https://github.com/isovalent/terraform-aws-talos

Terraform module for deploying Kubernetes on AWS EC2 using Talos (Linux)
https://github.com/isovalent/terraform-aws-talos
cute terraform terraform-module testing
Last synced: 5 months ago
JSON representation
Terraform module for deploying Kubernetes on AWS EC2 using Talos (Linux)
Host: GitHub
URL: https://github.com/isovalent/terraform-aws-talos
Owner: isovalent
License: apache-2.0
Created: 2023-10-05T11:48:39.000Z (almost 3 years ago)
Default Branch: main
Last Pushed: 2026-01-26T08:30:18.000Z (6 months ago)
Last Synced: 2026-01-26T16:58:36.256Z (6 months ago)
Topics: cute, terraform, terraform-module, testing
Language: HCL
Homepage:
Size: 219 KB
Stars: 41
Watchers: 24
Forks: 12
Open Issues: 2
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
Awesome Lists containing this project

README

          # Terraform Setup to Test Cilium on Talos

![Terraform docs and formatting](https://github.com/isovalent/terraform-aws-talos/actions/workflows/terraform.yml/badge.svg)

A Terraform module to manage a Talos-based Kubernetes on AWS (EC2 instances). Is uses the official [Talos Terraform provider](https://github.com/siderolabs/terraform-provider-talos) in the background. We mainly followed the provided [siderolabs/contrib](https://github.com/siderolabs/contrib/tree/main/examples/terraform/aws) example.

## Supported Features

- Install Talos Linux OS EC2 VMs

  - Due to Talos' setup requirements, it's only supported to deploy the EC2 instances in public subnets with public IPs assigned (access can be restricted via security groups)

  - AMD64 and ARM64 are supported

- Support for single- and multi-node cluster architectures

- Bootstrap Talos Kubernetes cluster with some infrastructure components:

  - [Talos' KubePrism](https://www.talos.dev/v1.5/kubernetes-guides/configuration/kubeprism/) to get an internal endpoint for the KAPI (used for [Cilium Kube-Proxy replacement](https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/))

  - [kubernetes-sigs/metrics-server](https://github.com/kubernetes-sigs/metrics-server/)

  - [alex1989hu/kubelet-serving-cert-approver](https://github.com/alex1989hu/kubelet-serving-cert-approver) inspired by [Talos' Deploying Metrics Server](https://www.talos.dev/v1.5/kubernetes-guides/configuration/deploy-metrics-server/) guide.

  - [AWS Cloud Provider](https://github.com/kubernetes/cloud-provider-aws/tree/master)

- Cilium features:

  - [Kube-Proxy replacement](https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/)

  - [IPAM modes](https://docs.cilium.io/en/stable/network/concepts/ipam/): `kubernetes`, `cluster-pool`

## Example Usage

```

// Create a Talos Linux cluster

module "talos" {

  source = "git::https://github.com/isovalent/terraform-aws-talos?ref="

  // Supported Talos versions (and therefore K8s versions) can be found here: https://github.com/siderolabs/talos/releases

  talos_version         = "v1.10.4"

  kubernetes_version    = "1.33.1"

  cluster_name          = "talos-cute"

  region                = "eu-west-1"

  tags                  = local.tags

  // VPC needs to be created in advance via https://github.com/isovalent/terraform-aws-vpc

  vpc_id                = module.vpc.id

  pod_cidr              = "100.64.0.0/14"

  service_cidr          = "100.68.0.0/16"

  # Configure the allowed source CIDR range:

  external_source_cidrs = ["A.B.C.D/E"]

}

```

## Terraform Module Doc

### Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.4.0 |

|  [aws](#requirement\_aws) | ~> 6.0 |

|  [random](#requirement\_random) | ~> 3.7 |

|  [talos](#requirement\_talos) | 0.10.1 |

### Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | ~> 6.0 |

|  [local](#provider\_local) | n/a |

|  [null](#provider\_null) | n/a |

|  [random](#provider\_random) | ~> 3.7 |

|  [talos](#provider\_talos) | 0.10.1 |

### Modules

| Name | Source | Version |

|------|--------|---------|

|  [cluster\_sg](#module\_cluster\_sg) | terraform-aws-modules/security-group/aws | ~> 5.3 |

|  [nlb\_sg](#module\_nlb\_sg) | terraform-aws-modules/security-group/aws | ~> 5.3 |

|  [talos\_control\_plane\_nodes](#module\_talos\_control\_plane\_nodes) | terraform-aws-modules/ec2-instance/aws | ~> 6.0 |

|  [talos\_worker\_group](#module\_talos\_worker\_group) | terraform-aws-modules/ec2-instance/aws | ~> 6.0 |

