mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-09 00:09:43 +00:00
Add local example for empty EKS Cluster
This commit is contained in:
Rodrigue Koffi
@@ -0,0 +1,99 @@
|
||||
# EKS Cluster Deployment with new VPC
|
||||
|
||||
Note: This example is a subset from [this EKS Blueprint example](https://github.com/aws-ia/terraform-aws-eks-blueprints/tree/main/examples/eks-cluster-with-new-vpc)
|
||||
|
||||
This example deploys the following Basic EKS Cluster with VPC
|
||||
|
||||
- Creates a new sample VPC, 3 Private Subnets and 3 Public Subnets
|
||||
- Creates Internet gateway for Public Subnets and NAT Gateway for Private Subnets
|
||||
- Creates EKS Cluster Control plane with one managed node group
|
||||
|
||||
## How to Deploy
|
||||
|
||||
### Prerequisites
|
||||
|
||||
Ensure that you have installed the following tools in your Mac or Windows Laptop before start working with this module and run Terraform Plan and Apply
|
||||
|
||||
1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
|
||||
2. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
|
||||
3. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
|
||||
|
||||
### Minimum IAM Policy
|
||||
|
||||
> **Note**: The policy resource is set as `*` to allow all resources, this is not a recommended practice.
|
||||
|
||||
You can find the policy [here](min-iam-policy.json)
|
||||
|
||||
|
||||
### Deployment Steps
|
||||
|
||||
#### Step 1: Clone the repo using the command below
|
||||
|
||||
```sh
|
||||
git clone https://github.com/aws-observability/terraform-aws-observability-accelerator.git
|
||||
```
|
||||
|
||||
#### Step 2: Run Terraform INIT
|
||||
|
||||
Initialize a working directory with configuration files
|
||||
|
||||
```sh
|
||||
cd examples/eks-cluster-with-vpc/
|
||||
terraform init
|
||||
```
|
||||
|
||||
#### Step 3: Run Terraform PLAN
|
||||
|
||||
Verify the resources created by this execution
|
||||
|
||||
```sh
|
||||
export TF_VAR_aws_region=<ENTER YOUR REGION> # Select your own region
|
||||
terraform plan
|
||||
```
|
||||
|
||||
#### Step 4: Finally, Terraform APPLY
|
||||
|
||||
**Deploy the pattern**
|
||||
|
||||
```sh
|
||||
terraform apply
|
||||
```
|
||||
|
||||
Enter `yes` to apply.
|
||||
|
||||
### Configure `kubectl` and test cluster
|
||||
|
||||
EKS Cluster details can be extracted from terraform output or from AWS Console to get the name of cluster.
|
||||
This following command used to update the `kubeconfig` in your local machine where you run kubectl commands to interact with your EKS Cluster.
|
||||
|
||||
#### Step 5: Run `update-kubeconfig` command
|
||||
|
||||
`~/.kube/config` file gets updated with cluster details and certificate from the below command
|
||||
|
||||
aws eks --region <enter-your-region> update-kubeconfig --name <cluster-name>
|
||||
|
||||
#### Step 6: List all the worker nodes by running the command below
|
||||
|
||||
kubectl get nodes
|
||||
|
||||
#### Step 7: List all the pods running in `kube-system` namespace
|
||||
|
||||
kubectl get pods -n kube-system
|
||||
|
||||
## Cleanup
|
||||
|
||||
To clean up your environment, destroy the Terraform modules in reverse order.
|
||||
|
||||
Destroy the Kubernetes Add-ons, EKS cluster with Node groups and VPC
|
||||
|
||||
```sh
|
||||
terraform destroy -target="module.eks_blueprints_kubernetes_addons" -auto-approve
|
||||
terraform destroy -target="module.eks_blueprints" -auto-approve
|
||||
terraform destroy -target="module.vpc" -auto-approve
|
||||
```
|
||||
|
||||
Finally, destroy any additional resources that are not in the above modules
|
||||
|
||||
```sh
|
||||
terraform destroy -auto-approve
|
||||
```
|
||||
@@ -0,0 +1,119 @@
|
||||
provider "aws" {
|
||||
region = local.region
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = module.eks_blueprints.eks_cluster_endpoint
|
||||
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
|
||||
provider "helm" {
|
||||
kubernetes {
|
||||
host = module.eks_blueprints.eks_cluster_endpoint
|
||||
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
|
||||
token = data.aws_eks_cluster_auth.this.token
