apps-devstg/us-east-2/k8s-eks-v1.17 folder renamed + sync changes wit…

…h us-east-1 stack

apps-devstg/us-east-2/k8s-eks/cluster/config.tf → apps-devstg/us-east-2/k8s-eks-v1.17/cluster/config.tf

@@ -2,9 +2,8 @@
 # Providers
 #
 provider "aws" {
-  region                  = var.region_secondary
-  profile                 = var.profile
-  shared_credentials_file = "~/.aws/${var.project}/config"
+  region  = var.region
+  profile = var.profile
 }
 
 provider "kubernetes" {
@@ -17,15 +16,15 @@ provider "kubernetes" {
 # Backend Config (partial)
 #
 terraform {
-  required_version = ">= 0.12.28"
+  required_version = "~> 1.1.3"
 
   required_providers {
-    aws        = "~> 3.28"
-    kubernetes = "~> 2.0.2"
+    aws        = "~> 4.10"
+    kubernetes = "~> 2.10"
   }
 
   backend "s3" {
-    key = "apps-devstg/k8s-eks-dr/cluster/terraform.tfstate"
+    key = "apps-devstg/k8s-eks-v1.17-dr/cluster/terraform.tfstate"
   }
 }
 
@@ -47,7 +46,7 @@ data "terraform_remote_state" "eks-dr-vpc" {
     region  = var.region
     profile = var.profile
     bucket  = var.bucket
-    key     = "apps-devstg/k8s-eks-dr/network/terraform.tfstate"
+    key     = "apps-devstg/k8s-eks-v1.17-dr/network/terraform.tfstate"
   }
 }
 

apps-devstg/us-east-2/k8s-eks/cluster/eks-workers-managed.tf → apps-devstg/us-east-2/k8s-eks-v1.17/cluster/eks-workers-managed.tf

@@ -1,5 +1,5 @@
 module "eks" {
-  source = "github.com/binbashar/terraform-aws-eks.git?ref=v17.20.0"
+  source = "github.com/binbashar/terraform-aws-eks.git?ref=v17.24.0"
 
   create_eks      = true
   cluster_name    = data.terraform_remote_state.eks-dr-vpc.outputs.cluster_name
@@ -34,20 +34,28 @@ module "eks" {
   #
   node_groups_defaults = {
     # Managed Nodes cannot specify custom AMIs, only use the ones allowed by EKS
-    ami_type       = "AL2_x86_64"
-    disk_size      = 50
-    instance_types = ["t2.medium"]
-    k8s_labels     = local.tags
+    ami_type   = "AL2_x86_64"
+    disk_size  = 50
+    k8s_labels = local.tags
   }
 
   #
   # List of Managed Node Groups
   #
   node_groups = {
-    main = {
+    on-demand = {
+      desired_capacity = 1
+      max_capacity     = 1
+      min_capacity     = 1
+      capacity_type    = "ON_DEMAND"
+      instance_types   = ["t2.medium", "t3.medium"]
+    }
+    spot = {
       desired_capacity = 1
       max_capacity     = 3
       min_capacity     = 1
+      capacity_type    = "SPOT"
+      instance_types   = ["t2.medium", "t3.medium"]
     }
   }
 
@@ -73,9 +81,9 @@ module "eks" {
   # Auth: aws-iam-authenticator
   #
   manage_aws_auth = var.manage_aws_auth
-  map_roles       = var.map_roles
-  map_accounts    = var.map_accounts
-  map_users       = var.map_users
+  map_roles       = local.map_roles
+  map_accounts    = local.map_accounts
+  map_users       = local.map_users
 
   #
   # Logging: which log types should be enabled and how long they should be kept for
@@ -93,7 +101,7 @@ module "eks" {
   # Tags
   #
   tags = merge(local.tags,
-    map("k8s.io/cluster-autoscaler/enabled", "TRUE"),
-    map("k8s.io/cluster-autoscaler/${data.terraform_remote_state.eks-dr-vpc.outputs.cluster_name}", "owned")
+    { "k8s.io/cluster-autoscaler/enabled" = "TRUE" },
+    { "k8s.io/cluster-autoscaler/${data.terraform_remote_state.eks-dr-vpc.outputs.cluster_name}" = "owned" }
   )
 }

apps-devstg/us-east-2/k8s-eks/cluster/locals.tf → apps-devstg/us-east-2/k8s-eks-v1.17/cluster/locals.tf

