initial commit
This commit is contained in:
26
.devcontainer/devcontainer.json
Normal file
26
.devcontainer/devcontainer.json
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
|
||||||
|
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
|
||||||
|
{
|
||||||
|
"name": "Ubuntu",
|
||||||
|
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
|
||||||
|
"image": "mcr.microsoft.com/devcontainers/base:noble",
|
||||||
|
"features": {
|
||||||
|
"ghcr.io/devcontainers/features/terraform:1": {},
|
||||||
|
"ghcr.io/devcontainers/features/github-cli:1": {},
|
||||||
|
"ghcr.io/devcontainers/features/aws-cli:1": {},
|
||||||
|
"ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {}
|
||||||
|
},
|
||||||
|
// Features to add to the dev container. More info: https://containers.dev/features.
|
||||||
|
// "features": {},
|
||||||
|
// Use 'forwardPorts' to make a list of ports inside the container available locally.
|
||||||
|
// "forwardPorts": [],
|
||||||
|
// Use 'postCreateCommand' to run commands after the container is created.
|
||||||
|
// "postCreateCommand": "uname -a",
|
||||||
|
// Configure tool-specific properties.
|
||||||
|
// "customizations": {},
|
||||||
|
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
|
||||||
|
// "remoteUser": "root"
|
||||||
|
"mounts": [
|
||||||
|
"source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind"
|
||||||
|
]
|
||||||
|
}
|
||||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@@ -0,0 +1 @@
|
|||||||
|
.terraform
|
||||||
105
environments/development/.terraform.lock.hcl
generated
Normal file
105
environments/development/.terraform.lock.hcl
generated
Normal file
@@ -0,0 +1,105 @@
|
|||||||
|
# This file is maintained automatically by "terraform init".
|
||||||
|
# Manual edits may be lost in future updates.
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/aws" {
|
||||||
|
version = "5.100.0"
|
||||||
|
constraints = ">= 4.33.0, >= 5.95.0, < 6.0.0"
|
||||||
|
hashes = [
|
||||||
|
"h1:edXOJWE4ORX8Fm+dpVpICzMZJat4AX0VRCAy/xkcOc0=",
|
||||||
|
"zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644",
|
||||||
|
"zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2",
|
||||||
|
"zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274",
|
||||||
|
"zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b",
|
||||||
|
"zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862",
|
||||||
|
"zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342",
|
||||||
|
"zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
|
||||||
|
"zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93",
|
||||||
|
"zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2",
|
||||||
|
"zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e",
|
||||||
|
"zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421",
|
||||||
|
"zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4",
|
||||||
|
"zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9",
|
||||||
|
"zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9",
|
||||||
|
"zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/cloudinit" {
|
||||||
|
version = "2.3.7"
|
||||||
|
constraints = ">= 2.0.0"
|
||||||
|
hashes = [
|
||||||
|
"h1:iZ27qylcH/2bs685LJTKOKcQ+g7cF3VwN3kHMrzm4Ow=",
|
||||||
|
"zh:06f1c54e919425c3139f8aeb8fcf9bceca7e560d48c9f0c1e3bb0a8ad9d9da1e",
|
||||||
|
"zh:0e1e4cf6fd98b019e764c28586a386dc136129fef50af8c7165a067e7e4a31d5",
|
||||||
|
"zh:1871f4337c7c57287d4d67396f633d224b8938708b772abfc664d1f80bd67edd",
|
||||||
|
"zh:2b9269d91b742a71b2248439d5e9824f0447e6d261bfb86a8a88528609b136d1",
|
||||||
|
"zh:3d8ae039af21426072c66d6a59a467d51f2d9189b8198616888c1b7fc42addc7",
|
||||||
|
"zh:3ef4e2db5bcf3e2d915921adced43929214e0946a6fb11793085d9a48995ae01",
|
||||||
|
"zh:42ae54381147437c83cbb8790cc68935d71b6357728a154109d3220b1beb4dc9",
|
||||||
|
"zh:4496b362605ae4cbc9ef7995d102351e2fe311897586ffc7a4a262ccca0c782a",
|
||||||
|
"zh:652a2401257a12706d32842f66dac05a735693abcb3e6517d6b5e2573729ba13",
|
||||||
|
"zh:7406c30806f5979eaed5f50c548eced2ea18ea121e01801d2f0d4d87a04f6a14",
|
||||||
|
"zh:7848429fd5a5bcf35f6fee8487df0fb64b09ec071330f3ff240c0343fe2a5224",
|
||||||
|
