:role/cluster-autoscaler"
-
-autoDiscovery:
- clusterName: test-eks-irsa
- enabled: true
diff --git a/examples/irsa/irsa.tf b/examples/irsa/irsa.tf
index 7bb9f7f258..a36d0e3394 100644
--- a/examples/irsa/irsa.tf
+++ b/examples/irsa/irsa.tf
@@ -1,6 +1,62 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_region" "current" {}
+
+locals {
+ k8s_service_account_namespace = "kube-system"
+ k8s_service_account_name = "cluster-autoscaler-aws"
+}
+
+provider "helm" {
+ kubernetes {
+ host = data.aws_eks_cluster.cluster.endpoint
+ cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+ token = data.aws_eks_cluster_auth.cluster.token
+ }
+}
+
+resource "helm_release" "cluster-autoscaler" {
+ depends_on = [
+ module.eks
+ ]
+
+ name = "cluster-autoscaler"
+ namespace = local.k8s_service_account_namespace
+ repository = "https://kubernetes.github.io/autoscaler"
+ chart = "cluster-autoscaler"
+ version = "9.10.7"
+ create_namespace = false
+
+ set {
+ name = "awsRegion"
+ value = data.aws_region.current.name
+ }
+ set {
+ name = "rbac.serviceAccount.name"
+ value = local.k8s_service_account_name
+ }
+ set {
+ name = "rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
+ value = module.iam_assumable_role_admin.iam_role_arn
+ type = "string"
+ }
+ set {
+ name = "autoDiscovery.clusterName"
+ value = local.name
+ }
+ set {
+ name = "autoDiscovery.enabled"
+ value = "true"
+ }
+ set {
+ name = "rbac.create"
+ value = "true"
+ }
+}
+
module "iam_assumable_role_admin" {
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
- version = "3.6.0"
+ version = "~> 4.0"
create_role = true
role_name = "cluster-autoscaler"
diff --git a/examples/irsa/locals.tf b/examples/irsa/locals.tf
deleted file mode 100644
index a0e5da0c28..0000000000
--- a/examples/irsa/locals.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-locals {
- cluster_name = "test-eks-irsa"
- k8s_service_account_namespace = "kube-system"
- k8s_service_account_name = "cluster-autoscaler-aws-cluster-autoscaler-chart"
-}
diff --git a/examples/irsa/main.tf b/examples/irsa/main.tf
index c9ea505900..ebe2eeffea 100644
--- a/examples/irsa/main.tf
+++ b/examples/irsa/main.tf
@@ -1,53 +1,37 @@
provider "aws" {
- region = "eu-west-1"
+ region = local.region
}
-data "aws_eks_cluster" "cluster" {
- name = module.eks.cluster_id
+locals {
+ name = "irsa-${random_string.suffix.result}"
+ cluster_version = "1.20"
+ region = "eu-west-1"
}
-data "aws_eks_cluster_auth" "cluster" {
- name = module.eks.cluster_id
-}
+################################################################################
+# EKS Module
+################################################################################
-provider "kubernetes" {
- host = data.aws_eks_cluster.cluster.endpoint
- cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
- token = data.aws_eks_cluster_auth.cluster.token
-}
+module "eks" {
+ source = "../.."
-data "aws_availability_zones" "available" {}
+ cluster_name = local.name
+ cluster_version = local.cluster_version
-data "aws_caller_identity" "current" {}
+ vpc_id = module.vpc.vpc_id
+ subnets = module.vpc.private_subnets
-module "vpc" {
- source = "terraform-aws-modules/vpc/aws"
- version = "2.64.0"
- name = "test-vpc"
- cidr = "10.0.0.0/16"
- azs = data.aws_availability_zones.available.names
- public_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
- enable_dns_hostnames = true
+ cluster_endpoint_private_access = true
+ cluster_endpoint_public_access = true
- public_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared"
- "kubernetes.io/role/elb" = "1"
- }
-}
-
-module "eks" {
- source = "../.."
