Updated the example for the private eks cluster with additional details and individual stacks for vpc, eks cluster and add-ons

examples/fully-private-eks-cluster/README.md

@@ -1,139 +1,45 @@
-# Fully Private EKS Cluster with VPC and Endpoints deployment
+# Fully Private EKS Cluster with VPC and VPC Endpoints deployment
 
 This example deploys a fully private EKS Cluster into a new VPC.
  - Creates a new VPC and 3 Private Subnets
  - VPC Endpoints for various services and S3 VPC Endpoint gateway
- - Creates EKS Cluster Control plane with one Managed node group
-    - EKS Cluster API endpoint that can be set to public and private, and then into private only.
+ - Creates EKS Cluster Control plane with a private endpoint and with one Managed node group
 
 Please see this [document](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) for more details on configuring fully private EKS Clusters
 
-## How to Deploy
-### Prerequisites:
-Ensure that you have installed the following tools in your Mac or Windows Laptop before start working with this module and run Terraform Plan and Apply
-1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
-3. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
-4. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
-
-### Deployment Steps
-#### Step1: Clone the repo using the command below
-
-```shell script
-git clone https://github.com/aws-samples/aws-eks-accelerator-for-terraform.git
-```
-
-#### Step2: Run Terraform INIT
-Initialize a working directory with configuration files
-
-```shell script
-cd examples/fully-private-eks-cluster/
-terraform init
-```
-
-#### Step3: Run Terraform PLAN
-Verify the resources created by this execution
-
-```shell script
-export AWS_REGION=<ENTER YOUR REGION>   # Select your own region
-terraform plan
-```
-
-#### Step4: Terraform APPLY
-to create resources
-
-```shell script
-terraform apply
-```
-
-Enter `yes` to apply
-
-### Configure `kubectl` and test cluster
-EKS Cluster details can be extracted from terraform output or from AWS Console to get the name of cluster.
-This following command used to update the `kubeconfig` in your local machine where you run kubectl commands to interact with your EKS Cluster.
-
-#### Step5: Run `update-kubeconfig` command
+Here is the high level design of the solution. The solution has been split into 3 different TerraForm stacks for simplicity.
+1. VPC
+2. EKS
+3. ADD-ONS
 
-`~/.kube/config` file gets updated with cluster details and certificate from the below command
+![High Level Design](./images/EKS_private_cluster.jpg)
 
-    $ aws eks --region <enter-your-region> update-kubeconfig --name <cluster-name>
-
-#### Step6: List all the worker nodes by running the command below
-
-    $ kubectl get nodes
-
-#### Step7: List all the pods running in `kube-system` namespace
-
-    $ kubectl get pods -n kube-system
-
-### Setting up private only API endpoint and accessing the cluster
-
-- To set the API endpoint to private only, on the `main.tf` file under the SSP module:
-    - Set `eks_cluster_api_endpoint_public = false`
-    - Set `eks_cluster_api_endpoint_private = true`
-
-- To access the private cluster, you need to access it from a machine that can access the VPC and the private subnets. Few ways to do this are:
-    - Create a bastion host in the VPC and then access the cluster from the bastion host
-    - Create a cloud9 instance in the VPC and then access the cluster from the cloud9 instance
-These examples assume you do not have any other network infrastructure in place (e.g. direct connect(DX), VPN etc.).
-
-Learn more about private EKS clusters [here](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html)
-
-## How to Destroy
-The following command destroys the resources created by `terraform apply`
-
-```shell script
-cd examples/fully-private-eks-cluster
-terraform destroy --auto-approve
-```
+## How to Deploy
+### Prerequisites:
 
-<!--- BEGIN_TF_DOCS --->
-## Requirements
 
-| Name | Version |
-|------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.1 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.66.0 |
-| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.4.1 |
-| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.6.1 |
+### Environment Set up.
 
-## Providers
+Pre-requisites
+1. This examples assumes that you have a default VPC in your AWS account.
+2. An EC2 instance running in the default VPC that is running Jekins OR having the pre-requisite tools mentioned below. For simplicity this EC2 instance is running in the public VPC.
 
-| Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.66.0 |
+    2.1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
 
-## Modules
+    2.2. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
 
-| Name | Source | Version |
-|------|--------|---------|
-| <a name="module_aws-eks-accelerator-for-terraform"></a> [aws-eks-accelerator-for-terraform](#module\_aws-eks-accelerator-for-terraform) | ../.. | n/a |
-| <a name="module_aws_vpc"></a> [aws\_vpc](#module\_aws\_vpc) | terraform-aws-modules/vpc/aws | v3.2.0 |
-| <a name="module_vpc_endpoint_gateway"></a> [vpc\_endpoint\_gateway](#module\_vpc\_endpoint\_gateway) | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | v3.2.0 |
-| <a name="module_vpc_endpoints"></a> [vpc\_endpoints](#module\_vpc\_endpoints) | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | v3.2.0 |
+    2.3. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
 
-## Resources
+3. You can SSH into the EC2 instance to run Terraform commands OR access the Jenkins server running on this EC2 instance. Please note that setting up Jenkins on the EC2 instance is out of scope from this example.
+4. Deploy the individual stacks from each of the sub folders. i.e.
 