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/null" {
|
||||||
|
version = "3.2.4"
|
||||||
|
constraints = ">= 3.0.0"
|
||||||
|
hashes = [
|
||||||
|
"h1:hkf5w5B6q8e2A42ND2CjAvgvSN3puAosDmOJb3zCVQM=",
|
||||||
|
"zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2",
|
||||||
|
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||||
|
"zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43",
|
||||||
|
"zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a",
|
||||||
|
"zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991",
|
||||||
|
"zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f",
|
||||||
|
"zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e",
|
||||||
|
"zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615",
|
||||||
|
"zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442",
|
||||||
|
"zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5",
|
||||||
|
"zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f",
|
||||||
|
"zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/time" {
|
||||||
|
version = "0.13.1"
|
||||||
|
constraints = ">= 0.9.0"
|
||||||
|
hashes = [
|
||||||
|
"h1:+W+DMrVoVnoXo3f3M4W+OpZbkCrUn6PnqDF33D2Cuf0=",
|
||||||
|
"zh:02cb9aab1002f0f2a94a4f85acec8893297dc75915f7404c165983f720a54b74",
|
||||||
|
"zh:04429b2b31a492d19e5ecf999b116d396dac0b24bba0d0fb19ecaefe193fdb8f",
|
||||||
|
"zh:26f8e51bb7c275c404ba6028c1b530312066009194db721a8427a7bc5cdbc83a",
|
||||||
|
"zh:772ff8dbdbef968651ab3ae76d04afd355c32f8a868d03244db3f8496e462690",
|
||||||
|
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||||
|
"zh:898db5d2b6bd6ca5457dccb52eedbc7c5b1a71e4a4658381bcbb38cedbbda328",
|
||||||
|
"zh:8de913bf09a3fa7bedc29fec18c47c571d0c7a3d0644322c46f3aa648cf30cd8",
|
||||||
|
"zh:9402102c86a87bdfe7e501ffbb9c685c32bbcefcfcf897fd7d53df414c36877b",
|
||||||
|
"zh:b18b9bb1726bb8cfbefc0a29cf3657c82578001f514bcf4c079839b6776c47f0",
|
||||||
|
"zh:b9d31fdc4faecb909d7c5ce41d2479dd0536862a963df434be4b16e8e4edc94d",
|
||||||
|
"zh:c951e9f39cca3446c060bd63933ebb89cedde9523904813973fbc3d11863ba75",
|
||||||
|
"zh:e5b773c0d07e962291be0e9b413c7a22c044b8c7b58c76e8aa91d1659990dfb5",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/tls" {
|
||||||
|
version = "4.1.0"
|
||||||
|
constraints = ">= 3.0.0"
|
||||||
|
hashes = [
|
||||||
|
"h1:Ka8mEwRFXBabR33iN/WTIEW6RP0z13vFsDlwn11Pf2I=",
|
||||||
|
"zh:14c35d89307988c835a7f8e26f1b83ce771e5f9b41e407f86a644c0152089ac2",
|
||||||
|
"zh:2fb9fe7a8b5afdbd3e903acb6776ef1be3f2e587fb236a8c60f11a9fa165faa8",
|
||||||
|
"zh:35808142ef850c0c60dd93dc06b95c747720ed2c40c89031781165f0c2baa2fc",
|
||||||
|
"zh:35b5dc95bc75f0b3b9c5ce54d4d7600c1ebc96fbb8dfca174536e8bf103c8cdc",
|
||||||
|
"zh:38aa27c6a6c98f1712aa5cc30011884dc4b128b4073a4a27883374bfa3ec9fac",
|
||||||
|
"zh:51fb247e3a2e88f0047cb97bb9df7c228254a3b3021c5534e4563b4007e6f882",
|
||||||
|
"zh:62b981ce491e38d892ba6364d1d0cdaadcee37cc218590e07b310b1dfa34be2d",
|
||||||
|
"zh:bc8e47efc611924a79f947ce072a9ad698f311d4a60d0b4dfff6758c912b7298",
|
||||||
|
"zh:c149508bd131765d1bc085c75a870abb314ff5a6d7f5ac1035a8892d686b6297",
|
||||||
|
"zh:d38d40783503d278b63858978d40e07ac48123a2925e1a6b47e62179c046f87a",
|
||||||
|
"zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
|
||||||
|
"zh:fb07f708e3316615f6d218cec198504984c0ce7000b9f1eebff7516e384f4b54",
|
||||||
|
]
|
||||||
|
}
|
||||||
3
environments/development/locals.tf
Normal file
3
environments/development/locals.tf
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
locals {
|
||||||
|
cluster_name = "${var.cluster_name}-${var.environment}"
|
||||||
|
}
|
||||||
20
environments/development/main.tf
Normal file
20
environments/development/main.tf
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
module "network" {
|
||||||
|
source = "../../modules/network"
|
||||||
|
vpc_id = var.vpc_id
|
||||||
|
private_subnets = var.private_subnets
|
||||||
|
public_subnets = var.public_subnets
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
module "eks" {
|
||||||
|
source = "../../modules/eks"
|
||||||
|
vpc_id = var.vpc_id
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
subnet_ids = concat(
|
||||||
|
module.network.private_subnet_ids,
|