- cluster_name = local.cluster_name
- cluster_version = "1.20"
- subnets = module.vpc.public_subnets
- vpc_id = module.vpc.vpc_id
- enable_irsa = true
+ enable_irsa = true
worker_groups = [
{
name = "worker-group-1"
instance_type = "t3.medium"
asg_desired_capacity = 1
+ asg_max_size = 4
tags = [
{
"key" = "k8s.io/cluster-autoscaler/enabled"
@@ -55,11 +39,77 @@ module "eks" {
"value" = "true"
},
{
- "key" = "k8s.io/cluster-autoscaler/${local.cluster_name}"
+ "key" = "k8s.io/cluster-autoscaler/${local.name}"
"propagate_at_launch" = "false"
"value" = "owned"
}
]
}
]
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
+################################################################################
+# Kubernetes provider configuration
+################################################################################
+
+data "aws_eks_cluster" "cluster" {
+ name = module.eks.cluster_id
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+ name = module.eks.cluster_id
}
+
+provider "kubernetes" {
+ host = data.aws_eks_cluster.cluster.endpoint
+ cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+ token = data.aws_eks_cluster_auth.cluster.token
+}
+
+################################################################################
+# Supporting Resources
+################################################################################
+
+data "aws_availability_zones" "available" {
+}
+
+resource "random_string" "suffix" {
+ length = 8
+ special = false
+}
+
+module "vpc" {
+ source = "terraform-aws-modules/vpc/aws"
+ version = "~> 3.0"
+
+ name = local.name
+ cidr = "10.0.0.0/16"
+ azs = data.aws_availability_zones.available.names
+ private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+ public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+ enable_nat_gateway = true
+ single_nat_gateway = true
+ enable_dns_hostnames = true
+
+ public_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/elb" = "1"
+ }
+
+ private_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/internal-elb" = "1"
+ }
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
diff --git a/examples/irsa/versions.tf b/examples/irsa/versions.tf
index 6e29ae8f1b..f546ca0cf0 100644
--- a/examples/irsa/versions.tf
+++ b/examples/irsa/versions.tf
@@ -5,6 +5,7 @@ terraform {
aws = ">= 3.22.0"
local = ">= 1.4"
random = ">= 2.1"
- kubernetes = "~> 1.11"
+ kubernetes = "~> 2.0"
+ helm = "~> 2.0"
}
}
diff --git a/examples/_bootstrap/README.md b/examples/launch_templates/README.md
similarity index 53%
rename from examples/_bootstrap/README.md
rename to examples/launch_templates/README.md
index 28e34f9c8f..6d1d5e2549 100644
--- a/examples/_bootstrap/README.md
+++ b/examples/launch_templates/README.md
@@ -1,8 +1,8 @@
-# Various bootstrap resources required for other EKS examples
+# Launch templates example
-Configuration in this directory creates some resources required in other EKS examples (such as VPC).
+This is EKS example using workers launch template with worker groups feature.
-The resources created here are free (no NAT gateways here) and they can reside in test AWS account.
+See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/worker.html) for more details.
## Usage
@@ -23,7 +23,8 @@ Note that this example may create resources which cost money. Run `terraform des
|------|---------|
| [terraform](#requirement\_terraform) | >= 0.13.1 |
| [aws](#requirement\_aws) | >= 3.22.0 |
-| [kubernetes](#requirement\_kubernetes) | >= 1.11 |
+| [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
+| [local](#requirement\_local) | >= 1.4 |
| [random](#requirement\_random) | >= 2.1 |
## Providers
@@ -37,6 +38,7 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Source | Version |
|------|--------|---------|
+| [eks](#module\_eks) | ../.. | |
| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
## Resources
@@ -45,6 +47,8 @@ Note that this example may create resources which cost money. Run `terraform des
|------|------|
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
+| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
## Inputs
@@ -54,7 +58,8 @@ No inputs.
| Name | Description |
|------|-------------|
-| [cluster\_name](#output\_cluster\_name) | Name of EKS Cluster used in tags for subnets |
-| [region](#output\_region) | AWS region |
-| [vpc](#output\_vpc) | Complete output of VPC module |
+| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
+| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
+| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
+| [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
diff --git a/examples/launch_templates/main.tf b/examples/launch_templates/main.tf
index 68fc20599b..476ca13d68 100644
--- a/examples/launch_templates/main.tf
+++ b/examples/launch_templates/main.tf
@@ -1,50 +1,25 @@
provider "aws" {
- region = "eu-west-1"
-}
-
-data "aws_eks_cluster" "cluster" {
- name = module.eks.cluster_id
-}
-
-data "aws_eks_cluster_auth" "cluster" {
- name = module.eks.cluster_id
-}
-
-provider "kubernetes" {
- host = data.aws_eks_cluster.cluster.endpoint
- cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
- token = data.aws_eks_cluster_auth.cluster.token
-}
-
-data "aws_availability_zones" "available" {
+ region = local.region
}
locals {
- cluster_name = "test-eks-lt-${random_string.suffix.result}"
-}
-
-resource "random_string" "suffix" {
- length = 8
- special = false
+ name = "launch_template-${random_string.suffix.result}"
+ cluster_version = "1.20"
+ region = "eu-west-1"
}
-module "vpc" {
- source = "terraform-aws-modules/vpc/aws"
- version = "~> 2.47"
-
- name = "test-vpc-lt"
- cidr = "10.0.0.0/16"
- azs = data.aws_availability_zones.available.names
- public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
- enable_dns_hostnames = true
-}
+################################################################################
+# EKS Module
+################################################################################
module "eks" {
- source = "../.."