### Resources

| Name | Type |

|------|------|

| [aws_iam_policy.control_plane_ccm_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

| [aws_iam_policy.worker_ccm_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

| [aws_lb.api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |

| [aws_lb_listener.https](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |

| [aws_lb_listener.talos](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |

| [aws_lb_target_group.k8s](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |

| [aws_lb_target_group.talos](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |

| [aws_lb_target_group_attachment.cp_k8s](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |

| [aws_lb_target_group_attachment.cp_talos](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |

| [local_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |

| [local_file.talosconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |

| [null_resource.wait_for_subnets](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |

| [random_string.workspace_id](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |

| [talos_cluster_kubeconfig.this](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/resources/cluster_kubeconfig) | resource |

| [talos_machine_bootstrap.this](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/resources/machine_bootstrap) | resource |

| [talos_machine_configuration_apply.controlplane](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/resources/machine_configuration_apply) | resource |

| [talos_machine_configuration_apply.worker_group](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/resources/machine_configuration_apply) | resource |

| [talos_machine_secrets.this](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/resources/machine_secrets) | resource |

| [aws_ami.talos](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |

| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

| [aws_subnets.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |

| [aws_subnets.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |

| [aws_vpc.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |

| [talos_client_configuration.this](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/data-sources/client_configuration) | data source |

| [talos_machine_configuration.controlplane](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/data-sources/machine_configuration) | data source |

| [talos_machine_configuration.worker_group](https://registry.terraform.io/providers/siderolabs/talos/0.10.1/docs/data-sources/machine_configuration) | data source |

### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [admission\_plugins](#input\_admission\_plugins) | List of admission plugins to enable | `string` | `"MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ServiceAccount"` | no |

|  [allocate\_node\_cidrs](#input\_allocate\_node\_cidrs) | Whether to assign PodCIDRs to Node resources or not. Only needed in case Cilium runs in 'kubernetes' IPAM mode. | `bool` | `true` | no |

|  [allow\_workload\_on\_cp\_nodes](#input\_allow\_workload\_on\_cp\_nodes) | Allow workloads on CP nodes or not. Allowing it means Talos Linux default taints are removed from CP nodes which is typically required for single-node clusters. More details here: https://www.talos.dev/v1.5/talos-guides/howto/workers-on-controlplane/ | `bool` | `false` | no |

|  [cluster\_architecture](#input\_cluster\_architecture) | Cluster architecture. Choose 'arm64' or 'amd64'. If you choose 'arm64', ensure to also override the control\_plane.instance\_type and worker\_groups.instance\_type with an ARM64-based instance type like 'm7g.large'. | `string` | `"amd64"` | no |

|  [cluster\_id](#input\_cluster\_id) | The ID of the cluster. | `number` | `"1"` | no |

|  [cluster\_name](#input\_cluster\_name) | Name of cluster | `string` | n/a | yes |

|  [config\_patch\_files](#input\_config\_patch\_files) | Path to talos config path files that applies to all nodes | `list(string)` | `[]` | no |

|  [control\_plane](#input\_control\_plane) | Info for control plane that will be created | 
object({
    instance_type      = optional(string, "m5.large")
    config_patch_files = optional(list(string), [])
    tags               = optional(map(string), {})
  }) | `{}` | no |

|  [controlplane\_count](#input\_controlplane\_count) | Defines how many controlplane nodes are deployed in the cluster. | `number` | `3` | no |

|  [deploy\_external\_cloud\_provider\_iam\_policies](#input\_deploy\_external\_cloud\_provider\_iam\_policies) | Whether to auto-deploy the externalCloudProvider-required IAM policies. See https://cloud-provider-aws.sigs.k8s.io/prerequisites/. | `bool` | `false` | no |

|  [disable\_containerd\_nri\_plugins](#input\_disable\_containerd\_nri\_plugins) | Whether to disable the Talos containerd NRI plugins or not. Talos disables it by default. See https://www.talos.dev/latest/talos-guides/configuration/containerd/#enabling-nri-plugins. Supported since Talos v1.9.2 (see https://github.com/siderolabs/talos/discussions/10068). | `bool` | `true` | no |

|  [disable\_kube\_proxy](#input\_disable\_kube\_proxy) | Whether to deploy Kube-Proxy or not. By default, KP shouldn't be deployed. | `bool` | `true` | no |

