https://github.com/govtechsg/terraform-aws-eks
https://github.com/govtechsg/terraform-aws-eks
terraform
Last synced: about 2 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/govtechsg/terraform-aws-eks
- Owner: GovTechSG
- License: mit
- Created: 2021-10-23T07:53:53.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2024-02-21T03:38:07.000Z (over 2 years ago)
- Last Synced: 2025-02-22T10:31:35.378Z (over 1 year ago)
- Topics: terraform
- Language: HCL
- Homepage:
- Size: 74.2 KB
- Stars: 0
- Watchers: 9
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# EKS
This module creates a kubernetes cluster on amazon web services(AWS). This module has a number of assumptions and dependencies with [https://gitlab.com/govtechsingapore/gdsace/terraform-modules/aws-vpc](https://gitlab.com/govtechsingapore/gdsace/terraform-modules/aws-vpc). It will probably not work with other infrastructure design, particularly on your subnet slices.
This module works with the VPC module as it follows the subnet types(public,private,intranet,database) defined in it.
### Usage
```hcl
module "eks" {
eks_cluster_name = "shire"
cluster_version = "1.14"
# user and roles
# references:
# 1. [aws-iam-authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator)
# 2. [awscli configuration](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)
map_users = [
{
user_arn = "arn:aws:iam::${get_aws_account_id()}:user/USERNAME"
username = "USERNAME"
group = "system:masters"
}
]
private_worker_variables = [
{
instance_type = "r5.xlarge"
asg_min_size = "1"
asg_desired_capacity = "2"
asg_max_size = "4"
iam_instance_profile_name = "eks-worker-private"
ami_id = "ami-03a2cce9abe958c6c"
name = "services"
kubelet_extra_args = ""
},
{
instance_type = "c5n.xlarge"
asg_desired_capacity = 0
asg_max_size = 4
iam_instance_profile_name = "eks-worker-gitlab"
ami_id = "ami-03a2cce9abe958c6c"
name = "gitlab-runners"
kubelet_extra_args = "--register-with-taints=gitlab-runner=true:NoSchedule"
}
]
public_worker_variables = [
{
instance_type = "m5.large"
asg_desired_capacity = 1
asg_max_size = 4
iam_instance_profile_name = "eks-worker-public"
name = "public-1"
ami_id = "ami-03a2cce9abe958c6c"
kubelet_extra_args = "--register-with-taints=public=true:NoSchedule --node-labels=public-node=true"
}
]
cluster_endpoint_private_access = true
cluster_endpoint_public_access = false
permissions_boundary = "arn:aws:iam::${get_aws_account_id()}:policy/GCCIAccountBoundary"
# write_kubeconfig = "true"
config_output_path = "${get_terragrunt_dir()}/"
additional_whitelist_cidr_block_443 = ["172.31.0.0/24"]
additional_whitelist_cidr_block_443_description = ["description"]
// remote state variables
vpc_state_key = ""
artifacts_base_path = get_terragrunt_dir()
environment = "uat"
}
```
### Migration
#### 1.x.x to 2.x.x
- delete aws-auth configmap as it is now created using k8s provider.
