Skip to content
This repository was archived by the owner on Sep 27, 2024. It is now read-only.

Commit d935f2c

Browse files
UncleGeddUncleGedd
committed
initial migration from batcave-landing-zone
0 parents  commit d935f2c

File tree

8 files changed

+319
-0
lines changed

8 files changed

+319
-0
lines changed

‎iam.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
################################################################################
2+
# AWS Identity and Access Management
3+
################################################################################
4+
5+
resource "aws_iam_policy" "ssm_managed_instance" {
6+
name = "karpenter-ssm-policy-${var.cluster_name}"
7+
path = var.iam_path
8+
policy = jsonencode({
9+
Version = "2012-10-17",
10+
Statement = [
11+
{
12+
Effect = "Allow",
13+
Action = [
14+
"ssm:DescribeAssociation",
15+
"ssm:GetDeployablePatchSnapshotForInstance",
16+
"ssm:GetDocument",
17+
"ssm:DescribeDocument",
18+
"ssm:GetManifest",
19+
"ssm:GetParameter",
20+
"ssm:GetParameters",
21+
"ssm:ListAssociations",
22+
"ssm:ListInstanceAssociations",
23+
"ssm:PutInventory",
24+
"ssm:PutComplianceItems",
25+
"ssm:PutConfigurePackageResult",
26+
"ssm:UpdateAssociationStatus",
27+
"ssm:UpdateInstanceAssociationStatus",
28+
"ssm:UpdateInstanceInformation"
29+
],
30+
Resource = "*"
31+
},
32+
{
33+
Effect = "Allow",
34+
Action = [
35+
"ssmmessages:CreateControlChannel",
36+
"ssmmessages:CreateDataChannel",
37+
"ssmmessages:OpenControlChannel",
38+
"ssmmessages:OpenDataChannel"
39+
],
40+
Resource = "*"
41+
},
42+
{
43+
Effect = "Allow",
44+
Action = [
45+
"ec2messages:AcknowledgeMessage",
46+
"ec2messages:DeleteMessage",
47+
"ec2messages:FailMessage",
48+
"ec2messages:GetEndpoint",
49+
"ec2messages:GetMessages",
50+
"ec2messages:SendReply"
51+
],
52+
Resource = "*"
53+
}
54+
]
55+
})
56+
}
57+
58+
resource "aws_iam_role_policy_attachment" "karpenter_ssm_policy" {
59+
role = var.worker_iam_role_name
60+
policy_arn = aws_iam_policy.ssm_managed_instance.arn
61+
}
62+
63+
resource "aws_iam_instance_profile" "karpenter" {
64+
name = "KarpenterNodeInstanceProfile-${var.cluster_name}"
65+
role = var.worker_iam_role_name
66+
path = "/delegatedadmin/developer/"
67+
}
68+
69+
module "iam_assumable_role_karpenter" {
70+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
71+
version = "4.7.0"
72+
create_role = true
73+
role_name = "karpenter-controller-${var.cluster_name}"
74+
provider_url = var.provider_url
75+
role_path = var.iam_path
76+
role_permissions_boundary_arn = var.permissions_boundary
77+
oidc_fully_qualified_subjects = ["system:serviceaccount:karpenter:karpenter"]
78+
}
79+
80+
resource "aws_iam_policy" "karpenter_contoller" {
81+
name = "karpenter-policy-${var.cluster_name}"
82+
path = var.iam_path
83+
policy = jsonencode({
84+
Version = "2012-10-17"
85+
Statement = [
86+
{
87+
Action = [
88+
"ec2:CreateLaunchTemplate",
89+
"ec2:CreateFleet",
90+
"ec2:RunInstances",
91+
"ec2:CreateTags",
92+
"iam:PassRole",
93+
"ec2:TerminateInstances",
94+
"ec2:DescribeLaunchTemplates",
95+
"ec2:DescribeInstances",
96+
"ec2:DescribeSecurityGroups",
97+
"ec2:DescribeSubnets",
98+
"ec2:DescribeInstanceTypes",
99+
"ec2:DescribeInstanceTypeOfferings",
100+
"ec2:DescribeAvailabilityZones",
101+
"ssm:GetParameter"
102+
]
103+
Effect = "Allow"
104+
Resource = "*"
105+
},
106+
]
107+
})
108+
}
109+
110+
resource "aws_iam_role_policy_attachment" "karpenter_contoller_policy_attachment" {
111+
role = module.iam_assumable_role_karpenter.iam_role_name
112+
policy_arn = aws_iam_policy.karpenter_contoller.arn
113+
}

‎karpenter.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
################################################################################
2+
# Helm Release - Karpenter
3+
################################################################################
4+
data "aws_eks_cluster" "cluster" {
5+
name = var.cluster_name
6+
}
7+
8+
provider "helm" {
9+
kubernetes {
10+
host = data.aws_eks_cluster.cluster.endpoint
11+
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
12+
exec {
13+
api_version = "client.authentication.k8s.io/v1alpha1"
14+
args = ["eks", "get-token", "--cluster-name", data.aws_eks_cluster.cluster.name]
15+
command = "aws"
16+
}
17+
}
18+
}
19+
20+
resource "helm_release" "karpenter" {
21+
namespace = var.helm_namespace
22+
create_namespace = var.helm_create_namespace
23+
24+
name = "karpenter"
25+
repository = "https://charts.karpenter.sh"
26+
chart = "karpenter"
27+
version = "0.6.1"
28+
29+
values = [
30+
"${file("values.yaml")}"
31+
]
32+
set {
33+
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
34+
value = module.iam_assumable_role_karpenter.iam_role_arn
35+
}
36+
37+
set {
38+
name = "controller.clusterName"
39+
value = var.cluster_name
40+
}
41+
42+
set {
43+
name = "controller.clusterEndpoint"
44+
value = var.cluster_endpoint
45+
}
46+
}
47+