||||||
|
module.network.public_subnet_ids,
|
||||||
|
)
|
||||||
|
depends_on = [module.network]
|
||||||
|
azs = module.network.azs
|
||||||
|
}
|
||||||
19
environments/development/providers.tf
Normal file
19
environments/development/providers.tf
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
aws = {
|
||||||
|
source = "hashicorp/aws"
|
||||||
|
version = "< 6.0.0"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "aws" {
|
||||||
|
region = var.region
|
||||||
|
|
||||||
|
default_tags {
|
||||||
|
tags = {
|
||||||
|
Environment = var.environment
|
||||||
|
Service = "Kubernetes"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
4962
environments/development/terraform.tfstate
Normal file
4962
environments/development/terraform.tfstate
Normal file
File diff suppressed because one or more lines are too long
4958
environments/development/terraform.tfstate.backup
Normal file
4958
environments/development/terraform.tfstate.backup
Normal file
File diff suppressed because one or more lines are too long
43
environments/development/variables.tf
Normal file
43
environments/development/variables.tf
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
variable "environment" {
|
||||||
|
description = "The deployment environment"
|
||||||
|
type = string
|
||||||
|
default = "devel"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "region" {
|
||||||
|
description = "AWS region"
|
||||||
|
type = string
|
||||||
|
default = "us-east-1"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "vpc_id" {
|
||||||
|
description = "VPC ID"
|
||||||
|
type = string
|
||||||
|
default = "vpc-0271dff7a4b4bbf76"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "cluster_name" {
|
||||||
|
description = "EKS cluster name"
|
||||||
|
type = string
|
||||||
|
default = "eks1"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "private_subnets" {
|
||||||
|
description = "List of private subnet CIDRs (one per AZ)"
|
||||||
|
type = list(string)
|
||||||
|
default = [
|
||||||
|
"172.31.128.0/20",
|
||||||
|
"172.31.144.0/20",
|
||||||
|
"172.31.160.0/20",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "public_subnets" {
|
||||||
|
description = "List of public subnet CIDRs (one per AZ)"
|
||||||
|
type = list(string)
|
||||||
|
default = [
|
||||||
|
"172.31.176.0/24",
|
||||||
|
"172.31.177.0/24",
|
||||||
|
"172.31.178.0/24",
|
||||||
|
]
|
||||||
|
}
|
||||||
251
modules/eks/aws-load-balancer-controller-iam-policy.json
Normal file
251
modules/eks/aws-load-balancer-controller-iam-policy.json
Normal file
@@ -0,0 +1,251 @@
|
|||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"iam:CreateServiceLinkedRole"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:DescribeAccountAttributes",
|
||||||
|
"ec2:DescribeAddresses",
|
||||||
|
"ec2:DescribeAvailabilityZones",
|
||||||
|
"ec2:DescribeInternetGateways",
|
||||||
|
"ec2:DescribeVpcs",
|
||||||
|
"ec2:DescribeVpcPeeringConnections",
|
||||||
|
"ec2:DescribeSubnets",
|
||||||
|
"ec2:DescribeSecurityGroups",
|
||||||
|
"ec2:DescribeInstances",
|
||||||
|
"ec2:DescribeNetworkInterfaces",
|
||||||
|
"ec2:DescribeTags",
|
||||||
|
"ec2:GetCoipPoolUsage",
|
||||||
|
"ec2:DescribeCoipPools",
|
||||||
|
"ec2:GetSecurityGroupsForVpc",
|
||||||
|
"ec2:DescribeIpamPools",
|
||||||
|
"ec2:DescribeRouteTables",
|
||||||
|
"elasticloadbalancing:DescribeLoadBalancers",
|
||||||
|
"elasticloadbalancing:DescribeLoadBalancerAttributes",
|
||||||
|
"elasticloadbalancing:DescribeListeners",
|
||||||
|
"elasticloadbalancing:DescribeListenerCertificates",
|
||||||
|
"elasticloadbalancing:DescribeSSLPolicies",
|
||||||
|
"elasticloadbalancing:DescribeRules",
|
||||||
|
"elasticloadbalancing:DescribeTargetGroups",
|
||||||
|
"elasticloadbalancing:DescribeTargetGroupAttributes",
|
||||||
|
"elasticloadbalancing:DescribeTargetHealth",
|
||||||
|
"elasticloadbalancing:DescribeTags",
|
||||||
|
"elasticloadbalancing:DescribeTrustStores",
|
||||||
|
"elasticloadbalancing:DescribeListenerAttributes",
|
||||||
|
"elasticloadbalancing:DescribeCapacityReservation"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"cognito-idp:DescribeUserPoolClient",
|
||||||
|
"acm:ListCertificates",
|