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_eks_cluster_auth" "this" {
|
||||
name = module.eks_blueprints.eks_cluster_id
|
||||
}
|
||||
|
||||
data "aws_availability_zones" "available" {}
|
||||
|
||||
locals {
|
||||
name = basename(path.cwd)
|
||||
cluster_name = coalesce(var.cluster_name, local.name)
|
||||
region = var.aws_region
|
||||
|
||||
vpc_cidr = "10.0.0.0/16"
|
||||
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||
|
||||
tags = {
|
||||
Blueprint = local.name
|
||||
GithubRepo = "github.com/aws-observability/terraform-aws-observability-accelerator"
|
||||
}
|
||||
}
|
||||
|
||||
#---------------------------------------------------------------
|
||||
# EKS Blueprints
|
||||
#---------------------------------------------------------------
|
||||
|
||||
module "eks_blueprints" {
|
||||
source = "github.com/aws-ia/terraform-aws-eks-blueprints"
|
||||
|
||||
cluster_name = local.cluster_name
|
||||
cluster_version = "1.23"
|
||||
|
||||
vpc_id = module.vpc.vpc_id
|
||||
private_subnet_ids = module.vpc.private_subnets
|
||||
|
||||
managed_node_groups = {
|
||||
mg_5 = {
|
||||
node_group_name = "managed-ondemand"
|
||||
instance_types = ["m5.large"]
|
||||
min_size = 2
|
||||
subnet_ids = module.vpc.private_subnets
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
module "eks_blueprints_kubernetes_addons" {
|
||||
source = "github.com/aws-ia/terraform-aws-eks-blueprints/modules/kubernetes-addons"
|
||||
|
||||
eks_cluster_id = module.eks_blueprints.eks_cluster_id
|
||||
eks_cluster_endpoint = module.eks_blueprints.eks_cluster_endpoint
|
||||
eks_oidc_provider = module.eks_blueprints.oidc_provider
|
||||
eks_cluster_version = module.eks_blueprints.eks_cluster_version
|
||||
|
||||
# EKS Managed Add-ons
|
||||
enable_amazon_eks_vpc_cni = true
|
||||
enable_amazon_eks_coredns = true
|
||||
enable_amazon_eks_kube_proxy = true
|
||||
enable_amazon_eks_aws_ebs_csi_driver = true
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
#---------------------------------------------------------------
|
||||
# Supporting Resources
|
||||
#---------------------------------------------------------------
|
||||
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
name = local.name
|
||||
cidr = local.vpc_cidr
|
||||
|
||||
azs = local.azs
|
||||
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
|
||||
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 10)]
|
||||
|
||||
enable_nat_gateway = true
|
||||
single_nat_gateway = true
|
||||
enable_dns_hostnames = true
|
||||
|
||||
# Manage so we can name
|
||||
manage_default_network_acl = true
|
||||
default_network_acl_tags = { Name = "${local.name}-default" }
|
||||
manage_default_route_table = true
|
||||
default_route_table_tags = { Name = "${local.name}-default" }
|
||||
manage_default_security_group = true
|
||||
default_security_group_tags = { Name = "${local.name}-default" }
|
||||
|
||||
public_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
|
||||
"kubernetes.io/role/elb" = 1
|
||||
}
|
||||
|
||||
private_subnet_tags = {
|
||||
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
|
||||
"kubernetes.io/role/internal-elb" = 1
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -0,0 +1,105 @@
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:AllocateAddress",
|
||||
"ec2:AssociateRouteTable",
|
||||
"ec2:AttachInternetGateway",
|
||||
"ec2:AuthorizeSecurityGroupEgress",
|
||||
"ec2:AuthorizeSecurityGroupIngress",
|
||||
"ec2:CreateInternetGateway",
|
||||
"ec2:CreateNatGateway",
|
||||
"ec2:CreateNetworkAclEntry",
|
||||
"ec2:CreateRoute",
|
||||
"ec2:CreateRouteTable",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:CreateSubnet",
|
||||
"ec2:CreateTags",
|
||||
"ec2:CreateVpc",
|
||||
"ec2:DeleteInternetGateway",
|
||||
"ec2:DeleteNatGateway",
|
||||
"ec2:DeleteNetworkAclEntry",
|
||||
"ec2:DeleteRoute",
|
||||
"ec2:DeleteRouteTable",
|
||||
"ec2:DeleteSecurityGroup",
|
||||
"ec2:DeleteSubnet",
|
||||
"ec2:DeleteTags",
|
||||
"ec2:DeleteVpc",
|
||||
"ec2:DescribeAccountAttributes",
|
||||
"ec2:DescribeAddresses",
|
||||
"ec2:DescribeAvailabilityZones",
|
||||
"ec2:DescribeInternetGateways",
