{"id":30788540,"url":"https://github.com/eliyasv/eks-tf-infra","last_synced_at":"2026-04-13T18:01:39.289Z","repository":{"id":305271569,"uuid":"1017737875","full_name":"eliyasv/EKS-TF-infra","owner":"eliyasv","description":"A project that provisions an Amazon EKS cluster designed for scalability, reusability, and DevOps automation best practices.","archived":false,"fork":false,"pushed_at":"2026-02-15T18:40:46.000Z","size":39,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-16T00:32:46.362Z","etag":null,"topics":["aws","eks","jenkins","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eliyasv.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-11T02:59:02.000Z","updated_at":"2026-02-15T18:40:50.000Z","dependencies_parsed_at":"2025-07-19T09:45:22.134Z","dependency_job_id":"ffb93278-c8c1-43cf-8638-b8888a29801b","html_url":"https://github.com/eliyasv/EKS-TF-infra","commit_stats":null,"previous_names":["eliyasv/eks-tf-infra"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/eliyasv/EKS-TF-infra","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eliyasv%2FEKS-TF-infra","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eliyasv%2FEKS-TF-infra/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eliyasv%2FEKS-TF-infra/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eliyasv%2FEKS-TF-infra/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eliyasv","download_url":"https://codeload.github.com/eliyasv/EKS-TF-infra/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eliyasv%2FEKS-TF-infra/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31764317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-13T15:25:13.801Z","status":"ssl_error","status_checked_at":"2026-04-13T15:25:09.162Z","response_time":93,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","eks","jenkins","terraform","terraform-modules"],"created_at":"2025-09-05T13:03:57.587Z","updated_at":"2026-04-13T18:01:39.283Z","avatar_url":"https://github.com/eliyasv.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"## EKS Infrastructure with Terraform\n\nProduction-style Kubernetes infrastructure on AWS using Terraform, designed to be modular, reproducible, and environment-agnostic.\n\nThis project demonstrates Infrastructure as Code, Kubernetes platform provisioning, and cloud networking design aligned with DevOps best practices.\n\n---\n### What This Project Demonstrates\n\n* Infrastructure as Code using Terraform\n* Kubernetes platform provisioning on AWS\n* Cloud networking design (VPC/subnets/routing)\n* IAM role configuration for managed services\n* Reusable infrastructure modules\n* Cluster scalability design (scalable from 3–8 nodes)\n\n### Features\n\n*  Separate environments (`dev`, `prod`)\n*  Modular Terraform structure (`vpc`, `iam`, `eks`)\n*  Multi-AZ for high availability\n*  Public/private subnets with NAT Gateway\n*  Spot and On-Demand node groups for cost optimization\n*  Secure EKS cluster (private API access)\n*  OIDC/IRSA enabled for Kubernetes IAM\n*  Configurable EKS add-ons\n*  CI/CD ready with Jenkins pipeline for safe plan/apply/destroy\n*  Remote S3 backend with state locking via DynamoDB for Terraform state management\n\n---\n\n### Architecture Overview\n\n      ┌─────────────────────────────────────────────────────────────────────────────┐\n      │                              AWS CLOUD (us-east-1)                          │\n      │                                                                             │\n      │  ┌───────────────────────────────────────────────────────────────────────┐  │\n      │  │                         VPC (10.x.0.0/16)                             │  │\n      │  │                                                                       │  │\n      │  │  ┌──────────────────┐         ┌────────────────────────────────────┐  │  │\n      │  │  │  Public Subnets  │         │       Private Subnets              │  │  │\n      │  │  │  (3 AZs)         │         │         (3 AZs)                    │  │  │\n      │  │  │                  │         │                                    │  │  │\n      │  │  │  ┌────────────┐  │         │  ┌──────────────────────────────┐  │  │  │\n      │  │  │  │ Internet   │  │         │  │      EKS Cluster             │  │  │  │\n      │  │  │  │  Gateway   │  │         │  │  ┌──────────────────────┐    │  │  │  │\n      │  │  │  └─────┬──────┘  │         │  │  │   Control Plane      │    │  │  │  │\n      │  │  │        │         │         │  │  │   (Private API)      │    │  │  │  │\n      │  │  │  ┌─────▼──────┐  │         │  │  └──────────┬───────────┘    │  │  │  │\n      │  │  │  │ NAT Gateway│  │         │  │             │                │  │  │  │\n      │  │  │  └────────────┘  │         │  │  ┌──────────▼───────────┐    │  │  │  │\n      │  │  │                  │         │  │  │   Node Groups        │    │  │  │  │\n      │  │  │  ┌────────────┐  │         │  │  │  • On-Demand         │    │  │  │  │\n      │  │  │  │ Route Table│  │         │  │  │  • Spot              │    │  │  │  │\n      │  │  │  └────────────┘  │         │  │  └──────────────────────┘    │  │  │  │\n      │  │  └──────────────────┘         └────────────────────────────────────┘  │  |\n      │  └───────────────────────────────────────────────────────────────────────┘  │\n      │                                                                             │\n      │  ┌──────────────────────────┐  ┌────────────────────────────────────────┐   │\n      │  │      IAM Roles           │  │         State Backend                  │   │\n      │  │  • Control Plane         │  │  • S3 (terraform.tfstate)              │   │\n      │  │  • Node Groups           │  │  • DynamoDB (state locking)            │   │\n      │  │  • OIDC/IRSA             │  │                                        │   │\n      │  └──────────────────────────┘  └────────────────────────────────────────┘   │\n      └─────────────────────────────────────────────────────────────────────────────┘\n                          ^                                  ^\n                          │                                  │\n               ┌──────────┴──────────┐             ┌─────────┴─────────┐\n               │   Jenkins Pipeline  │             │  Jumpserver       │\n               │   (Plan→Apply)      │             │   (kubectl)       │\n               └──────────┬──────────┘             └─────────┬─────────┘\n                          │                                    │\n                          └────────────┬───────────────────────┘\n                                       │\n                               ┌───────▼───────┐\n                               │ Git Repository│\n                               │ (Terraform)   │\n                               └───────────────┘\n\n\n### Terraform Module Overview\n      ┌─────────────────────┬───────────────────────────────────────────────────────┐\n      │      MODULE         │              WHAT IT BUILDS                           │\n      ├─────────────────────┼───────────────────────────────────────────────────────┤\n      │                     │                                                       │\n      │   modules/vpc/      │  Networking Foundation                                │\n      │                     │  • VPC (Virtual Private Cloud)                        │\n      │                     │  • Public Subnets (3 AZs)                             │\n      │                     │  • Private Subnets (3 AZs)                            │\n      │                     │  • Internet Gateway                                   │\n      │                     │  • NAT Gateway + Elastic IP                           │\n      │                     │  • Route Tables (public + private)                    │\n      │                     │  • Security Groups                                    │\n      │                     │                                                       │\n      ├─────────────────────┼───────────────────────────────────────────────────────┤\n      │                     │                                                       │\n      │   modules/iam/      │  Identity \u0026 Access Management                         │\n      │                     │  PHASE 1 (iam_pre):                                   │\n      │                     │  • EKS Control Plane IAM Role                         │\n      │                     │  • EKS