- cluster_name = local.cluster_name
- cluster_version = "1.20"
- subnets = module.vpc.public_subnets
- vpc_id = module.vpc.vpc_id
+ source = "../.."
+ cluster_name = local.name
+ cluster_version = local.cluster_version
+ vpc_id = module.vpc.vpc_id
+ subnets = module.vpc.private_subnets
+ cluster_endpoint_private_access = true
+ cluster_endpoint_public_access = true
worker_groups_launch_template = [
{
@@ -90,4 +65,70 @@ module "eks" {
]
},
]
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
+################################################################################
+# Kubernetes provider configuration
+################################################################################
+
+data "aws_eks_cluster" "cluster" {
+ name = module.eks.cluster_id
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+ name = module.eks.cluster_id
+}
+
+provider "kubernetes" {
+ host = data.aws_eks_cluster.cluster.endpoint
+ cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+ token = data.aws_eks_cluster_auth.cluster.token
+}
+
+################################################################################
+# Supporting Resources
+################################################################################
+
+data "aws_availability_zones" "available" {
+}
+
+resource "random_string" "suffix" {
+ length = 8
+ special = false
+}
+
+module "vpc" {
+ source = "terraform-aws-modules/vpc/aws"
+ version = "~> 3.0"
+
+ name = local.name
+ cidr = "10.0.0.0/16"
+ azs = data.aws_availability_zones.available.names
+ private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+ public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+ enable_nat_gateway = true
+ single_nat_gateway = true
+ enable_dns_hostnames = true
+
+ public_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/elb" = "1"
+ }
+
+ private_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/internal-elb" = "1"
+ }
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
}
diff --git a/examples/launch_templates/outputs.tf b/examples/launch_templates/outputs.tf
index 359db3a481..b778ec7926 100644
--- a/examples/launch_templates/outputs.tf
+++ b/examples/launch_templates/outputs.tf
@@ -1,19 +1,19 @@
-output "cluster_endpoint" {
- description = "Endpoint for EKS control plane."
- value = module.eks.cluster_endpoint
-}
-
-output "cluster_security_group_id" {
- description = "Security group ids attached to the cluster control plane."
- value = module.eks.cluster_security_group_id
-}
-
-output "kubectl_config" {
- description = "kubectl config as generated by the module."
- value = module.eks.kubeconfig
-}
-
-output "config_map_aws_auth" {
- description = "A kubernetes configuration to authenticate to this EKS cluster."
- value = module.eks.config_map_aws_auth
-}
+output "cluster_endpoint" {
+ description = "Endpoint for EKS control plane."
+ value = module.eks.cluster_endpoint
+}
+
+output "cluster_security_group_id" {
+ description = "Security group ids attached to the cluster control plane."
+ value = module.eks.cluster_security_group_id
+}
+
+output "kubectl_config" {
+ description = "kubectl config as generated by the module."
+ value = module.eks.kubeconfig
+}
+
+output "config_map_aws_auth" {
+ description = "A kubernetes configuration to authenticate to this EKS cluster."
+ value = module.eks.config_map_aws_auth
+}
diff --git a/examples/launch_templates/pre_userdata.sh b/examples/launch_templates/pre_userdata.sh
index 52dd50f28c..4cbf0d114b 100644
--- a/examples/launch_templates/pre_userdata.sh
+++ b/examples/launch_templates/pre_userdata.sh
@@ -1 +1 @@
-yum update -y
+yum update -y
diff --git a/examples/launch_templates/versions.tf b/examples/launch_templates/versions.tf
index 6e29ae8f1b..9c1dbfa3e8 100644
--- a/examples/launch_templates/versions.tf
+++ b/examples/launch_templates/versions.tf
@@ -5,6 +5,7 @@ terraform {
aws = ">= 3.22.0"
local = ">= 1.4"
random = ">= 2.1"
- kubernetes = "~> 1.11"
+ kubernetes = "~> 2.0"
}
}
+
diff --git a/examples/launch_templates_with_managed_node_groups/README.md b/examples/launch_templates_with_managed_node_groups/README.md
new file mode 100644
index 0000000000..e79ff558f9
--- /dev/null
+++ b/examples/launch_templates_with_managed_node_groups/README.md
@@ -0,0 +1,70 @@
+# Launch template with managed groups example
+
+This is EKS example using workers custom launch template with managed groups feature in two different ways:
+
+- Using a defined existing launch template created outside module
+- Using dlaunch template which will be created by module with user customization
+
+See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) for more details.