|
||||
"ec2:DescribeNatGateways",
|
||||
"ec2:DescribeNetworkAcls",
|
||||
"ec2:DescribeNetworkInterfaces",
|
||||
"ec2:DescribeRouteTables",
|
||||
"ec2:DescribeSecurityGroups",
|
||||
"ec2:DescribeSubnets",
|
||||
"ec2:DescribeTags",
|
||||
"ec2:DescribeVpcAttribute",
|
||||
"ec2:DescribeVpcClassicLink",
|
||||
"ec2:DescribeVpcClassicLinkDnsSupport",
|
||||
"ec2:DescribeVpcs",
|
||||
"ec2:DetachInternetGateway",
|
||||
"ec2:DisassociateRouteTable",
|
||||
"ec2:ModifySubnetAttribute",
|
||||
"ec2:ModifyVpcAttribute",
|
||||
"ec2:ReleaseAddress",
|
||||
"ec2:RevokeSecurityGroupEgress",
|
||||
"ec2:RevokeSecurityGroupIngress",
|
||||
"eks:CreateAddon",
|
||||
"eks:CreateCluster",
|
||||
"eks:CreateNodegroup",
|
||||
"eks:DeleteAddon",
|
||||
"eks:DeleteCluster",
|
||||
"eks:DeleteNodegroup",
|
||||
"eks:DescribeAddon",
|
||||
"eks:DescribeAddonVersions",
|
||||
"eks:DescribeCluster",
|
||||
"eks:DescribeNodegroup",
|
||||
"iam:AddRoleToInstanceProfile",
|
||||
"iam:AttachRolePolicy",
|
||||
"iam:CreateInstanceProfile",
|
||||
"iam:CreateOpenIDConnectProvider",
|
||||
"iam:CreatePolicy",
|
||||
"iam:CreateRole",
|
||||
"iam:CreateServiceLinkedRole",
|
||||
"iam:DeleteInstanceProfile",
|
||||
"iam:DeleteOpenIDConnectProvider",
|
||||
"iam:DeletePolicy",
|
||||
"iam:DeleteRole",
|
||||
"iam:DetachRolePolicy",
|
||||
"iam:GetInstanceProfile",
|
||||
"iam:GetOpenIDConnectProvider",
|
||||
"iam:GetPolicy",
|
||||
"iam:GetPolicyVersion",
|
||||
"iam:GetRole",
|
||||
"iam:ListAttachedRolePolicies",
|
||||
"iam:ListInstanceProfilesForRole",
|
||||
"iam:ListPolicyVersions",
|
||||
"iam:ListRolePolicies",
|
||||
"iam:PassRole",
|
||||
"iam:RemoveRoleFromInstanceProfile",
|
||||
"iam:TagInstanceProfile",
|
||||
"kms:CreateAlias",
|
||||
"kms:CreateKey",
|
||||
"kms:DeleteAlias",
|
||||
"kms:DescribeKey",
|
||||
"kms:EnableKeyRotation",
|
||||
"kms:GetKeyPolicy",
|
||||
"kms:GetKeyRotationStatus",
|
||||
"kms:ListAliases",
|
||||
"kms:ListResourceTags",
|
||||
"kms:PutKeyPolicy",
|
||||
"kms:ScheduleKeyDeletion",
|
||||
"kms:TagResource",
|
||||
"s3:GetObject",
|
||||
"s3:ListBucket",
|
||||
"s3:PutObject"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
output "vpc_private_subnet_cidr" {
|
||||
description = "VPC private subnet CIDR"
|
||||
value = module.vpc.private_subnets_cidr_blocks
|
||||
}
|
||||
|
||||
output "vpc_public_subnet_cidr" {
|
||||
description = "VPC public subnet CIDR"
|
||||
value = module.vpc.public_subnets_cidr_blocks
|
||||
}
|
||||
|
||||
output "vpc_cidr" {
|
||||
description = "VPC CIDR"
|
||||
value = module.vpc.vpc_cidr_block
|
||||
}
|
||||
|
||||
output "eks_cluster_id" {
|
||||
description = "EKS cluster ID"
|
||||
value = module.eks_blueprints.eks_cluster_id
|
||||
}
|
||||
|
||||
output "eks_managed_nodegroups" {
|
||||
description = "EKS managed node groups"
|
||||
value = module.eks_blueprints.managed_node_groups
|
||||
}
|
||||
|
||||
output "eks_managed_nodegroup_ids" {
|
||||
description = "EKS managed node group ids"
|
||||
value = module.eks_blueprints.managed_node_groups_id
|
||||
}
|
||||
|
||||
output "eks_managed_nodegroup_arns" {
|
||||
description = "EKS managed node group arns"
|
||||
value = module.eks_blueprints.managed_node_group_arn
|
||||
}
|
||||
|
||||
output "eks_managed_nodegroup_role_name" {
|
||||
description = "EKS managed node group role name"
|
||||
value = module.eks_blueprints.managed_node_group_iam_role_names
|
||||
}
|
||||
|
||||
output "eks_managed_nodegroup_status" {
|
||||
description = "EKS managed node group status"
|
||||
value = module.eks_blueprints.managed_node_groups_status
|
||||
}
|
||||
|
||||
output "configure_kubectl" {
|
||||
description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
|
||||
value = module.eks_blueprints.configure_kubectl
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
variable "cluster_name" {
|
||||
description = "Name of cluster - used by Terratest for e2e test automation"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
variable "aws_region" {
|
||||
description = "AWS Region"
|
||||
type = string
|
||||
}
|
||||
Reference in New Issue
Block a user