||||||
|
"acm:DescribeCertificate",
|
||||||
|
"iam:ListServerCertificates",
|
||||||
|
"iam:GetServerCertificate",
|
||||||
|
"waf-regional:GetWebACL",
|
||||||
|
"waf-regional:GetWebACLForResource",
|
||||||
|
"waf-regional:AssociateWebACL",
|
||||||
|
"waf-regional:DisassociateWebACL",
|
||||||
|
"wafv2:GetWebACL",
|
||||||
|
"wafv2:GetWebACLForResource",
|
||||||
|
"wafv2:AssociateWebACL",
|
||||||
|
"wafv2:DisassociateWebACL",
|
||||||
|
"shield:GetSubscriptionState",
|
||||||
|
"shield:DescribeProtection",
|
||||||
|
"shield:CreateProtection",
|
||||||
|
"shield:DeleteProtection"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:AuthorizeSecurityGroupIngress",
|
||||||
|
"ec2:RevokeSecurityGroupIngress"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateSecurityGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateTags"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"ec2:CreateAction": "CreateSecurityGroup"
|
||||||
|
},
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateTags",
|
||||||
|
"ec2:DeleteTags"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:AuthorizeSecurityGroupIngress",
|
||||||
|
"ec2:RevokeSecurityGroupIngress",
|
||||||
|
"ec2:DeleteSecurityGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:CreateLoadBalancer",
|
||||||
|
"elasticloadbalancing:CreateTargetGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:CreateListener",
|
||||||
|
"elasticloadbalancing:DeleteListener",
|
||||||
|
"elasticloadbalancing:CreateRule",
|
||||||
|
"elasticloadbalancing:DeleteRule"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags",
|
||||||
|
"elasticloadbalancing:RemoveTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
||||||
|
],
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags",
|
||||||
|
"elasticloadbalancing:RemoveTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:ModifyLoadBalancerAttributes",
|
||||||
|
"elasticloadbalancing:SetIpAddressType",
|
||||||
|
"elasticloadbalancing:SetSecurityGroups",
|
||||||
|
"elasticloadbalancing:SetSubnets",
|
||||||
|
"elasticloadbalancing:DeleteLoadBalancer",
|
||||||
|
"elasticloadbalancing:ModifyTargetGroup",
|
||||||
|
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
||||||
|
"elasticloadbalancing:DeleteTargetGroup",
|
||||||
|
"elasticloadbalancing:ModifyListenerAttributes",
|
||||||
|
"elasticloadbalancing:ModifyCapacityReservation",
|
||||||
|
"elasticloadbalancing:ModifyIpPools"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
||||||
|
],
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"elasticloadbalancing:CreateAction": [
|
||||||
|
"CreateTargetGroup",
|
||||||
|
"CreateLoadBalancer"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:RegisterTargets",
|
||||||
|
"elasticloadbalancing:DeregisterTargets"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:SetWebAcl",
|
||||||
|
"elasticloadbalancing:ModifyListener",
|
||||||
|
"elasticloadbalancing:AddListenerCertificates",
|
||||||
|
"elasticloadbalancing:RemoveListenerCertificates",
|
||||||
|
"elasticloadbalancing:ModifyRule",
|
||||||
|
"elasticloadbalancing:SetRulePriorities"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
408
modules/eks/iam.tf
Normal file
408
modules/eks/iam.tf
Normal file
@@ -0,0 +1,408 @@
|
|||||||
|
// AWS Load Balancer Controller
|
||||||
|
resource "aws_iam_role" "aws-load-balancer-controller" {
|
||||||
|
name = "aws-load-balancer-controller"
|
||||||
|
|
||||||
|
assume_role_policy = jsonencode({
|
||||||
|
Version = "2012-10-17",
|
||||||
|
Statement = [{
|
||||||
|
Sid = ""
|
||||||
|
Effect = "Allow",
|
||||||
|
Principal = {
|
||||||
|
Federated = module.eks.oidc_provider_arn
|
||||||
|
},
|
||||||
|
Action = "sts:AssumeRoleWithWebIdentity",
|
||||||
|
Condition = {
|
||||||
|
StringEquals = {
|
||||||
|
"${module.eks.oidc_provider}:sub" = "system:serviceaccount:kube-system:aws-load-balancer-controller"
|
||||||
|
"${module.eks.oidc_provider}:aud" = "sts.amazonaws.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_policy" "AWSLoadBalancerControllerIAMPolicy" {
|
||||||
|
name = "AWSLoadBalancerControllerIAMPolicy"
|
||||||
|
|
||||||
|
// policy =
|
||||||
|
// file("${path.module}/aws-load-balancer-controller-iam-policy.json")
