adding terraform to create eks cluster and dependencies

.gitignore

@@ -14,6 +14,17 @@ i18n/*.invalid
 data/chatbot/*.*
 !data/chatbot/.gitkeep
 
+# TF
+secret.auto.tfvars
+**/.terraform/*
+*.tfstate
+*.tfstate.*
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+tfplan.binary
+
 # Build
 .nyc_output/
 .sass-cache/
@@ -57,3 +68,4 @@ config/*.yml
 !config/unsafe.yml
 !config/tutorial.yml
 !config/oss.yml
+kubeconfig_*

example-secret.auto.tfvars

@@ -0,0 +1,2 @@
+access_key = ""
+secret_key = ""

main.tf

@@ -0,0 +1,74 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.20.0"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "3.1.0"
+    }
+
+    local = {
+      source  = "hashicorp/local"
+      version = "2.1.0"
+    }
+
+    null = {
+      source  = "hashicorp/null"
+      version = "3.1.0"
+    }
+
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.0.1"
+    }
+  }
+
+  required_version = ">= 0.14"
+}
+
+provider "aws" {
+  region                      = var.region
+  skip_credentials_validation = true
+  skip_requesting_account_id  = true
+  skip_metadata_api_check     = true
+  access_key                  = var.access_key
+  secret_key                  = var.secret_key
+}
+
+provider "kubernetes" {
+  host                   = module.includes.cluster_host
+  token                  = module.includes.cluster_token
+  cluster_ca_certificate = module.includes.cluster_cert
+}
+
+module "includes" {
+  source = "./terraform/modules/includes"
+
+  sg_wg_one_id = module.sg.workgroup_one_id
+  sg_wg_two_id = module.sg.workgroup_two_id
+}
+
+module "sg"  {
+  source = "./terraform/modules/security-groups"
+  vpc_id = module.includes.vpc_id
+}
+
+module "subnets" {
+  source = "./terraform/modules/subnets"
+
+  region = var.region
+  vpc_id = module.includes.vpc_id
+}
+
+module "storage" {
+  source = "./terraform/modules/storage"
+
+  cluster_name = module.includes.cluster_name
+  rds_sg_id = module.sg.rds_sg_id
+  private_subnet = [module.subnets.subnet_id_main, module.subnets.subnet_id_secondary]
+}
+
+

terraform/modules/includes/inputs.tf

@@ -0,0 +1,3 @@
+variable "sg_wg_one_id" {}
+
+variable "sg_wg_two_id" {}

terraform/modules/includes/main.tf

@@ -0,0 +1,78 @@
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+}
+
+locals {
+  cluster_name = "snyk-demo-eks-${random_string.suffix.result}"
+}
+
+data "aws_eks_cluster" "cluster" {
+  name = module.eks.cluster_id
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+  name = module.eks.cluster_id
+}
+
+data "aws_availability_zones" "available" {}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "3.2.0"
+
+  name                 = "snyk-demo-vpc"
+  cidr                 = "10.0.0.0/16"
+  azs                  = data.aws_availability_zones.available.names
+  private_subnets      = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+  public_subnets       = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+  enable_nat_gateway   = true
+  single_nat_gateway   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+  }
+
+  public_subnet_tags = {
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+    "kubernetes.io/role/elb"                      = "1"
+  }
+
+  private_subnet_tags = {
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+    "kubernetes.io/role/internal-elb"             = "1"
+  }
+}
+
+module "eks" {
+  source          = "terraform-aws-modules/eks/aws"
+  version         = "17.24.0"
+  cluster_name    = local.cluster_name
+  cluster_version = "1.20"
+  subnets         = module.vpc.private_subnets
+
+  vpc_id = module.vpc.vpc_id
+
+  workers_group_defaults = {
+    root_volume_type = "gp2"
+  }
+
+  worker_groups = [
+    {
+      name                          = "worker-group-1"
+      instance_type                 = "t2.small"
+      additional_userdata           = "echo foo bar"
+      additional_security_group_ids = [var.sg_wg_one_id]
+      asg_desired_capacity          = 2
+    },
+    {
+      name                          = "worker-group-2"
+      instance_type                 = "t2.medium"
+      additional_userdata           = "echo foo bar"
+      additional_security_group_ids = [var.sg_wg_two_id]
+      asg_desired_capacity          = 1
+    },
+  ]
+}
+

terraform/modules/includes/outputs.tf

@@ -0,0 +1,19 @@
+output "cluster_host" {
+  value = data.aws_eks_cluster.cluster.endpoint
+}
+
+output "cluster_token" {
+  value = data.aws_eks_cluster_auth.cluster.token
+}
+
+output "cluster_cert" {
+value = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
+}
+
+output "cluster_name" {
+  value = local.cluster_name
+}
+
+output "vpc_id" {
+  value = module.vpc.vpc_id
+}

terraform/modules/security-groups/inputs.tf

@@ -0,0 +1,3 @@
+variable "vpc_id" {
+  description = "ID of preconfigured VPC"
+}