Node Group IAM Role                            │\n      │                     │  • Attached AWS Managed Policies                      │\n      │                     │                                                       │\n      │                     │  PHASE 2 (iam_irsa):                                  │\n      │                     │  • OIDC Provider (trust relationship with EKS)        │\n      │                     │  • IRSA IAM Roles (for Kubernetes service accounts)   │\n      │                     │  • Custom IAM Policies                                │\n      │                     │                                                       │\n      ├─────────────────────┼───────────────────────────────────────────────────────┤\n      │                     │                                                       │\n      │   modules/eks/      │  Kubernetes Cluster                                   │\n      │                     │  • EKS Cluster (Control Plane)                        │\n      │                     │  • On-Demand Node Group                               │\n      │                     │  • Spot Node Group                                    │\n      │                     │  • EKS Add-ons (vpc-cni, coredns, kube-proxy, ebs-csi)│\n      │                     │                                                       │\n      └─────────────────────┴───────────────────────────────────────────────────────┘\n\n---\n\n### Prerequisites\n\n* Terraform CLI\n* AWS IAM user with appropriate permissions\n* S3 bucket + DynamoDB table for remote state storing\n* Jenkins server configured with docker, terraform  plugins and credentials (for all relevant CI/CD jobs.) \n\n---\n\n### CI Pipeline (Jenkins)\n\nInfrastructure provisioning is automated using a Jenkins pipeline.\nThe pipeline supports environment-based deployments and safe infrastructure changes.\n\nPipeline Stages:\n\n* Checkout repository\n* Prepare environment backend configuration\n* Terraform init\n* Terraform fmt\n* Terraform validate\n* Terraform plan\n* Manual approval (apply/destroy)\n* Terraform apply or destroy\n\nThe pipeline uses parameterized builds:\n\nENVIRONMENT:  dev/prod\nACTION:  plan/apply/destroy\n\nInfrastructure changes follow this workflow:\n\nGit Commit → Jenkins Pipeline → Terraform Plan → Approval → Apply → AWS EKS\n\nThis workflow ensures infrastructure changes are validated before provisioning and provides controlled deployment of cloud resources.\n\n---\n\n### Accessing the Cluster\n\n```bash\n#Get kubeconfig\naws eks update-kubeconfig --region us-east-1 --name ignite-cluster-dev\n#Verify access\nkubectl get nodes\n# Deploy sample app\nkubectl apply -f https://k8s.io/examples/application/deployment.yaml\n```\n---\n\n### Folder Structure\n\n```bash\n❯ tree -aL 3\n.\n├── environments\n│   ├── dev\n│   │   ├── backend.tf\n│   │   └── dev.tfvars\n│   └── prod\n│       ├── backend.tf\n│       └── prod.tfvars\n├── .gitignore\n├── Jenkinsfile\n├── main.tf\n├── modules\n│   ├── eks\n│   │   ├── main.tf\n│   │   ├── outputs.tf\n│   │   └── variables.tf\n│   ├── iam\n│   │   ├── data.tf\n│   │   ├── main.tf\n│   │   ├── outputs.tf\n│   │   └── variables.tf\n│   └── vpc\n│       ├── main.tf\n│       ├── outputs.tf\n│       └── variables.tf\n├── outputs.tf\n├── data.tf\n├── providers.tf\n├── README.md\n└── variables.tf\n\n\n```\n---\n\n---\n\n### Remote Backend Configuration\n\nEdit `backend.tf` to match your S3 and DynamoDB setup:\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket         = \"bucketname\"\n    key            = \"path to terraform.tfstate\"\n    region         = \"us-east-1\"\n    dynamodb_table = \"lock\"\n    encrypt        = true\n  }\n}\n```\n\n---\n\n### Environment Variables\n\nYou can override values in `dev.tfvars` or `prod.tfvars`. Example:\n\n```hcl\n# environments/dev.tfvars\ninfra_environment       = \"dev\"\ninfra_region            = \"us-east-1\"\ninfra_vpc_cidr          = \"10.10.0.0/16\"\ninfra_cluster_name      = \"dev-project-ignite-cluster\"\ninfra_enable_eks        = true\ninfra_cluster_version       = \"1.30\"\n...\n```\n\n---\n\n### Per-Environment Terraform Workflow (Locally)\n\nYou can deploy or manage infrastructure for each environment (`dev`, `prod`, etc.) independently using their own backend and variable files.