-| Name | Type |
-|------|------|
-| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
-| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
-| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
-| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
-| [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
+    4.1 VPC
 
-## Inputs
+    4.2 EKS
 
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes Version | `string` | `"1.21"` | no |
-| <a name="input_environment"></a> [environment](#input\_environment) | Environment area, e.g. prod or preprod | `string` | `"preprod"` | no |
-| <a name="input_tenant"></a> [tenant](#input\_tenant) | Account Name or unique account unique id e.g., apps or management or aws007 | `string` | `"aws001"` | no |
-| <a name="input_zone"></a> [zone](#input\_zone) | zone, e.g. dev or qa or load or ops etc... | `string` | `"dev"` | no |
+    4.3 Add-ons
 
-## Outputs
 
-| Name | Description |
-|------|-------------|
-| <a name="output_configure_kubectl"></a> [configure\_kubectl](#output\_configure\_kubectl) | Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig |
+Please refer to the README.MD in the individual sub folders for the deployment instructions.
 
 <!--- END_TF_DOCS --->

examples/fully-private-eks-cluster/add-ons/README.md

@@ -0,0 +1,116 @@
+## How to deploy the example
+
+This example deploys the following :
+ - Install ArgoCD as the GitOps tool
+ - Deploys some add-ons using ArgoCD
+ - Deploys a sample application using ArgoCD
+
+
+### Prerequisites:
+We will deploy the EKS cluster from the bastion host/Jenkins server that is running on the default VPC.
+Ensure that you have installed the following tools in the bastion host/Jenkins server before start working with this module and run Terraform Plan and Apply
+1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
+3. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
+4. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
+
+### Deployment Steps
+#### Step1: Clone the repo using the command below
+
+```shell script
+git clone https://github.com/aws-samples/aws-eks-accelerator-for-terraform.git
+```
+
+#### Step2: Run Terraform INIT
+Initialize a working directory with configuration files
+
+```shell script
+cd examples/fully-private-eks-cluster/add-ons
+terraform init -backend-config backend.conf
+```
+
+#### Step3: Run Terraform PLAN
+Verify the resources created by this execution
+
+```shell script
+export AWS_REGION=<ENTER YOUR REGION>   # Select your own region
+terraform plan -var-file base.tfvars
+```
+
+#### Step4: Terraform APPLY
+to create resources
+
+```shell script
+terraform apply -var-file base.tfvars
+```
+
+Enter `yes` to apply
+
+## Verify the add-ons are deployed.
+Pre-requisite : kubectl installed on the bastion host/Jenkins Server.
+
+    $ kubectl get pods -A
+
+You can see a list of all the add-ons running as pods on the EKS cluster. This also includes argocd runnings in its own namespace.
+
+
+## How to Destroy
+The following command destroys the resources created by `terraform apply`
+
+```shell script
+cd examples/fully-private-eks-cluster/vpc
+terraform destroy -var-file base.tfvars -auto-approve  
+``` 
+
+
+<!--- BEGIN_TF_DOCS --->
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: MIT-0
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the "Software"), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_eks-cluster-with-import-vpc"></a> [eks-cluster-with-import-vpc](#module\_eks-cluster-with-import-vpc) | ../../../examples/eks-cluster-with-import-vpc/eks | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_environment"></a> [environment](#input\_environment) | Environment area, e.g. prod or preprod | `string` | n/a | yes |
+| <a name="input_kubernetes_version"></a> [kubernetes\_version](#input\_kubernetes\_version) | Kubernetes Version | `string` | `"1.21"` | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
+| <a name="input_tenant"></a> [tenant](#input\_tenant) | Account Name or unique account unique id e.g., apps or management or aws007 | `string` | n/a | yes |
+| <a name="input_tf_state_vpc_s3_bucket"></a> [tf\_state\_vpc\_s3\_bucket](#input\_tf\_state\_vpc\_s3\_bucket) | Terraform state S3 Bucket Name | `string` | n/a | yes |
+| <a name="input_tf_state_vpc_s3_key"></a> [tf\_state\_vpc\_s3\_key](#input\_tf\_state\_vpc\_s3\_key) | Terraform state S3 Key path | `string` | n/a | yes |
+| <a name="input_zone"></a> [zone](#input\_zone) | zone, e.g. dev or qa or load or ops etc... | `string` | n/a | yes |
+
+## Outputs
+
+No outputs.
+
+<!--- END_TF_DOCS --->

examples/fully-private-eks-cluster/add-ons/backend.conf

@@ -0,0 +1,3 @@
+bucket = "terraform-ssp-github-actions-state"
+region = "us-west-2"
+key    = "private/addons/terraform-main.tfstate"

examples/fully-private-eks-cluster/add-ons/base.tfvars

@@ -0,0 +1,2 @@
+region = "us-west-2"
+eks_cluster_id = "aws001-preprod-test-eks"

examples/fully-private-eks-cluster/add-ons/data.tf

@@ -0,0 +1,27 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: MIT-0
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this
+ * software and associated documentation files (the "Software"), to deal in the Software
+ * without restriction, including without limitation the rights to use, copy, modify,
+ * merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+ * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+data "aws_availability_zones" "available" {}
+
+data "aws_eks_cluster" "cluster" {
+  name = var.eks_cluster_id
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+  name = var.eks_cluster_id
+}