@@ -49,5 +49,14 @@ locals {
       groups = [
       "system:masters"]
     },
+    #
+    # Allow DevOps SSO role to become cluster admins
+    #
+    {
+      rolearn  = "arn:aws:iam::${var.appsdevstg_account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_DevOps_5e0501636a32f9c4"
+      username = "DevOps"
+      groups = [
+      "system:masters"]
+    },
   ]
 }

apps-devstg/us-east-2/k8s-eks/identities/config.tf → apps-devstg/us-east-2/k8s-eks-v1.17/identities/config.tf

@@ -2,30 +2,28 @@
 # AWS Provider Settings       #
 #=============================#
 provider "aws" {
-  region                  = var.region
-  profile                 = var.profile
-  shared_credentials_file = "~/.aws/${var.project}/config"
+  region  = var.region
+  profile = var.profile
 }
 
 provider "aws" {
-  alias                   = "shared"
-  region                  = var.region
-  profile                 = "${var.project}-shared-devops"
-  shared_credentials_file = "~/.aws/${var.project}/config"
+  alias   = "shared"
+  region  = var.region
+  profile = "${var.project}-shared-devops"
 }
 
 #=============================#
 # Backend Config (partial)    #
 #=============================#
 terraform {
-  required_version = ">= 0.14.11"
+  required_version = ">= 1.1.3"
 
   required_providers {
-    aws = "~> 3.27"
+    aws = "~> 4.10"
   }
 
   backend "s3" {
-    key = "apps-devstg/k8s-eks-dr/identities/terraform.tfstate"
+    key = "apps-devstg/k8s-eks-v1.17-dr/identities/terraform.tfstate"
   }
 }
 
@@ -39,7 +37,7 @@ data "terraform_remote_state" "apps-devstg-eks-dr-cluster" {
     region  = var.region
     profile = var.profile
     bucket  = var.bucket
-    key     = "${var.environment}/k8s-eks-dr/cluster/terraform.tfstate"
+    key     = "${var.environment}/k8s-eks-v1.17-dr/cluster/terraform.tfstate"
   }
 }
 

apps-devstg/us-east-2/k8s-eks/identities/policies.tf → apps-devstg/us-east-2/k8s-eks-v1.17/identities/policies.tf

@@ -33,12 +33,12 @@ EOF
 }
 
 #
-# External DNS policy
+# External DNS policy: aws.binbash.com.ar
 #
 resource "aws_iam_policy" "externaldns_aws_binbash_com_ar" {
   provider    = aws.shared
   name        = "${local.prefix}-externaldns-aws.binbash.com.ar"
-  description = "External DNS permissions on aws.binbash.com.ar"
+  description = "ExternalDNS permissions on aws.binbash.com.ar"
   policy      = <<EOF
 {
     "Version": "2012-10-17",

apps-devstg/us-east-2/k8s-eks/k8s-resources/apps.auto.tfvars → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/apps.auto.tfvars

@@ -54,11 +54,6 @@ kubernetes_dashboard_hosts         = "kubernetes-dashboard.us-east-2.devstg.aws.
 # Demo Apps - ArgoCD
 #------------------------------------------------------------------------------
 enable_cicd = true
-demoapps = {
-  emojivoto = false
-  gdm       = false
-  sockshop  = true
-}
 
 #------------------------------------------------------------------------------
 # Backups

apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/chart-values/vault.yaml

@@ -0,0 +1,2 @@
+injector:
+  externalVaultAddr: ${vaultAddress}

apps-devstg/us-east-2/k8s-eks/k8s-resources/ci_cd.tf → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/ci_cd.tf

@@ -7,6 +7,6 @@ resource "helm_release" "argocd" {
   namespace  = kubernetes_namespace.argocd.id
   repository = "https://argoproj.github.io/argo-helm"
   chart      = "argo-cd"
-  version    = "2.17.4"
+  version    = "4.5.7"
   values     = [file("chart-values/argo-cd.yaml")]
 }

apps-devstg/us-east-2/k8s-eks/k8s-resources/config.tf → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/config.tf