|
||||||
|
|
||||||
|
policy = <<POLICY
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"iam:CreateServiceLinkedRole"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:DescribeAccountAttributes",
|
||||||
|
"ec2:DescribeAddresses",
|
||||||
|
"ec2:DescribeAvailabilityZones",
|
||||||
|
"ec2:DescribeInternetGateways",
|
||||||
|
"ec2:DescribeVpcs",
|
||||||
|
"ec2:DescribeVpcPeeringConnections",
|
||||||
|
"ec2:DescribeSubnets",
|
||||||
|
"ec2:DescribeSecurityGroups",
|
||||||
|
"ec2:DescribeInstances",
|
||||||
|
"ec2:DescribeNetworkInterfaces",
|
||||||
|
"ec2:DescribeTags",
|
||||||
|
"ec2:GetCoipPoolUsage",
|
||||||
|
"ec2:DescribeCoipPools",
|
||||||
|
"ec2:GetSecurityGroupsForVpc",
|
||||||
|
"ec2:DescribeIpamPools",
|
||||||
|
"ec2:DescribeRouteTables",
|
||||||
|
"elasticloadbalancing:DescribeLoadBalancers",
|
||||||
|
"elasticloadbalancing:DescribeLoadBalancerAttributes",
|
||||||
|
"elasticloadbalancing:DescribeListeners",
|
||||||
|
"elasticloadbalancing:DescribeListenerCertificates",
|
||||||
|
"elasticloadbalancing:DescribeSSLPolicies",
|
||||||
|
"elasticloadbalancing:DescribeRules",
|
||||||
|
"elasticloadbalancing:DescribeTargetGroups",
|
||||||
|
"elasticloadbalancing:DescribeTargetGroupAttributes",
|
||||||
|
"elasticloadbalancing:DescribeTargetHealth",
|
||||||
|
"elasticloadbalancing:DescribeTags",
|
||||||
|
"elasticloadbalancing:DescribeTrustStores",
|
||||||
|
"elasticloadbalancing:DescribeListenerAttributes",
|
||||||
|
"elasticloadbalancing:DescribeCapacityReservation"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"cognito-idp:DescribeUserPoolClient",
|
||||||
|
"acm:ListCertificates",
|
||||||
|
"acm:DescribeCertificate",
|
||||||
|
"iam:ListServerCertificates",
|
||||||
|
"iam:GetServerCertificate",
|
||||||
|
"waf-regional:GetWebACL",
|
||||||
|
"waf-regional:GetWebACLForResource",
|
||||||
|
"waf-regional:AssociateWebACL",
|
||||||
|
"waf-regional:DisassociateWebACL",
|
||||||
|
"wafv2:GetWebACL",
|
||||||
|
"wafv2:GetWebACLForResource",
|
||||||
|
"wafv2:AssociateWebACL",
|
||||||
|
"wafv2:DisassociateWebACL",
|
||||||
|
"shield:GetSubscriptionState",
|
||||||
|
"shield:DescribeProtection",
|
||||||
|
"shield:CreateProtection",
|
||||||
|
"shield:DeleteProtection"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:AuthorizeSecurityGroupIngress",
|
||||||
|
"ec2:RevokeSecurityGroupIngress"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateSecurityGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateTags"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"ec2:CreateAction": "CreateSecurityGroup"
|
||||||
|
},
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:CreateTags",
|
||||||
|
"ec2:DeleteTags"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:ec2:*:*:security-group/*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:AuthorizeSecurityGroupIngress",
|
||||||
|
"ec2:RevokeSecurityGroupIngress",
|
||||||
|
"ec2:DeleteSecurityGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:CreateLoadBalancer",
|
||||||
|
"elasticloadbalancing:CreateTargetGroup"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:CreateListener",
|
||||||
|
"elasticloadbalancing:DeleteListener",
|
||||||
|
"elasticloadbalancing:CreateRule",
|
||||||
|
"elasticloadbalancing:DeleteRule"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags",
|
||||||
|
"elasticloadbalancing:RemoveTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
||||||
|
],
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags",
|
||||||
|
"elasticloadbalancing:RemoveTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:ModifyLoadBalancerAttributes",
|
||||||
|
"elasticloadbalancing:SetIpAddressType",
|
||||||
|
"elasticloadbalancing:SetSecurityGroups",
|
||||||
|
"elasticloadbalancing:SetSubnets",
|
||||||
|
"elasticloadbalancing:DeleteLoadBalancer",
|
||||||
|
"elasticloadbalancing:ModifyTargetGroup",
|
||||||
|
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
||||||
|
"elasticloadbalancing:DeleteTargetGroup",
|
||||||
|
"elasticloadbalancing:ModifyListenerAttributes",
|
||||||
|
"elasticloadbalancing:ModifyCapacityReservation",
|
||||||
|