+
+## Usage
+
+To run this example you need to execute:
+
+```bash
+$ terraform init
+$ terraform plan
+$ terraform apply
+```
+
+Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 0.13.1 |
+| [aws](#requirement\_aws) | >= 3.22.0 |
+| [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
+| [local](#requirement\_local) | >= 1.4 |
+| [random](#requirement\_random) | >= 2.1 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 3.22.0 |
+| [random](#provider\_random) | >= 2.1 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| [eks](#module\_eks) | ../.. | |
+| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_service_linked_role.autoscaling](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
+| [aws_launch_template.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
+| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
+| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
+| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
+| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
+| [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
+
diff --git a/examples/launch_templates_with_managed_node_groups/launchtemplate.tf b/examples/launch_templates_with_managed_node_groups/launchtemplate.tf
index a2840ebc77..0f0e4ebf31 100644
--- a/examples/launch_templates_with_managed_node_groups/launchtemplate.tf
+++ b/examples/launch_templates_with_managed_node_groups/launchtemplate.tf
@@ -2,7 +2,7 @@
# template = file("${path.module}/templates/userdata.sh.tpl")
#
# vars = {
-# cluster_name = local.cluster_name
+# cluster_name = local.name
# endpoint = module.eks.cluster_endpoint
# cluster_auth_base64 = module.eks.cluster_certificate_authority_data
#
@@ -17,6 +17,7 @@
#
# Trivia: AWS transparently creates a copy of your LaunchTemplate and actually uses that copy then for the node group. If you DONT use a custom AMI,
# then the default user-data for bootstrapping a cluster is merged in the copy.
+
resource "aws_launch_template" "default" {
name_prefix = "eks-example-"
description = "Default Launch-Template"
@@ -59,22 +60,21 @@ resource "aws_launch_template" "default" {
# data.template_file.launch_template_userdata.rendered,
# )
-
# Supplying custom tags to EKS instances is another use-case for LaunchTemplates
tag_specifications {
resource_type = "instance"
tags = {
- CustomTag = "EKS example"
+ CustomTag = "Instance custom tag"
}
}
- # Supplying custom tags to EKS instances root volumes is another use-case for LaunchTemplates. (doesnt add tags to dynamically provisioned volumes via PVC tho)
+ # Supplying custom tags to EKS instances root volumes is another use-case for LaunchTemplates. (doesnt add tags to dynamically provisioned volumes via PVC)
tag_specifications {
resource_type = "volume"
tags = {
- CustomTag = "EKS example"
+ CustomTag = "Volume custom tag"
}
}
@@ -89,7 +89,7 @@ resource "aws_launch_template" "default" {
# Tag the LT itself
tags = {
- CustomTag = "EKS example"
+ CustomTag = "Launch template custom tag"
}
lifecycle {
diff --git a/examples/launch_templates_with_managed_node_groups/main.tf b/examples/launch_templates_with_managed_node_groups/main.tf
index 833b4b9f29..5d70e97615 100644
--- a/examples/launch_templates_with_managed_node_groups/main.tf
+++ b/examples/launch_templates_with_managed_node_groups/main.tf
@@ -1,7 +1,91 @@
provider "aws" {
- region = "eu-west-1"
+ region = local.region
}
+locals {
+ name = "lt_with_mng-${random_string.suffix.result}"
+ cluster_version = "1.20"
+ region = "eu-west-1"
+}
+
+################################################################################
+# EKS Module
+################################################################################
+
+module "eks" {
+ source = "../.."