|  [enable\_external\_cloud\_provider](#input\_enable\_external\_cloud\_provider) | Whether to enable or disable externalCloudProvider support. See https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/. | `bool` | `false` | no |

|  [external\_cloud\_provider\_manifest](#input\_external\_cloud\_provider\_manifest) | externalCloudProvider manifest to be applied if var.enable\_external\_cloud\_provider is enabled. If you want to deploy it manually (e.g., via Helm chart), enable var.enable\_external\_cloud\_provider but set this value to an empty string (""). See https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/. | `string` | `"https://raw.githubusercontent.com/isovalent/terraform-aws-talos/main/manifests/aws-cloud-controller.yaml"` | no |

|  [external\_source\_cidrs](#input\_external\_source\_cidrs) | Specify the external source CIDRs (use /32 for specific IP addresses) allowed for inbound traffic. | `list(string)` | n/a | yes |

|  [iam\_instance\_profile\_control\_plane](#input\_iam\_instance\_profile\_control\_plane) | IAM instance profile to attach to the control plane instances to give AWS CCM the sufficient rights to execute. | `string` | `null` | no |

|  [iam\_instance\_profile\_worker](#input\_iam\_instance\_profile\_worker) | IAM instance profile to attach to the worker instances to give AWS CCM the sufficient rights to execute. | `string` | `null` | no |

|  [kubernetes\_version](#input\_kubernetes\_version) | Kubernetes version to use for the Talos cluster, if not set, the K8s version shipped with the selected Talos version will be used. Check https://www.talos.dev/latest/introduction/support-matrix/. For example '1.29.3'. | `string` | `""` | no |

|  [metadata\_options](#input\_metadata\_options) | Metadata to attach to the instances. | `map(string)` | {
  "http_endpoint": "enabled",
  "http_put_response_hop_limit": 1,
  "http_tokens": "optional"
} | no |

|  [pod\_cidr](#input\_pod\_cidr) | The CIDR to use for Pods. Only required in case allocate\_node\_cidrs is set to 'true'. Otherwise, simply configure it inside Cilium's Helm values. | `string` | `"100.64.0.0/14"` | no |

|  [region](#input\_region) | The region in which to create the Talos Linux cluster. | `string` | n/a | yes |

|  [service\_cidr](#input\_service\_cidr) | The CIDR to use for services. | `string` | `"100.68.0.0/16"` | no |

|  [tags](#input\_tags) | The set of tags to place on the cluster. | `map(string)` | n/a | yes |

|  [talos\_version](#input\_talos\_version) | Talos version to use for the cluster, if not set, the newest Talos version. Check https://github.com/siderolabs/talos/releases for available releases. | `string` | `"v1.11.2"` | no |

|  [vpc\_cidr](#input\_vpc\_cidr) | The IPv4 CIDR block for the VPC. | `string` | `"10.0.0.0/16"` | no |

|  [vpc\_id](#input\_vpc\_id) | ID of the VPC where to place the VMs. | `string` | n/a | yes |

|  [worker\_groups](#input\_worker\_groups) | List of node worker node groups to create | list(object({
    name               = string
    instance_type      = optional(string, "m5.large")
    config_patch_files = optional(list(string), [])
    tags               = optional(map(string), {})
  }))
 | [
  {
    "name": "default"
  }
] | no |

|  [workers\_count](#input\_workers\_count) | Defines how many worker nodes are deployed in the cluster. | `number` | `2` | no |

### Outputs

| Name | Description |

|------|-------------|

|  [cluster\_name](#output\_cluster\_name) | Name of cluster |

|  [elb\_dns\_name](#output\_elb\_dns\_name) | [DEPRECATED: Use lb\_dns\_name instead] Public load balancer DNS name. |

|  [kubeconfig](#output\_kubeconfig) | Kubeconfig content |

|  [lb\_arn](#output\_lb\_arn) | The ARN of the Network Load Balancer. |

|  [lb\_dns\_name](#output\_lb\_dns\_name) | Public NLB DNS name. |

|  [lb\_zone\_id](#output\_lb\_zone\_id) | The zone\_id of the NLB for Route53 alias records. |

|  [path\_to\_kubeconfig\_file](#output\_path\_to\_kubeconfig\_file) | The generated kubeconfig. |

|  [path\_to\_talosconfig\_file](#output\_path\_to\_talosconfig\_file) | The generated talosconfig. |
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/isovalent/terraform-aws-talos

Awesome Lists containing this project

README
