux\_additional) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_linux_custom_ami"></a> [eks\_mng\_linux\_custom\_ami](#output\_eks\_mng\_linux\_custom\_ami) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_linux_custom_template"></a> [eks\_mng\_linux\_custom\_template](#output\_eks\_mng\_linux\_custom\_template) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_eks_mng_linux_no_op"></a> [eks\_mng\_linux\_no\_op](#output\_eks\_mng\_linux\_no\_op) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_bottlerocket_bootstrap"></a> [self\_mng\_bottlerocket\_bootstrap](#output\_self\_mng\_bottlerocket\_bootstrap) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_bottlerocket_custom_template"></a> [self\_mng\_bottlerocket\_custom\_template](#output\_self\_mng\_bottlerocket\_custom\_template) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_bottlerocket_no_op"></a> [self\_mng\_bottlerocket\_no\_op](#output\_self\_mng\_bottlerocket\_no\_op) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_linux_bootstrap"></a> [self\_mng\_linux\_bootstrap](#output\_self\_mng\_linux\_bootstrap) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_linux_custom_template"></a> [self\_mng\_linux\_custom\_template](#output\_self\_mng\_linux\_custom\_template) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_linux_no_op"></a> [self\_mng\_linux\_no\_op](#output\_self\_mng\_linux\_no\_op) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_windows_bootstrap"></a> [self\_mng\_windows\_bootstrap](#output\_self\_mng\_windows\_bootstrap) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_windows_custom_template"></a> [self\_mng\_windows\_custom\_template](#output\_self\_mng\_windows\_custom\_template) | Base64 decoded user data rendered for the provided inputs |
|
||||
| <a name="output_self_mng_windows_no_op"></a> [self\_mng\_windows\_no\_op](#output\_self\_mng\_windows\_no\_op) | Base64 decoded user data rendered for the provided inputs |
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
289
examples/user_data/main.tf
Normal file
289
examples/user_data/main.tf
Normal file
@@ -0,0 +1,289 @@
|
||||
locals {
|
||||
name = "ex-${replace(basename(path.cwd), "_", "-")}"
|
||||
|
||||
cluster_endpoint = "https://012345678903AB2BAE5D1E0BFE0E2B50.gr7.us-east-1.eks.amazonaws.com"
|
||||
cluster_auth_base64 = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKbXFqQ1VqNGdGR2w3ZW5PeWthWnZ2RjROOTVOUEZCM2o0cGhVZUsrWGFtN2ZSQnZya0d6OGxKZmZEZWF2b2plTwpQK2xOZFlqdHZncmxCUEpYdHZIZmFzTzYxVzdIZmdWQ2EvamdRM2w3RmkvL1dpQmxFOG9oWUZkdWpjc0s1SXM2CnNkbk5KTTNYUWN2TysrSitkV09NT2ZlNzlsSWdncmdQLzgvRU9CYkw3eUY1aU1hS3lsb1RHL1V3TlhPUWt3ZUcKblBNcjdiUmdkQ1NCZTlXYXowOGdGRmlxV2FOditsTDhsODBTdFZLcWVNVlUxbjQyejVwOVpQRTd4T2l6L0xTNQpYV2lXWkVkT3pMN0xBWGVCS2gzdkhnczFxMkI2d1BKZnZnS1NzWllQRGFpZTloT1NNOUJkNFNPY3JrZTRYSVBOCkVvcXVhMlYrUDRlTWJEQzhMUkVWRDdCdVZDdWdMTldWOTBoL3VJUy9WU2VOcEdUOGVScE5DakszSjc2aFlsWm8KWjNGRG5QWUY0MWpWTHhiOXF0U1ROdEp6amYwWXBEYnFWci9xZzNmQWlxbVorMzd3YWM1eHlqMDZ4cmlaRUgzZgpUM002d2lCUEVHYVlGeWN5TmNYTk5aYW9DWDJVL0N1d2JsUHAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ=="
|
||||
cluster_service_ipv4_cidr = "172.16.0.0/16"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# User Data Module
|
||||
################################################################################
|
||||
|
||||
# EKS managed node group - linux
|
||||
module "eks_mng_linux_no_op" {
|
||||
source = "../../modules/_user_data"
|
||||
}
|
||||
|
||||
module "eks_mng_linux_additional" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "All done"
|
||||
EOT
|
||||
}
|
||||
|
||||
module "eks_mng_linux_custom_ami" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
cluster_service_ipv4_cidr = local.cluster_service_ipv4_cidr
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "All done"
|
||||
EOT
|
||||
}
|
||||
|
||||
|
||||
module "eks_mng_linux_custom_template" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
user_data_template_path = "${path.module}/templates/linux_custom.tpl"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "All done"
|
||||
EOT
|
||||
}
|
||||
|
||||
# EKS managed node group - bottlerocket
|
||||
module "eks_mng_bottlerocket_no_op" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
}
|
||||
|
||||