+
+ cluster_name = local.name
+ cluster_version = local.cluster_version
+
+ vpc_id = module.vpc.vpc_id
+ subnets = module.vpc.private_subnets
+
+ cluster_endpoint_private_access = true
+ cluster_endpoint_public_access = true
+
+ node_groups = {
+ # use arleady defined launch template
+ example1 = {
+ name_prefix = "example1"
+ desired_capacity = 1
+ max_capacity = 15
+ min_capacity = 1
+
+ launch_template_id = aws_launch_template.default.id
+ launch_template_version = aws_launch_template.default.default_version
+
+ instance_types = ["t3.small"]
+
+ additional_tags = {
+ ExtraTag = "example1"
+ }
+ }
+ # create launch template
+ example2 = {
+ create_launch_template = true
+ desired_capacity = 1
+ max_capacity = 10
+ min_capacity = 1
+
+ disk_size = 50
+ disk_type = "gp3"
+ disk_throughput = 150
+ disk_iops = 3000
+
+ instance_types = ["t3.large"]
+ capacity_type = "SPOT"
+ k8s_labels = {
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+ additional_tags = {
+ ExtraTag = "example2"
+ }
+ taints = [
+ {
+ key = "dedicated"
+ value = "gpuGroup"
+ effect = "NO_SCHEDULE"
+ }
+ ]
+ update_config = {
+ max_unavailable_percentage = 50 # or set `max_unavailable`
+ }
+ }
+ }
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
+################################################################################
+# Kubernetes provider configuration
+################################################################################
+
data "aws_eks_cluster" "cluster" {
name = module.eks.cluster_id
}
@@ -16,11 +100,11 @@ provider "kubernetes" {
token = data.aws_eks_cluster_auth.cluster.token
}
-data "aws_availability_zones" "available" {
-}
+################################################################################
+# Supporting Resources
+################################################################################
-locals {
- cluster_name = "test-eks-lt-${random_string.suffix.result}"
+data "aws_availability_zones" "available" {
}
resource "random_string" "suffix" {
@@ -30,43 +114,30 @@ resource "random_string" "suffix" {
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
- version = "~> 2.47"
+ version = "~> 3.0"
- name = "test-vpc"
- cidr = "172.16.0.0/16"
+ name = local.name
+ cidr = "10.0.0.0/16"
azs = data.aws_availability_zones.available.names
- private_subnets = ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"]
- public_subnets = ["172.16.4.0/24", "172.16.5.0/24", "172.16.6.0/24"]
+ private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+ public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
enable_nat_gateway = true
single_nat_gateway = true
enable_dns_hostnames = true
- private_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared" # EKS adds this and TF would want to remove then later
+ public_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/elb" = "1"
}
-}
-
-module "eks" {
- source = "../.."
- cluster_name = local.cluster_name
- cluster_version = "1.20"
- subnets = module.vpc.private_subnets
- vpc_id = module.vpc.vpc_id
-
- node_groups = {
- example = {
- desired_capacity = 1
- max_capacity = 15
- min_capacity = 1
-
- launch_template_id = aws_launch_template.default.id
- launch_template_version = aws_launch_template.default.default_version
- instance_types = var.instance_types
+ private_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/internal-elb" = "1"
+ }
- additional_tags = {
- CustomTag = "EKS example"
- }
- }
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
}
}
diff --git a/examples/launch_templates_with_managed_node_groups/variables.tf b/examples/launch_templates_with_managed_node_groups/variables.tf
index 9bd936c6f8..e69de29bb2 100644
--- a/examples/launch_templates_with_managed_node_groups/variables.tf
+++ b/examples/launch_templates_with_managed_node_groups/variables.tf
@@ -1,6 +0,0 @@
-variable "instance_types" {
- description = "Instance types"
- # Smallest recommended, where ~1.1Gb of 2Gb memory is available for the Kubernetes pods after ‘warming up’ Docker, Kubelet, and OS
- type = list(string)
- default = ["t3.small"]
-}
diff --git a/examples/launch_templates_with_managed_node_groups/versions.tf b/examples/launch_templates_with_managed_node_groups/versions.tf
index 6e29ae8f1b..bbcf893252 100644
--- a/examples/launch_templates_with_managed_node_groups/versions.tf
+++ b/examples/launch_templates_with_managed_node_groups/versions.tf
@@ -5,6 +5,6 @@ terraform {
aws = ">= 3.22.0"
local = ">= 1.4"
random = ">= 2.1"
- kubernetes = "~> 1.11"
+ kubernetes = "~> 2.0"
}
}
diff --git a/examples/managed_node_groups/README.md b/examples/managed_node_groups/README.md
new file mode 100644
index 0000000000..8cc2ecd8ae
--- /dev/null
+++ b/examples/managed_node_groups/README.md
@@ -0,0 +1,73 @@
+# Managed groups example
+
+This is EKS example using managed groups feature in two different ways:
+
+- Using SPOT instances in node group
+- Using ON_DEMAND instance in node group
+
+See [the official documentation](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) for more details.