"elasticloadbalancing:ModifyIpPools"
|
||||||
|
],
|
||||||
|
"Resource": "*",
|
||||||
|
"Condition": {
|
||||||
|
"Null": {
|
||||||
|
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:AddTags"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
|
||||||
|
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
|
||||||
|
],
|
||||||
|
"Condition": {
|
||||||
|
"StringEquals": {
|
||||||
|
"elasticloadbalancing:CreateAction": [
|
||||||
|
"CreateTargetGroup",
|
||||||
|
"CreateLoadBalancer"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"Null": {
|
||||||
|
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:RegisterTargets",
|
||||||
|
"elasticloadbalancing:DeregisterTargets"
|
||||||
|
],
|
||||||
|
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"elasticloadbalancing:SetWebAcl",
|
||||||
|
"elasticloadbalancing:ModifyListener",
|
||||||
|
"elasticloadbalancing:AddListenerCertificates",
|
||||||
|
"elasticloadbalancing:RemoveListenerCertificates",
|
||||||
|
"elasticloadbalancing:ModifyRule",
|
||||||
|
"elasticloadbalancing:SetRulePriorities"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
POLICY
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_role_policy_attachment" "aws-load-balancer-controller" {
|
||||||
|
role = aws_iam_role.aws-load-balancer-controller.name
|
||||||
|
policy_arn = aws_iam_policy.AWSLoadBalancerControllerIAMPolicy.arn
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cluster Autoscaler
|
||||||
|
resource "aws_iam_role" "cluster-autoscaler" {
|
||||||
|
name = "aws-cluster-autoscaler"
|
||||||
|
|
||||||
|
assume_role_policy = jsonencode({
|
||||||
|
Version = "2012-10-17",
|
||||||
|
Statement = [{
|
||||||
|
Sid = ""
|
||||||
|
Effect = "Allow",
|
||||||
|
Principal = {
|
||||||
|
Federated = module.eks.oidc_provider_arn
|
||||||
|
},
|
||||||
|
Action = "sts:AssumeRoleWithWebIdentity",
|
||||||
|
Condition = {
|
||||||
|
StringEquals = {
|
||||||
|
"${module.eks.oidc_provider}:sub" = "system:serviceaccount:kube-system:cluster-autoscaler"
|
||||||
|
"${module.eks.oidc_provider}:aud" = "sts.amazonaws.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_policy" "ClusterAutoscalerIAMPolicy" {
|
||||||
|
name = "ClusterAutoscalerIAMPolicy"
|
||||||
|
|
||||||
|
policy = <<POLICY
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"autoscaling:DescribeAutoScalingGroups",
|
||||||
|
"autoscaling:DescribeAutoScalingInstances",
|
||||||
|
"autoscaling:DescribeLaunchConfigurations",
|
||||||
|
"autoscaling:DescribeScalingActivities",
|
||||||
|
"ec2:DescribeInstanceTypes",
|
||||||
|
"ec2:DescribeLaunchTemplateVersions"
|
||||||
|
],
|
||||||
|
"Resource": ["*"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"autoscaling:SetDesiredCapacity",
|
||||||
|
"autoscaling:TerminateInstanceInAutoScalingGroup"
|
||||||
|
],
|
||||||
|
"Resource": ["*"]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
POLICY
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_role_policy_attachment" "cluster-autoscaler" {
|
||||||
|
role = aws_iam_role.cluster-autoscaler.name
|
||||||
|
policy_arn = aws_iam_policy.ClusterAutoscalerIAMPolicy.arn
|
||||||
|
}
|
||||||
|
|
||||||
|
// External DNS
|
||||||
|
resource "aws_iam_role" "external-dns" {
|
||||||
|
name = "external-dns"
|
||||||
|
|
||||||
|
assume_role_policy = jsonencode({
|
||||||
|
Version = "2012-10-17",
|
||||||
|
Statement = [{
|
||||||
|
Sid = ""
|
||||||
|
Effect = "Allow",
|
||||||
|
Principal = {
|
||||||
|
Federated = module.eks.oidc_provider_arn
|
||||||
|
},
|
||||||
|
Action = "sts:AssumeRoleWithWebIdentity",
|
||||||
|
Condition = {
|
||||||
|
StringEquals = {
|
||||||
|
"${module.eks.oidc_provider}:sub" = "system:serviceaccount:default:external-dns"
|
||||||
|
"${module.eks.oidc_provider}:aud" = "sts.amazonaws.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_policy" "AllowExternalDNSUpdates" {
|
||||||
|
name = "AllowExternalDNSUpdates"
|
||||||
|
|
||||||
|
policy = <<POLICY
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"route53:ChangeResourceRecordSets"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:route53:::hostedzone/*"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"route53:ListHostedZones",