-
## Inputs
| Name | Description | Type | Default | Required |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|------------------------------------|:--------:|
| [additional\_subnets](#input\_additional\_subnets) | Additional Subnets aside from those in your main vpc(e.g secondary cidr blocks) | `list(any)` | `[]` | no |
| [additional\_whitelist\_cidr\_block\_443](#input\_additional\_whitelist\_cidr\_block\_443) | Additional cidr to allow inbound and outbound for port 443 to eks cluster | `list(any)` | `[]` | no |
| [additional\_whitelist\_cidr\_block\_443\_description](#input\_additional\_whitelist\_cidr\_block\_443\_description) | Description for the additional cidr to allow inbound and outbound for port 443 to eks cluster | `list(any)` | `[]` | no |
| [addon\_coredns\_version](#input\_addon\_coredns\_version) | Specify CoreDNS addon version | `string` | `""` | no |
| [addon\_create\_coredns](#input\_addon\_create\_coredns) | Use EKS built-in addon CoreDNS | `bool` | `false` | no |
| [addon\_create\_kube\_proxy](#input\_addon\_create\_kube\_proxy) | Use EKS built-in addon Kube Proxy | `bool` | `false` | no |
| [addon\_create\_vpc\_cni](#input\_addon\_create\_vpc\_cni) | Use EKS built-in addon VPC CNI | `bool` | `false` | no |
| [addon\_kube\_proxy\_version](#input\_addon\_kube\_proxy\_version) | Specify Kube Proxy addon version | `string` | `""` | no |
| [addon\_vpc\_cni\_version](#input\_addon\_vpc\_cni\_version) | Specify VPC CNI addon version | `string` | `""` | no |
| [aws\_account\_id](#input\_aws\_account\_id) | AWS account ID | `string` | `"*"` | no |
| [aws\_region](#input\_aws\_region) | Region in which to spin up EKS | `string` | `"ap-southeast-1"` | no |
| [cluster\_create\_endpoint\_private\_access\_sg\_rule](#input\_cluster\_create\_endpoint\_private\_access\_sg\_rule) | Whether to create security group rules for the access to the Amazon EKS private API server endpoint. | `bool` | `false` | no |
| [cluster\_encryption\_config](#input\_cluster\_encryption\_config) | Configuration block with encryption configuration for the cluster. See examples/secrets\_encryption/main.tf for example format |
list(object({
provider_key_arn = string
resources = list(string)
})) | `[]` | no |
| [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
| [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
| [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | [
"0.0.0.0/0"
]
| no |
| [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
| [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Log retention in days | `number` | `90` | no |
| [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.13"` | no |
| [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Should end in a forward slash `/` . | `string` | `"./"` | no |
| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
| [create\_fargate\_pod\_execution\_role](#input\_create\_fargate\_pod\_execution\_role) | Controls if the EKS Fargate pod execution IAM role should be created. | `bool` | `true` | no |
| [eks\_cluster\_name](#input\_eks\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
| [enable\_alb](#input\_enable\_alb) | Enables alb by creating alb ingress controller policy required for alb ingress controller | `bool` | `false` | no |
| [enable\_dynamic\_pv](#input\_enable\_dynamic\_pv) | Enables dynamic persistent volume provisioning by allowing nodes to manage ec2 volumes and attaches policy to worker groups | `bool` | `false` | no |
| [enable\_external\_dns](#input\_enable\_external\_dns) | (Legacy) Enables External DNS installation(policy) and attaches policy to worker groups | `bool` | `false` | no |
| [enable\_kamus](#input\_enable\_kamus) | (Legacy) Enables kamus by creating role, policy and trust relationship required for kamus usage | `bool` | `false` | no |
| [enable\_kube2iam](#input\_enable\_kube2iam) | (Legacy) Enables kube2iam by creating role, policy and trust relationship required for kube2iam usage | `bool` | `false` | no |
| [enable\_ssm](#input\_enable\_ssm) | Enables SSM and Inspector | `bool` | `false` | no |
| [environment](#input\_environment) | Name for environment of this EKS cluster | `any` | n/a | yes |
| [fargate\_pod\_execution\_role\_name](#input\_fargate\_pod\_execution\_role\_name) | The IAM Role that provides permissions for the EKS Fargate Profile. | `string` | `null` | no |
| [fargate\_profiles](#input\_fargate\_profiles) | Fargate profiles to create. See `fargate_profile` keys section in fargate submodule's README.md for more details | `any` | `{}` | no |
| [intranet\_worker\_template\_variables](#input\_intranet\_worker\_template\_variables) | Worker launch template group declaration of nodes to be placed in intranet subnet | `list(any)` | `[]` | no |
| [intranet\_worker\_variables](#input\_intranet\_worker\_variables) | Worker group declaration of nodes to be placed in intranet subnet | `list(any)` | `[]` | no |
| [kubeconfig\_aws\_authenticator\_additional\_args](#input\_kubeconfig\_aws\_authenticator\_additional\_args) | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no |
| [kubeconfig\_aws\_authenticator\_command](#input\_kubeconfig\_aws\_authenticator\_command) | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no |
| [kubeconfig\_aws\_authenticator\_command\_args](#input\_kubeconfig\_aws\_authenticator\_command\_args) | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no |