+
+## Usage
+
+To run this example you need to execute:
+
+```bash
+$ terraform init
+$ terraform plan
+$ terraform apply
+```
+
+Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 0.13.1 |
+| [aws](#requirement\_aws) | >= 3.22.0 |
+| [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
+| [local](#requirement\_local) | >= 1.4 |
+| [random](#requirement\_random) | >= 2.1 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 3.22.0 |
+| [random](#provider\_random) | >= 2.1 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| [eks](#module\_eks) | ../.. | |
+| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
+| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. | `list(string)` | [
"777777777777",
"888888888888"
]
| no |
+| [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. | list(object({
rolearn = string
username = string
groups = list(string)
})) | [
{
"groups": [
"system:masters"
],
"rolearn": "arn:aws:iam::66666666666:role/role1",
"username": "role1"
}
]
| no |
+| [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. | list(object({
userarn = string
username = string
groups = list(string)
})) | [
{
"groups": [
"system:masters"
],
"userarn": "arn:aws:iam::66666666666:user/user1",
"username": "user1"
},
{
"groups": [
"system:masters"
],
"userarn": "arn:aws:iam::66666666666:user/user2",
"username": "user2"
}
]
| no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
+| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
+| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
+| [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
+| [node\_groups](#output\_node\_groups) | Outputs from node groups |
+
diff --git a/examples/managed_node_groups/main.tf b/examples/managed_node_groups/main.tf
index 99cc1fd730..56a2b05346 100644
--- a/examples/managed_node_groups/main.tf
+++ b/examples/managed_node_groups/main.tf
@@ -1,70 +1,28 @@
provider "aws" {
- region = "eu-west-1"
-}
-
-data "aws_eks_cluster" "cluster" {
- name = module.eks.cluster_id
-}
-
-data "aws_eks_cluster_auth" "cluster" {
- name = module.eks.cluster_id
-}
-
-provider "kubernetes" {
- host = data.aws_eks_cluster.cluster.endpoint
- cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
- token = data.aws_eks_cluster_auth.cluster.token
-}
-
-data "aws_availability_zones" "available" {
+ region = local.region
}
locals {
- cluster_name = "test-eks-${random_string.suffix.result}"
-}
-
-resource "random_string" "suffix" {
- length = 8
- special = false
+ name = "managed_node_groups-${random_string.suffix.result}"
+ cluster_version = "1.20"
+ region = "eu-west-1"
}
-module "vpc" {
- source = "terraform-aws-modules/vpc/aws"
- version = "~> 2.47"
-
- name = "test-vpc"
- cidr = "172.16.0.0/16"
- azs = data.aws_availability_zones.available.names
- private_subnets = ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"]
- public_subnets = ["172.16.4.0/24", "172.16.5.0/24", "172.16.6.0/24"]
- enable_nat_gateway = true
- single_nat_gateway = true
- enable_dns_hostnames = true
-
- public_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared"
- "kubernetes.io/role/elb" = "1"
- }
-
- private_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared"
- "kubernetes.io/role/internal-elb" = "1"
- }
-}
+################################################################################
+# EKS Module
+################################################################################
module "eks" {
- source = "../.."
- cluster_name = local.cluster_name
- cluster_version = "1.20"
- subnets = module.vpc.private_subnets
+ source = "../.."
- tags = {
- Environment = "test"
- GithubRepo = "terraform-aws-eks"
- GithubOrg = "terraform-aws-modules"
- }
+ cluster_name = local.name
+ cluster_version = local.cluster_version
+
+ vpc_id = module.vpc.vpc_id
+ subnets = module.vpc.private_subnets
- vpc_id = module.vpc.vpc_id
+ cluster_endpoint_private_access = true
+ cluster_endpoint_public_access = true
node_groups_defaults = {
ami_type = "AL2_x86_64"
@@ -73,23 +31,16 @@ module "eks" {
node_groups = {
example = {
- create_launch_template = true
-
desired_capacity = 1
max_capacity = 10
min_capacity = 1
- disk_size = 50
- disk_type = "gp3"
- disk_throughput = 150
- disk_iops = 3000
-
instance_types = ["t3.large"]
capacity_type = "SPOT"
k8s_labels = {
- Environment = "test"
- GithubRepo = "terraform-aws-eks"
- GithubOrg = "terraform-aws-modules"
+ Example = "managed_node_groups"
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
}
additional_tags = {
ExtraTag = "example"
@@ -105,24 +56,93 @@ module "eks" {
max_unavailable_percentage = 50 # or set `max_unavailable`
}
}
- }
-
- # Create security group rules to allow communication between pods on workers and pods in managed node groups.
- # Set this to true if you have AWS-Managed node groups and Self-Managed worker groups.