\n\n\u003e 📌 All commands should be run from the project root (`EKS-TF-infra/`)\n\n### Steps for `dev` Environment Quick Start (local)\n\n```bash\n\n# Clone repo\ngit clone https://github.com/eliyasv/EKS-TF-infra.git\ncd EKS-TF-infra\n# Copy backend config\ncp environments/dev/backend.tf ./backend.tf\n# Initialize Terraform\nterraform init\n# Plan for dev(This creates an execution plan based on the dev environment variables.)\nterraform plan -var-file=environments/dev/dev.tfvars -out=tfplan-dev\n# Apply for dev\nterraform apply tfplan-dev\n\n```\n\nThis Terraform configuration deploys a production-ready EKS cluster named ignite-cluster-dev in the us-east-1 region. It includes:\n\n* An EKS cluster running Kubernetes version 1.30\n* Node groups using both On-demand and Spot EC2 instances with autoscaling capability\n* EKS managed addons: coredns, kube-proxy, vpc-cni, and aws-ebs-csi-driver\n* AWS Identity and Access Management (IAM) roles and policies, including OpenID Connect (OIDC) provider for IAM Roles for Service Accounts (IRSA)\n* Virtual Private Cloud (VPC) with public and private subnets across multiple Availability Zones\n* NAT gateway and Internet Gateway for routing internet traffic\n* Route tables for public and private subnet routing\n\n\n```bash\n\n# Destroy dev\nterraform destroy -var-file=environments/dev/dev.tfvars\n\n# Clean up\nrm backend.tf\n```\n### Switching Between Environments (e.g. prod)\n\n```bash\n\ncp environments/prod/backend.tf ./backend.tf\nterraform init -reconfigure\nterraform plan -var-file=environments/prod/prod.tfvars -out=tfplan-prod\nterraform apply tfplan-prod\n\n```\n---\n\n### Configuring Ingress in the cluster\n\nAn Ingress is a Kubernetes API object that manages external access to services within a cluster, typically over HTTP and HTTPS.\nWith Ingress, you can use one entry point (like a single door) and let rules decide which app the request should go to.\n\nIngress doesn’t handle traffic itself; it needs an Ingress Controller.\n\n* Access the eks by jumpserver (created inside the vpc with appropriate sg rules)\n\n\n```bash\n\n# IAM OIDC provider is already setup using terraform.\n\n# Download IAM policy for the Load Balancer Controller\ncurl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.11.0/docs/install/iam_policy.json\n\n# Create an IAM policy called AWSLoadBalancerControllerIAMPolicy\naws iam create-policy \\\n    --policy-name AWSLoadBalancerControllerIAMPolicy \\\n    --policy-document file://iam_policy.json\n\n# Create an IAM service account in Kubernetes with the policy attached (Replace the values for cluster name, region code, and account ID)\neksctl create iamserviceaccount \\\n    --cluster=\u003ccluster-name\u003e \\\n    --namespace=kube-system \\\n    --name=aws-load-balancer-controller \\\n    --attach-policy-arn=arn:aws:iam::\u003cAWS_ACCOUNT_ID\u003e:policy/AWSLoadBalancerControllerIAMPolicy \\\n    --override-existing-serviceaccounts \\\n    --region \u003caws-region-code\u003e \\\n    --approve\n```    \n\n* Install AWS Load Balencer with helm (install helm if haven't already)\n\n```bash\n\nhelm repo add eks https://aws.github.io/eks-charts\nhelm repo update eks\n \nhelm install aws-load-balancer-controller eks/aws-load-balancer-controller \\\n  -n kube-system \\\n  --set clusterName=my-cluster \\\n  --set serviceAccount.create=false \\\n  --set serviceAccount.name=aws-load-balancer-controller \\\n  --version 1.13.0\n\n# helm install command automatically installs the custom resource definitions (CRDs) for the controller.\n```\n### Security Considerations\n     \n-  Private API endpoint (no public access)\n-  IRSA enabled for pod-level IAM\n-  State encryption at rest (S3)\n-  State locking (DynamoDB)\n-  Security group allows 0.0.0.0/0 on 443 (restrict in production)\n-  IRSA policy uses wildcard permissions (apply least privilege in production)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feliyasv%2Feks-tf-infra","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feliyasv%2Feks-tf-infra","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feliyasv%2Feks-tf-infra/lists"}