@@ -2,9 +2,8 @@
 # Providers
 #
 provider "aws" {
-  region                  = var.region_secondary
-  profile                 = var.profile
-  shared_credentials_file = "~/.aws/${var.project}/config"
+  region  = var.region
+  profile = var.profile
 }
 
 provider "kubernetes" {
@@ -25,16 +24,16 @@ provider "helm" {
 # Backend Config (partial)
 #
 terraform {
-  required_version = ">= 0.13.6"
+  required_version = ">= 1.1.3"
 
   required_providers {
-    aws        = "~> 3.28"
-    helm       = "~> 2.1.0"
-    kubernetes = "~> 2.0.2"
+    aws        = "~> 4.10"
+    helm       = "~> 2.5"
+    kubernetes = "~> 2.10"
   }
 
   backend "s3" {
-    key = "apps-devstg/k8s-eks-dr/k8s-resources/terraform.tfstate"
+    key = "apps-devstg/k8s-eks-v1.17-dr/k8s-resources/terraform.tfstate"
   }
 }
 
@@ -63,6 +62,6 @@ data "terraform_remote_state" "eks-cluster" {
     region  = var.region
     profile = var.profile
     bucket  = var.bucket
-    key     = "apps-devstg/k8s-eks-dr/cluster/terraform.tfstate"
+    key     = "apps-devstg/k8s-eks-v1.17-dr/cluster/terraform.tfstate"
   }
 }

apps-devstg/us-east-2/k8s-eks/k8s-resources/ingressmonitorcontroller-endpoint.tf → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/ingressmonitorcontroller-endpoint.tf

@@ -50,5 +50,5 @@ resource "helm_release" "emojivoto_imc_endpoint" {
       }
     )
   ]
-  depends_on = [helm_release.ingressmonitorcontroller, helm_release.emojivoto]
+  depends_on = [helm_release.ingressmonitorcontroller]
 }

apps-devstg/us-east-2/k8s-eks/k8s-resources/networking.tf → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/networking.tf

@@ -33,7 +33,7 @@ resource "helm_release" "externaldns_private" {
   namespace  = kubernetes_namespace.externaldns.id
   repository = "https://charts.bitnami.com/bitnami"
   chart      = "external-dns"
-  version    = "4.6.0"
+  version    = "6.5.3"
   values = [
     templatefile("chart-values/externaldns-private.yaml", {
       roleArn = "arn:aws:iam::${var.shared_account_id}:role/appsdevstg-dr-externaldns-private"

apps-devstg/us-east-2/k8s-eks/k8s-resources/variables.tf → apps-devstg/us-east-2/k8s-eks-v1.17/k8s-resources/variables.tf

@@ -3,7 +3,7 @@
 #=============================#
 variable "enable_private_ingress" {
   type    = bool
-  default = false
+  default = true
 }
 
 variable "enable_public_ingress" {
@@ -13,7 +13,7 @@ variable "enable_public_ingress" {
 
 variable "enable_private_dns_sync" {
   type    = bool
-  default = false
+  default = true
 }
 
 variable "enable_public_dns_sync" {
@@ -33,7 +33,7 @@ variable "enable_grafana_dependencies" {
 
 variable "enable_certmanager" {
   type    = bool
-  default = false
+  default = true
 }
 
 variable "enable_vault" {
@@ -48,7 +48,7 @@ variable "enable_cicd" {
 
 variable "enable_kubernetes_dashboard" {
   type    = bool
-  default = false
+  default = true
 }
 
 variable "enable_hpa_scaling" {
@@ -106,12 +106,6 @@ variable "enable_backups" {
   default = false
 }
 
-
-variable "demoapps" {
-  type    = any
-  default = {}
-}
-
 #==================================#
 # Ingress Monitor Controller (IMC) #
 #==================================#

apps-devstg/us-east-2/k8s-eks-v1.17/k8s-workloads/apps.auto.tfvars

@@ -0,0 +1,5 @@
+demoapps = {
+  emojivoto = true
+  gdm       = false
+  sockshop  = false
+}