- # See https://github.com/terraform-aws-modules/terraform-aws-eks/issues/1089
-
- # worker_create_cluster_primary_security_group_rules = true
+ example2 = {
+ desired_capacity = 1
+ max_capacity = 10
+ min_capacity = 1
- # worker_groups_launch_template = [
- # {
- # name = "worker-group-1"
- # instance_type = "t3.small"
- # asg_desired_capacity = 2
- # public_ip = true
- # }
- # ]
+ instance_types = ["t3.medium"]
+ k8s_labels = {
+ Example = "managed_node_groups"
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+ additional_tags = {
+ ExtraTag = "example2"
+ }
+ update_config = {
+ max_unavailable_percentage = 50 # or set `max_unavailable`
+ }
+ }
+ }
map_roles = var.map_roles
map_users = var.map_users
map_accounts = var.map_accounts
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
+################################################################################
+# Kubernetes provider configuration
+################################################################################
+
+data "aws_eks_cluster" "cluster" {
+ name = module.eks.cluster_id
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+ name = module.eks.cluster_id
+}
+
+provider "kubernetes" {
+ host = data.aws_eks_cluster.cluster.endpoint
+ cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+ token = data.aws_eks_cluster_auth.cluster.token
+}
+
+################################################################################
+# Supporting Resources
+################################################################################
+
+data "aws_availability_zones" "available" {
+}
+
+resource "random_string" "suffix" {
+ length = 8
+ special = false
+}
+
+module "vpc" {
+ source = "terraform-aws-modules/vpc/aws"
+ version = "~> 3.0"
+
+ name = local.name
+ cidr = "10.0.0.0/16"
+ azs = data.aws_availability_zones.available.names
+ private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+ public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+ enable_nat_gateway = true
+ single_nat_gateway = true
+ enable_dns_hostnames = true
+
+ public_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/elb" = "1"
+ }
+
+ private_subnet_tags = {
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/internal-elb" = "1"
+ }
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
}
diff --git a/examples/managed_node_groups/versions.tf b/examples/managed_node_groups/versions.tf
index 47f7c05e43..bbcf893252 100644
--- a/examples/managed_node_groups/versions.tf
+++ b/examples/managed_node_groups/versions.tf
@@ -2,9 +2,9 @@ terraform {
required_version = ">= 0.13.1"
required_providers {
- aws = ">= 3.56.0"
+ aws = ">= 3.22.0"
local = ">= 1.4"
random = ">= 2.1"
- kubernetes = "~> 1.11"
+ kubernetes = "~> 2.0"
}
}
diff --git a/examples/secrets_encryption/README.md b/examples/secrets_encryption/README.md
new file mode 100644
index 0000000000..c3ee731f2a
--- /dev/null
+++ b/examples/secrets_encryption/README.md
@@ -0,0 +1,66 @@
+# Managed groups example
+
+This is EKS using [secrets encryption](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) feature.
+
+See [the official blog](https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/) for more details.
+
+## Usage
+
+To run this example you need to execute:
+
+```bash
+$ terraform init
+$ terraform plan
+$ terraform apply
+```
+
+Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 0.13.1 |
+| [aws](#requirement\_aws) | >= 3.22.0 |
+| [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
+| [local](#requirement\_local) | >= 1.4 |
+| [random](#requirement\_random) | >= 2.1 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 3.22.0 |
+| [random](#provider\_random) | >= 2.1 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| [eks](#module\_eks) | ../.. | |
+| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
+| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
+| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for EKS control plane. |
+| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ids attached to the cluster control plane. |
+| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
+| [kubectl\_config](#output\_kubectl\_config) | kubectl config as generated by the module. |
+
diff --git a/examples/secrets_encryption/main.tf b/examples/secrets_encryption/main.tf
index 76fa2b2392..49d9a7b029 100644
--- a/examples/secrets_encryption/main.tf
+++ b/examples/secrets_encryption/main.tf
@@ -1,7 +1,57 @@
provider "aws" {
- region = "eu-west-1"
+ region = local.region
}
+locals {
+ name = "secrets_encryption-${random_string.suffix.result}"
+ cluster_version = "1.20"
+ region = "eu-west-1"
+}
+
+################################################################################
+# EKS Module
+################################################################################
+
+module "eks" {
+ source = "../.."
+
+ cluster_name = local.name
+ cluster_version = local.cluster_version
+
+ vpc_id = module.vpc.vpc_id
+ subnets = module.vpc.private_subnets
+
+ cluster_endpoint_private_access = true
+ cluster_endpoint_public_access = true
+
+
+ cluster_encryption_config = [
+ {
+ provider_key_arn = aws_kms_key.eks.arn
+ resources = ["secrets"]
+ }
+ ]
+
+ worker_groups = [
+ {
+ name = "worker-group-1"
+ instance_type = "t3.small"
+ additional_userdata = "echo foo bar"
+ asg_desired_capacity = 2
+ },
+ ]
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
+}
+
+################################################################################
+# Kubernetes provider configuration
+################################################################################
+
data "aws_eks_cluster" "cluster" {
name = module.eks.cluster_id
}
@@ -16,11 +66,28 @@ provider "kubernetes" {
token = data.aws_eks_cluster_auth.cluster.token
}
-data "aws_availability_zones" "available" {
+################################################################################
+# KMS for encrypting secrets
+################################################################################
+
+resource "aws_kms_key" "eks" {
+ description = "EKS Secret Encryption Key"
+ deletion_window_in_days = 7
+ enable_key_rotation = true
+
+ tags = {
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
+ }
}
-locals {
- cluster_name = "test-eks-${random_string.suffix.result}"
+
+################################################################################
+# Supporting Resources
+################################################################################
+
+data "aws_availability_zones" "available" {
}
resource "random_string" "suffix" {
@@ -28,15 +95,11 @@ resource "random_string" "suffix" {
special = false
}
-resource "aws_kms_key" "eks" {
- description = "EKS Secret Encryption Key"
-}
-
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
- version = "~> 2.47"
+ version = "~> 3.0"
- name = "test-vpc"
+ name = local.name
cidr = "10.0.0.0/16"
azs = data.aws_availability_zones.available.names
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
@@ -46,47 +109,18 @@ module "vpc" {
enable_dns_hostnames = true
public_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared"
- "kubernetes.io/role/elb" = "1"
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/elb" = "1"
}
private_subnet_tags = {
- "kubernetes.io/cluster/${local.cluster_name}" = "shared"
- "kubernetes.io/role/internal-elb" = "1"
+ "kubernetes.io/cluster/${local.name}" = "shared"
+ "kubernetes.io/role/internal-elb" = "1"
}
-}
-
-module "eks" {
- source = "../.."