module "eks_mng_bottlerocket_additional" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
module "eks_mng_bottlerocket_custom_ami" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
module "eks_mng_bottlerocket_custom_template" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
user_data_template_path = "${path.module}/templates/bottlerocket_custom.tpl"
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Self managed node group - linux
|
||||
module "self_mng_linux_no_op" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
is_eks_managed_node_group = false
|
||||
}
|
||||
|
||||
module "self_mng_linux_bootstrap" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "All done"
|
||||
EOT
|
||||
}
|
||||
|
||||
module "self_mng_linux_custom_template" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
user_data_template_path = "${path.module}/templates/linux_custom.tpl"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
echo "foo"
|
||||
export FOO=bar
|
||||
EOT
|
||||
|
||||
bootstrap_extra_args = "--kubelet-extra-args '--node-labels=node.kubernetes.io/lifecycle=spot'"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
echo "All done"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Self managed node group - bottlerocket
|
||||
module "self_mng_bottlerocket_no_op" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
is_eks_managed_node_group = false
|
||||
}
|
||||
|
||||
module "self_mng_bottlerocket_bootstrap" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
module "self_mng_bottlerocket_custom_template" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "bottlerocket"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
user_data_template_path = "${path.module}/templates/bottlerocket_custom.tpl"
|
||||
|
||||
bootstrap_extra_args = <<-EOT
|
||||
# extra args added
|
||||
[settings.kernel]
|
||||
lockdown = "integrity"
|
||||
EOT
|
||||
}
|
||||
|
||||
# Self managed node group - windows
|
||||
module "self_mng_windows_no_op" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "windows"
|
||||
|
||||
is_eks_managed_node_group = false
|
||||
}
|
||||
|
||||
module "self_mng_windows_bootstrap" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "windows"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
[string]$Something = 'IDoNotKnowAnyPowerShell ¯\_(ツ)_/¯'
|
||||
EOT
|
||||
# I don't know if this is the right way on WindowsOS, but its just a string check here anyways
|
||||
bootstrap_extra_args = "-KubeletExtraArgs --node-labels=node.kubernetes.io/lifecycle=spot"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
[string]$Something = 'IStillDoNotKnowAnyPowerShell ¯\_(ツ)_/¯'
|
||||
EOT
|
||||
}
|
||||
|
||||
module "self_mng_windows_custom_template" {
|
||||
source = "../../modules/_user_data"
|
||||
|
||||
platform = "windows"
|
||||
|
||||
enable_bootstrap_user_data = true
|
||||
is_eks_managed_node_group = false
|
||||
|
||||
cluster_name = local.name
|
||||
cluster_endpoint = local.cluster_endpoint
|
||||
cluster_auth_base64 = local.cluster_auth_base64
|
||||
|
||||
user_data_template_path = "${path.module}/templates/windows_custom.tpl"
|
||||
|
||||
pre_bootstrap_user_data = <<-EOT
|
||||
[string]$Something = 'IDoNotKnowAnyPowerShell ¯\_(ツ)_/¯'
|
||||
EOT
|
||||
# I don't know if this is the right way on WindowsOS, but its just a string check here anyways
|
||||
bootstrap_extra_args = "-KubeletExtraArgs --node-labels=node.kubernetes.io/lifecycle=spot"
|
||||
|
||||
post_bootstrap_user_data = <<-EOT
|
||||
[string]$Something = 'IStillDoNotKnowAnyPowerShell ¯\_(ツ)_/¯'
|
||||
EOT
|
||||
}
|
||||
89
examples/user_data/outputs.tf
Normal file
89
examples/user_data/outputs.tf
Normal file
@@ -0,0 +1,89 @@
|
||||
# EKS managed node group - linux
|
||||
output "eks_mng_linux_no_op" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_linux_no_op.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_linux_additional" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_linux_additional.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_linux_custom_ami" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_linux_custom_ami.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_linux_custom_template" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_linux_custom_template.user_data)