| [kubeconfig\_aws\_authenticator\_env\_variables](#input\_kubeconfig\_aws\_authenticator\_env\_variables) | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no |
| [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
| [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
| [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
| [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. | `list(string)` | `[]` | no |
| [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. | list(object({
rolearn = string
username = string
groups = list(string)
})) | `[]` | no |
| [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. | list(object({
userarn = string
username = string
groups = list(string)
})) | `[]` | no |
| [master\_subnets\_ids](#input\_master\_subnets\_ids) | Subnets used by EKS master nodes | `list(list(string))` | n/a | yes |
| [module\_source\_version](#input\_module\_source\_version) | Version of module to use | `string` | `"5.0.0"` | no |
| [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `""` | no |
| [private\_worker\_template\_variables](#input\_private\_worker\_template\_variables) | Worker launch template group declaration of nodes to be placed in private subnet | `list(any)` | `[]` | no |
| [private\_worker\_variables](#input\_private\_worker\_variables) | Worker group declaration of nodes to be placed in private subnet | `list(any)` | `[]` | no |
| [public\_worker\_template\_variables](#input\_public\_worker\_template\_variables) | Worker launch template group declaration of nodes to be placed in public subnet | `list(any)` | `[]` | no |
| [public\_worker\_variables](#input\_public\_worker\_variables) | Worker group declaration of nodes to be placed in public subnet | `list(any)` | `[]` | no |
| [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
| [tfstate\_global\_bucket](#input\_tfstate\_global\_bucket) | S3 where the remote state is stored | `any` | n/a | yes |
| [use\_launch\_template](#input\_use\_launch\_template) | Toggle use of launch template vs launch configuration | `bool` | `false` | no |
| [vpc\_id](#input\_vpc\_id) | VPC ID | `any` | n/a | yes |
| [vpc\_name](#input\_vpc\_name) | VPC Name | `any` | n/a | yes |
| [vpc\_state\_key](#input\_vpc\_state\_key) | Key where the vpc remote state is stored | `string` | `"vpc"` | no |
| [worker\_additional\_security\_group\_ids](#input\_worker\_additional\_security\_group\_ids) | A list of additional security group ids to attach to worker instances. | `list(any)` | `[]` | no |
| [worker\_intra\_subnets\_ids](#input\_worker\_intra\_subnets\_ids) | Intra subnets used by worker nodes | `set(string)` | n/a | yes |
| [worker\_private\_subnets\_ids](#input\_worker\_private\_subnets\_ids) | Private subnets used by worker nodes | `set(string)` | n/a | yes |
| [worker\_public\_subnets\_ids](#input\_worker\_public\_subnets\_ids) | Public subnets used by worker nodes | `set(string)` | n/a | yes |
| [workers\_additional\_policies](#input\_workers\_additional\_policies) | Additional IAM policies to be added to workers | `list(string)` | `[]` | no |
| [workers\_custom\_policy](#input\_workers\_custom\_policy) | Custom IAM policy to be added to workers (supports heredoc syntax, e.g. < [write\_aws\_auth\_config](#input\_write\_aws\_auth\_config) | Whether to write the aws-auth configmap file. | `bool` | `true` | no |
| [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no |
## Outputs
| Name | Description |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------|
| [alb\_role\_arn](#output\_alb\_role\_arn) | alb role arn |
| [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
| [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. |
| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
| [cluster\_version](#output\_cluster\_version) | The Kubernetes server version for the EKS cluster. |
| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
| [dynamic\_persistent\_volume\_provisioning\_arn](#output\_dynamic\_persistent\_volume\_provisioning\_arn) | Dynamic PV policy arn |
| [external\_dns\_role\_arn](#output\_external\_dns\_role\_arn) | external role arn |
| [kamus\_role\_arn](#output\_kamus\_role\_arn) | kamus role arn |
| [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
| [node\_groups](#output\_node\_groups) | Outputs from EKS node groups. Map of maps, keyed by var.node\_groups keys |
| [worker\_additional\_policies](#output\_worker\_additional\_policies) | Additional policies added to the worker iam role |
| [worker\_iam\_role\_arn](#output\_worker\_iam\_role\_arn) | default IAM role ARN for EKS worker groups |
| [worker\_iam\_role\_name](#output\_worker\_iam\_role\_name) | default IAM role name for EKS worker groups |
| [worker\_security\_group\_id](#output\_worker\_security\_group\_id) | Security group ID attached to the EKS workers. |
| [workers\_asg\_arns](#output\_workers\_asg\_arns) | IDs of the autoscaling groups containing workers. |
| [workers\_asg\_names](#output\_workers\_asg\_names) | Names of the autoscaling groups containing workers. |
| [workers\_launch\_template\_ids](#output\_workers\_launch\_template\_ids) | IDs of the worker launch templates. |
| [workers\_user\_data](#output\_workers\_user\_data) | User data of worker groups |