- cluster_name = local.cluster_name
- cluster_version = "1.20"
- subnets = module.vpc.private_subnets
-
- cluster_encryption_config = [
- {
- provider_key_arn = aws_kms_key.eks.arn
- resources = ["secrets"]
- }
- ]
tags = {
- Environment = "test"
- GithubRepo = "terraform-aws-eks"
- GithubOrg = "terraform-aws-modules"
+ Example = local.name
+ GithubRepo = "terraform-aws-eks"
+ GithubOrg = "terraform-aws-modules"
}
-
- vpc_id = module.vpc.vpc_id
-
- worker_groups = [
- {
- name = "worker-group-1"
- instance_type = "t3.small"
- additional_userdata = "echo foo bar"
- asg_desired_capacity = 2
- },
- ]
-
- map_roles = var.map_roles
- map_users = var.map_users
- map_accounts = var.map_accounts
}
diff --git a/examples/secrets_encryption/variables.tf b/examples/secrets_encryption/variables.tf
index 57853d8b4d..e69de29bb2 100644
--- a/examples/secrets_encryption/variables.tf
+++ b/examples/secrets_encryption/variables.tf
@@ -1,48 +0,0 @@
-variable "map_accounts" {
- description = "Additional AWS account numbers to add to the aws-auth configmap."
- type = list(string)
-
- default = [
- "777777777777",
- "888888888888",
- ]
-}
-
-variable "map_roles" {
- description = "Additional IAM roles to add to the aws-auth configmap."
- type = list(object({
- rolearn = string
- username = string
- groups = list(string)
- }))
-
- default = [
- {
- rolearn = "arn:aws:iam::66666666666:role/role1"
- username = "role1"
- groups = ["system:masters"]
- },
- ]
-}
-
-variable "map_users" {
- description = "Additional IAM users to add to the aws-auth configmap."
- type = list(object({
- userarn = string
- username = string
- groups = list(string)
- }))
-
- default = [
- {
- userarn = "arn:aws:iam::66666666666:user/user1"
- username = "user1"
- groups = ["system:masters"]
- },
- {
- userarn = "arn:aws:iam::66666666666:user/user2"
- username = "user2"
- groups = ["system:masters"]
- },
- ]
-}
diff --git a/examples/secrets_encryption/versions.tf b/examples/secrets_encryption/versions.tf
index 120d873e2f..bbcf893252 100644
--- a/examples/secrets_encryption/versions.tf
+++ b/examples/secrets_encryption/versions.tf
@@ -5,6 +5,6 @@ terraform {
aws = ">= 3.22.0"
local = ">= 1.4"
random = ">= 2.1"
- kubernetes = ">= 1.11"
+ kubernetes = "~> 2.0"
}
}
diff --git a/variables.tf b/variables.tf
index a5d9adefe3..a830e20a62 100644
--- a/variables.tf
+++ b/variables.tf
@@ -71,13 +71,13 @@ variable "aws_auth_additional_labels" {
}
variable "map_accounts" {
- description = "Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format."
+ description = "Additional AWS account numbers to add to the aws-auth configmap."
type = list(string)
default = []
}
variable "map_roles" {
- description = "Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format."
+ description = "Additional IAM roles to add to the aws-auth configmap."
type = list(object({
rolearn = string
username = string
@@ -87,7 +87,7 @@ variable "map_roles" {
}
variable "map_users" {
- description = "Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format."
+ description = "Additional IAM users to add to the aws-auth configmap."
type = list(object({
userarn = string
username = string