‎karpenter.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# ---
2+
# apiVersion: karpenter.sh/v1alpha5
3+
# kind: Provisioner
4+
# metadata:
5+
# name: cpu
6+
# spec:
7+
# requirements:
8+
# - key: node.kubernetes.io/instance-type
9+
# operator: In
10+
# values: ["c5.xlarge"]
11+
# labels:
12+
# Name : cpu
13+
# taints:
14+
# - key: CpuOnly
15+
# effect: NoSchedule
16+
# provider:
17+
# instanceProfile: KarpenterNodeInstanceProfile-batcave-dev
18+
# launchTemplate: cpu-20220113143405730300000018
19+
# subnetSelector:
20+
# ContainerSubnet: "true"
21+
# ttlSecondsAfterEmpty: 30
22+
23+
# ---
24+
# apiVersion: karpenter.sh/v1alpha5
25+
# kind: Provisioner
26+
# metadata:
27+
# name: memory
28+
# spec:
29+
# requirements:
30+
# - key: node.kubernetes.io/instance-type
31+
# operator: In
32+
# values: ["r5.xlarge"]
33+
# labels:
34+
# Name : critical
35+
# taints:
36+
# - key: MemoryOnly
37+
# effect: NoSchedule
38+
# provider:
39+
# instanceProfile: KarpenterNodeInstanceProfile-batcave-test
40+
# launchTemplate: memory-2022011303540058450000000d
41+
# subnetSelector:
42+
# ContainerSubnet: "true"
43+
# ttlSecondsAfterEmpty: 30
44+
45+
---
46+
apiVersion: karpenter.sh/v1alpha5
47+
kind: Provisioner
48+
metadata:
49+
name: general
50+
spec:
51+
requirements:
52+
- key: node.kubernetes.io/instance-type
53+
operator: In
54+
values: ["c4.xlarge"]
55+
labels:
56+
Name : general
57+
provider:
58+
instanceProfile: KarpenterNodeInstanceProfile-batcave-east-dev
59+
launchTemplate: general-2022012006071202970000000b
60+
subnetSelector:
61+
ContainerSubnet: "true"
62+
ttlSecondsAfterEmpty: 30

‎output.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
output "karpenter_iam" {
2+
value = aws_iam_instance_profile.karpenter.id
3+
}
4+
5+
output "hr_manifest" {
6+
description = "The rendered manifest of the release as JSON"
7+
value = helm_release.karpenter
8+
sensitive = true
9+
}
10+

‎test.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: karpenter.sh/v1alpha5
2+
kind: Provisioner
3+
metadata:
4+
name: default
5+
spec:
6+
requirements:
7+
- key: karpenter.sh/capacity-type
8+
operator: In
9+
values: ["spot"]
10+
limits:
11+
resources:
12+
cpu: 1000
13+
provider:
14+
instanceProfile: KarpenterNodeInstanceProfile-batcave-dev
15+
subnetSelector:
16+
kubernetes.io/cluster/batcave-dev: 'shared'
17+
securityGroupSelector:
18+
Name: sg-0ae8da89426d04ac6
19+
ttlSecondsAfterEmpty: 30

‎test/test.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: inflate
5+
spec:
6+
replicas: 0
7+
selector:
8+
matchLabels:
9+
app: inflate
10+
template:
11+
metadata:
12+
labels:
13+
app: inflate
14+
spec:
15+
terminationGracePeriodSeconds: 0
16+
containers:
17+
- name: inflate
18+
image: public.ecr.aws/eks-distro/kubernetes/pause:3.2
19+
resources:
20+
requests:
21+
cpu: 1

‎values.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
controller:
2+
tolerations:
3+
- key: "CriticalAddonsOnly"
4+
operator: "Exists"
5+
effect: "NoSchedule"
6+
7+
webhook:
8+
tolerations:
9+
- key: "CriticalAddonsOnly"
10+
operator: "Exists"
11+
effect: "NoSchedule"

‎variables.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
variable "cluster_name" {}
2+
variable "provider_url" {
3+
default = ""
4+
}
5+
6+
7+
### Karpenter IAM variables
8+
9+
variable "worker_iam_role_name" {
10+
default = ""
11+
}
12+
13+
variable "iam_path" {
14+
default = "/delegatedadmin/developer/"
15+
}
16+
17+
variable "permissions_boundary" {
18+
default = "arn:aws:iam::373346310182:policy/cms-cloud-admin/developer-boundary-policy"
19+
}
20+
21+
22+
### Helm variables
23+
24+
variable "helm_namespace" {
25+
default = "karpenter"
26+
}
27+
variable "helm_create_namespace" {
28+
type = bool
29+
default = true
30+
}
31+
variable "helm_name" {
32+
default = "karpenter"
33+
}
34+
variable "cluster_endpoint" {
35+
default = ""
36+
}

0 commit comments

Comments
 (0)