|
||||||
|
"route53:ListResourceRecordSets",
|
||||||
|
"route53:ListTagsForResource"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"*"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
POLICY
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_iam_role_policy_attachment" "external-dns" {
|
||||||
|
role = aws_iam_role.external-dns.name
|
||||||
|
policy_arn = aws_iam_policy.AllowExternalDNSUpdates.arn
|
||||||
|
}
|
||||||
40
modules/eks/main.tf
Normal file
40
modules/eks/main.tf
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
module "eks" {
|
||||||
|
source = "terraform-aws-modules/eks/aws"
|
||||||
|
|
||||||
|
cluster_name = var.cluster_name
|
||||||
|
cluster_version = var.cluster_version
|
||||||
|
|
||||||
|
cluster_addons = {
|
||||||
|
coredns = {}
|
||||||
|
eks-pod-identity-agent = {}
|
||||||
|
kube-proxy = {}
|
||||||
|
vpc-cni = {}
|
||||||
|
}
|
||||||
|
|
||||||
|
vpc_id = var.vpc_id
|
||||||
|
subnet_ids = var.subnet_ids
|
||||||
|
|
||||||
|
/*
|
||||||
|
eks_managed_node_groups = { for az in var.azs : "ng-${az}" => {
|
||||||
|
instance_types = var.instance_types
|
||||||
|
ami_type = var.ami_type
|
||||||
|
min_size = var.min_size
|
||||||
|
max_size = var.max_size
|
||||||
|
desired_size = var.desired_size
|
||||||
|
placement_group_az = az
|
||||||
|
} }
|
||||||
|
*/
|
||||||
|
eks_managed_node_groups = {
|
||||||
|
ng = {
|
||||||
|
instance_types = var.instance_types
|
||||||
|
ami_type = var.ami_type
|
||||||
|
min_size = var.min_size
|
||||||
|
max_size = var.max_size
|
||||||
|
desired_size = var.desired_size
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
cluster_endpoint_public_access = true
|
||||||
|
cluster_endpoint_private_access = true
|
||||||
|
enable_cluster_creator_admin_permissions = true
|
||||||
|
}
|
||||||
51
modules/eks/variables.tf
Normal file
51
modules/eks/variables.tf
Normal file
@@ -0,0 +1,51 @@
|
|||||||
|
variable "vpc_id" {
|
||||||
|
description = "VPC ID"
|
||||||
|
type = string
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "subnet_ids" {
|
||||||
|
description = "EKS subnet IDs"
|
||||||
|
type = list(string)
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "instance_types" {
|
||||||
|
description = "EC2 instance types"
|
||||||
|
default = ["m5.large"]
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ami_type" {
|
||||||
|
description = "EC2 AMI type"
|
||||||
|
default = "AL2023_x86_64_STANDARD"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "cluster_name" {
|
||||||
|
description = "Cluster name"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "cluster_version" {
|
||||||
|
description = "Cluster Kubernetes version"
|
||||||
|
default = "1.33"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "azs" {
|
||||||
|
description = "Availability zones"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "min_size" {
|
||||||
|
description = "EKS managed node group minimum size"
|
||||||
|
type = number
|
||||||
|
default = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "max_size" {
|
||||||
|
description = "EKS managed node group maximum size"
|
||||||
|
type = number
|
||||||
|
default = 10
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "desired_size" {
|
||||||
|
description = "EKS managed node group desired size"
|
||||||
|
type = number
|
||||||
|
default = 1
|
||||||
|
}
|
||||||
|
|
||||||
19
modules/network/data.tf
Normal file
19
modules/network/data.tf
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
data "aws_availability_zones" "available" {
|
||||||
|
filter {
|
||||||
|
name = "opt-in-status"
|
||||||
|
values = ["opt-in-not-required"]
|
||||||
|
}
|
||||||
|
|
||||||
|
exclude_zone_ids = ["use1-az3", "usw1-az2", "cac1-az3"]
|
||||||
|
}
|
||||||
|
|
||||||
|
data "aws_vpc" "selected" {
|
||||||
|
id = var.vpc_id
|
||||||
|
}
|
||||||
|
|
||||||
|
data "aws_internet_gateway" "default" {
|
||||||
|
filter {
|
||||||
|
name = "attachment.vpc-id"
|
||||||
|
values = [data.aws_vpc.selected.id]
|
||||||
|
}
|
||||||
|
}
|
||||||
7
modules/network/locals.tf
Normal file
7
modules/network/locals.tf
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
locals {
|
||||||
|