|
||||
}
|
||||
|
||||
# EKS managed node group - bottlerocket
|
||||
output "eks_mng_bottlerocket_no_op" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_bottlerocket_no_op.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_bottlerocket_additional" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_bottlerocket_additional.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_bottlerocket_custom_ami" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_bottlerocket_custom_ami.user_data)
|
||||
}
|
||||
|
||||
output "eks_mng_bottlerocket_custom_template" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.eks_mng_bottlerocket_custom_template.user_data)
|
||||
}
|
||||
|
||||
# Self managed node group - linux
|
||||
output "self_mng_linux_no_op" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_linux_no_op.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_linux_bootstrap" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_linux_bootstrap.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_linux_custom_template" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_linux_custom_template.user_data)
|
||||
}
|
||||
|
||||
# Self managed node group - bottlerocket
|
||||
output "self_mng_bottlerocket_no_op" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_bottlerocket_no_op.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_bottlerocket_bootstrap" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_bottlerocket_bootstrap.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_bottlerocket_custom_template" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_bottlerocket_custom_template.user_data)
|
||||
}
|
||||
|
||||
# Self managed node group - windows
|
||||
output "self_mng_windows_no_op" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_windows_no_op.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_windows_bootstrap" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_windows_bootstrap.user_data)
|
||||
}
|
||||
|
||||
output "self_mng_windows_custom_template" {
|
||||
description = "Base64 decoded user data rendered for the provided inputs"
|
||||
value = base64decode(module.self_mng_windows_custom_template.user_data)
|
||||
}
|
||||
7
examples/user_data/templates/bottlerocket_custom.tpl
Normal file
7
examples/user_data/templates/bottlerocket_custom.tpl
Normal file
@@ -0,0 +1,7 @@
|
||||
# Custom user data template provided for rendering
|
||||
[settings.kubernetes]
|
||||
"cluster-name" = "${cluster_name}"
|
||||
"api-server" = "${cluster_endpoint}"
|
||||
"cluster-certificate" = "${cluster_auth_base64}"
|
||||
|
||||
${bootstrap_extra_args~}
|
||||
10
examples/user_data/templates/linux_custom.tpl
Normal file
10
examples/user_data/templates/linux_custom.tpl
Normal file
@@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
|
||||
${pre_bootstrap_user_data ~}
|
||||
|
||||
# Custom user data template provided for rendering
|
||||
B64_CLUSTER_CA=${cluster_auth_base64}
|
||||
API_SERVER_URL=${cluster_endpoint}
|
||||
/etc/eks/bootstrap.sh ${cluster_name} ${bootstrap_extra_args} --b64-cluster-ca $B64_CLUSTER_CA --apiserver-endpoint $API_SERVER_URL
|
||||
${post_bootstrap_user_data ~}
|
||||
10
examples/user_data/templates/windows_custom.tpl
Normal file
10
examples/user_data/templates/windows_custom.tpl
Normal file
@@ -0,0 +1,10 @@
|
||||
# Custom user data template provided for rendering
|
||||
<powershell>
|
||||
${pre_bootstrap_user_data ~}
|
||||
[string]$EKSBinDir = "$env:ProgramFiles\Amazon\EKS"
|
||||
[string]$EKSBootstrapScriptName = 'Start-EKSBootstrap.ps1'
|
||||
[string]$EKSBootstrapScriptFile = "$EKSBinDir\$EKSBootstrapScriptName"
|
||||
& $EKSBootstrapScriptFile -EKSClusterName ${cluster_name} -APIServerEndpoint ${cluster_endpoint} -Base64ClusterCA ${cluster_auth_base64} ${bootstrap_extra_args} 3>&1 4>&1 5>&1 6>&1
|
||||
$LastError = if ($?) { 0 } else { $Error[0].Exception.HResult }
|
||||
${post_bootstrap_user_data ~}
|
||||
</powershell>
|
||||
10
examples/user_data/versions.tf
Normal file
10
examples/user_data/versions.tf
Normal file
@@ -0,0 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 0.13.1"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.64"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user