diff --git a/spartan/terraform/eks-cluster/main.tf b/spartan/terraform/eks-cluster/main.tf new file mode 100644 index 000000000000..09ef171443ff --- /dev/null +++ b/spartan/terraform/eks-cluster/main.tf @@ -0,0 +1,114 @@ +terraform { + backend "s3" { + bucket = "aztec-terraform" + key = "spartan/terraform.tfstate" + region = "eu-west-2" + } + + required_providers { + aws = { + source = "hashicorp/aws" + version = "5.47.0" + } + } +} + +provider "aws" { + region = var.region +} + +# Filter out local zones, which are not currently supported +# with managed node groups +data "aws_availability_zones" "available" { + filter { + name = "opt-in-status" + values = ["opt-in-not-required"] + } +} + +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = "5.8.1" + + name = var.cluster_name + cidr = "10.1.0.0/16" + + azs = slice(data.aws_availability_zones.available.names, 0, 3) + private_subnets = ["10.1.1.0/24", "10.1.2.0/24"] + public_subnets = ["10.1.3.0/24", "10.1.4.0/24"] + + enable_nat_gateway = true + single_nat_gateway = true + enable_dns_hostnames = true + enable_vpn_gateway = true + + public_subnet_tags = { + "kubernetes.io/role/elb" = 1 + } + + private_subnet_tags = { + "kubernetes.io/role/internal-elb" = 1 + } + + tags = { + Project = var.cluster_name + } +} + +# EKS Module +module "eks" { + source = "terraform-aws-modules/eks/aws" + version = "20.8.5" + + cluster_name = var.cluster_name + cluster_version = "1.31" + + cluster_endpoint_public_access = true + enable_cluster_creator_admin_permissions = true + + cluster_addons = { + aws-ebs-csi-driver = { + service_account_role_arn = module.irsa-ebs-csi.iam_role_arn + } + } + + # VPC and Subnets + vpc_id = module.vpc.vpc_id + subnet_ids = module.vpc.private_subnets + + # EKS Managed Node Group(s) + eks_managed_node_group_defaults = { + ami_type = "AL2_x86_64" + } + + eks_managed_node_groups = { + default = { + name = "node-group-1" + instance_types = ["m6a.2xlarge"] + + min_size = 1 + max_size = 2 + desired_size = 1 + } + } + + tags = { + Project = var.cluster_name + } +} + +# https://aws.amazon.com/blogs/containers/amazon-ebs-csi-driver-is-now-generally-available-in-amazon-eks-add-ons/ +data "aws_iam_policy" "ebs_csi_policy" { + arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" +} + +module "irsa-ebs-csi" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc" + version = "5.39.0" + + create_role = true + role_name = "AmazonEKSTFEBSCSIRole-${module.eks.cluster_name}" + provider_url = module.eks.oidc_provider + role_policy_arns = [data.aws_iam_policy.ebs_csi_policy.arn] + oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:ebs-csi-controller-sa"] +} diff --git a/spartan/terraform/eks-cluster/outputs.tf b/spartan/terraform/eks-cluster/outputs.tf new file mode 100644 index 000000000000..8c14a52e2373 --- /dev/null +++ b/spartan/terraform/eks-cluster/outputs.tf @@ -0,0 +1,19 @@ +output "cluster_endpoint" { + description = "Endpoint for EKS control plane" + value = module.eks.cluster_endpoint +} + +output "cluster_security_group_id" { + description = "Security group ids attached to the cluster control plane" + value = module.eks.cluster_security_group_id +} + +output "region" { + description = "AWS region" + value = var.region +} + +output "cluster_name" { + description = "Kubernetes Cluster Name" + value = module.eks.cluster_name +} \ No newline at end of file diff --git a/spartan/terraform/eks-cluster/variables.tf b/spartan/terraform/eks-cluster/variables.tf new file mode 100644 index 000000000000..abe47f8fe822 --- /dev/null +++ b/spartan/terraform/eks-cluster/variables.tf @@ -0,0 +1,10 @@ +variable "region" { + description = "AWS region" + type = string + default = "us-east-1" +} + +variable "cluster_name" { + type = string + default = "spartan" +} \ No newline at end of file diff --git a/spartan/terraform/main.tf b/spartan/terraform/main.tf deleted file mode 100644 index 8174abc71be7..000000000000 --- a/spartan/terraform/main.tf +++ /dev/null @@ -1,125 +0,0 @@ -# Configure the AWS Provider -provider "aws" { - region = "us-east-2" # Change this to your preferred region -} - -# Create VPC for EKS -resource "aws_vpc" "spartan_vpc" { - cidr_block = "10.0.0.0/16" - - tags = { - Name = "spartan-vpc" - } -} - -# Create an internet gateway -resource "aws_internet_gateway" "spartan_igw" { - vpc_id = aws_vpc.spartan_vpc.id - - tags = { - Name = "spartan-igw" - } -} - -# Create a subnet -resource "aws_subnet" "spartan_subnet" { - vpc_id = aws_vpc.spartan_vpc.id - cidr_block = "10.0.1.0/24" - availability_zone = "us-east-2a" # Change this to match your region - - tags = { - Name = "spartan-subnet" - } -} - -# Create EKS Cluster -resource "aws_eks_cluster" "spartan_cluster" { - name = "spartan-cluster" - role_arn = aws_iam_role.spartan_cluster_role.arn - - vpc_config { - subnet_ids = [aws_subnet.spartan_subnet.id] - } - - depends_on = [aws_iam_role_policy_attachment.spartan_cluster_policy] -} - -# Create IAM role for EKS Cluster -resource "aws_iam_role" "spartan_cluster_role" { - name = "spartan-cluster-role" - - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = "sts:AssumeRole" - Effect = "Allow" - Principal = { - Service = "eks.amazonaws.com" - } - } - ] - }) -} - -# Attach necessary policies to the EKS Cluster role -resource "aws_iam_role_policy_attachment" "spartan_cluster_policy" { - policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" - role = aws_iam_role.spartan_cluster_role.name -} - -# Create EKS Node Group -resource "aws_eks_node_group" "spartan_node_group" { - cluster_name = aws_eks_cluster.spartan_cluster.name - node_group_name = "spartan-node-group" - node_role_arn = aws_iam_role.spartan_node_role.arn - subnet_ids = [aws_subnet.spartan_subnet.id] - - scaling_config { - desired_size = 1 - max_size = 1 - min_size = 1 - } - - instance_types = ["t4g.2xlarge"] - - depends_on = [ - aws_iam_role_policy_attachment.spartan_worker_node_policy, - aws_iam_role_policy_attachment.spartan_cni_policy, - aws_iam_role_policy_attachment.spartan_ecr_policy, - ] -} - -# Create IAM role for EKS Node Group -resource "aws_iam_role" "spartan_node_role" { - name = "spartan-node-role" - - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = "sts:AssumeRole" - Effect = "Allow" - Principal = { - Service = "ec2.amazonaws.com" - } - } - ] - }) -} - -# Attach necessary policies to the EKS Node role -resource "aws_iam_role_policy_attachment" "spartan_worker_node_policy" { - policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy" - role = aws_iam_role.spartan_node_role.name -} - -resource "aws_iam_role_policy_attachment" "spartan_cni_policy" { - policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" - role = aws_iam_role.spartan_node_role.name -} - -resource "aws_iam_role_policy_attachment" "spartan_ecr_policy" { - policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" - role = aws_iam_role.spartan_node_role.name -} \ No newline at end of file