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||||
|
|
||||||
|
az_private_subnets = zipmap(local.azs, var.private_subnets)
|
||||||
|
|
||||||
|
az_public_subnets = zipmap(local.azs, var.public_subnets)
|
||||||
|
}
|
||||||
74
modules/network/main.tf
Normal file
74
modules/network/main.tf
Normal file
@@ -0,0 +1,74 @@
|
|||||||
|
// Private subnet
|
||||||
|
resource "aws_subnet" "private" {
|
||||||
|
for_each = local.az_private_subnets
|
||||||
|
vpc_id = data.aws_vpc.selected.id
|
||||||
|
cidr_block = each.value
|
||||||
|
availability_zone = each.key
|
||||||
|
tags = {
|
||||||
|
Name = "EKS (${var.cluster_name}) private subnet (${each.key})",
|
||||||
|
"kubernetes.io/role/internal-elb" = 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route_table" "private" {
|
||||||
|
for_each = local.az_private_subnets
|
||||||
|
vpc_id = data.aws_vpc.selected.id
|
||||||
|
tags = {
|
||||||
|
Name = "EKS (${var.cluster_name}) private subnet (${each.key})"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route_table_association" "private" {
|
||||||
|
for_each = local.az_private_subnets
|
||||||
|
subnet_id = aws_subnet.private[each.key].id
|
||||||
|
route_table_id = aws_route_table.private[each.key].id
|
||||||
|
}
|
||||||
|
|
||||||
|
// Public subnet
|
||||||
|
resource "aws_subnet" "public" {
|
||||||
|
for_each = local.az_public_subnets
|
||||||
|
vpc_id = data.aws_vpc.selected.id
|
||||||
|
cidr_block = each.value
|
||||||
|
availability_zone = each.key
|
||||||
|
tags = {
|
||||||
|
Name = "EKS (${var.cluster_name}) public subnet (${each.key})"
|
||||||
|
"kubernetes.io/role/elb" = 1
|
||||||
|
}
|
||||||
|
map_public_ip_on_launch = true
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route_table" "public" {
|
||||||
|
vpc_id = data.aws_vpc.selected.id
|
||||||
|
tags = {
|
||||||
|
Name = "EKS (${var.cluster_name}) public subnet"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route_table_association" "public" {
|
||||||
|
for_each = local.az_public_subnets
|
||||||
|
subnet_id = aws_subnet.public[each.key].id
|
||||||
|
route_table_id = aws_route_table.public.id
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route" "public_internet_gateway" {
|
||||||
|
route_table_id = aws_route_table.public.id
|
||||||
|
destination_cidr_block = "0.0.0.0/0"
|
||||||
|
gateway_id = data.aws_internet_gateway.default.id
|
||||||
|
}
|
||||||
|
|
||||||
|
// NAT gateway
|
||||||
|
resource "aws_eip" "nat" {
|
||||||
|
domain = "vpc"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_nat_gateway" "nat_gateway" {
|
||||||
|
allocation_id = aws_eip.nat.id
|
||||||
|
subnet_id = aws_subnet.public[local.azs[0]].id
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "aws_route" "nat_gateway" {
|
||||||
|
for_each = local.az_private_subnets
|
||||||
|
route_table_id = aws_route_table.private[each.key].id
|
||||||
|
destination_cidr_block = "0.0.0.0/0"
|
||||||
|
nat_gateway_id = aws_nat_gateway.nat_gateway.id
|
||||||
|
}
|
||||||
15
modules/network/outputs.tf
Normal file
15
modules/network/outputs.tf
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
output "azs" {
|
||||||
|
value = local.azs
|
||||||
|
}
|
||||||
|
|
||||||
|
output "vpc" {
|
||||||
|
value = data.aws_vpc.selected
|
||||||
|
}
|
||||||
|
|
||||||
|
output "private_subnet_ids" {
|
||||||
|
value = [for k in aws_subnet.private : k.id]
|
||||||
|
}
|
||||||
|
|
||||||
|
output "public_subnet_ids" {
|
||||||
|
value = [for k in aws_subnet.public : k.id]
|
||||||
|
}
|
||||||
18
modules/network/variables.tf
Normal file
18
modules/network/variables.tf
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
variable "vpc_id" {
|
||||||
|
description = "VPC ID"
|
||||||
|
type = string
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "cluster_name" {
|
||||||
|
description = "The name of the cluster"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "private_subnets" {
|
||||||
|
description = "Private subnets}"
|
||||||
|
type = list(string)
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "public_subnets" {
|
||||||
|
description = "Public subnets}"
|
||||||
|
type = list(string)
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user