Skip to content

Commit d5a384d

Browse files
liam-lloydliam-lloyd
committed
Update EKS AMIs
The AMIs we're currently using for our node groups will soon be unsupported, so this commit updates them to the new standard version, along with updating the EKS module itself to enable that.
1 parent 2bc56c2 commit d5a384d

File tree

8 files changed

+122
-75
lines changed

8 files changed

+122
-75
lines changed

‎archivematica/prod_cluster/archivematica_deployment.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ resource "kubernetes_deployment" "archivematica_prod" {
8888
value = "archivematica.permanent.org"
8989
}
9090
env {
91-
name = "DJANGO_SECRET_KEY"
91+
name = "DJANGO_SECRET_KEY"
9292
value_from {
9393
secret_key_ref {
9494
name = "prod-archivematica-secrets"
@@ -243,7 +243,7 @@ resource "kubernetes_deployment" "archivematica_prod" {
243243
image = local.desired_images["archivematica-mcp-server-prod"]
244244
name = "archivematica-mcp-server-prod"
245245
env {
246-
name = "DJANGO_SECRET_KEY"
246+
name = "DJANGO_SECRET_KEY"
247247
value_from {
248248
secret_key_ref {
249249
name = "prod-archivematica-secrets"
@@ -364,7 +364,7 @@ resource "kubernetes_deployment" "archivematica_prod" {
364364
}
365365
}
366366
init_container {
367-
image = local.desired_images["archivematica-storage-service-prod"]
367+
image = local.desired_images["archivematica-storage-service-prod"]
368368
name = "archivematica-storage-service-create-user"
369369
env {
370370
name = "DJANGO_SETTINGS_MODULE"

‎archivematica/prod_cluster/eks-cluster.tf‎

Lines changed: 49 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,31 @@
11
module "eks" {
22
source = "terraform-aws-modules/eks/aws"
3-
version = "19.0.4"
4-
5-
cluster_name = local.cluster_name
6-
cluster_version = "1.32"
7-
8-
vpc_id = var.vpc_id
9-
subnet_ids = var.subnet_ids
10-
cluster_endpoint_public_access = true
11-
cluster_security_group_id = var.security_group_id
12-
aws_auth_users = [
13-
{
14-
userarn = "arn:aws:iam::364159549467:user/liam"
15-
username = "liam"
16-
groups = ["system:masters"]
3+
version = "21.2.0"
4+
5+
name = local.cluster_name
6+
kubernetes_version = "1.32"
7+
8+
vpc_id = var.vpc_id
9+
subnet_ids = var.subnet_ids
10+
endpoint_public_access = true
11+
security_group_id = var.security_group_id
12+
access_entries = {
13+
liam = {
14+
principal_arn = "arn:aws:iam::364159549467:user/liam"
15+
user_name = "liam"
16+
kubernetes_groups = ["eks-admins"]
1717
},
18-
{
19-
userarn = "arn:aws:iam::364159549467:user/cecilia"
20-
username = "cecilia"
21-
groups = ["system:masters"]
22-
}
23-
]
24-
25-
eks_managed_node_group_defaults = {
26-
ami_type = "AL2_x86_64"
27-
28-
block_device_mappings = {
29-
xvda = {
30-
device_name = "/dev/xvda"
31-
ebs = {
32-
volume_size = 32
33-
volume_type = "gp2"
34-
delete_on_termination = true
35-
encrypted = true
36-
}
37-
}
18+
cecilia = {
19+
principal_arn = "arn:aws:iam::364159549467:user/cecilia"
20+
user_name = "cecilia"
21+
kubernetes_groups = ["eks-admins"]
3822
}
3923
}
4024

4125
eks_managed_node_groups = {
4226
one = {
43-
name = "node-group-1"
27+
name = "node-group-1"
28+
ami_type = "AL2023_x86_64_STANDARD"
4429

4530
vpc_security_group_ids = [var.security_group_id]
4631

@@ -49,6 +34,35 @@ module "eks" {
4934
min_size = 3
5035
max_size = 3
5136
desired_size = 3
37+
block_device_mappings = {
38+
xvda = {
39+
device_name = "/dev/xvda"
40+
ebs = {
41+
volume_size = 32
42+
volume_type = "gp2"
43+
delete_on_termination = true
44+
encrypted = true
45+
}
46+
}
47+
}
5248
}
5349
}
5450
}
51+
52+
resource "kubernetes_cluster_role_binding" "eks_admins_cluster_admin" {
53+
metadata {
54+
name = "eks-admins-cluster-admin"
55+
}
56+
57+
role_ref {
58+
api_group = "rbac.authorization.k8s.io"
59+
kind = "ClusterRole"
60+
name = "cluster-admin"
61+
}
62+
63+
subject {
64+
kind = "Group"
65+
name = "eks-admins"
66+
api_group = "rbac.authorization.k8s.io"
67+
}
68+
}

‎archivematica/prod_cluster/load_balancer.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "lb_role" {
2-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
2+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
33
version = "5.60.0"
44

55
role_name = "prod_archivematica_lb"

‎archivematica/prod_cluster/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
locals {
22
current_archivematica_prod_deploy = data.kubernetes_resource.archivematica_prod.object
3-
current_mcp_client_prod_deploy = data.kubernetes_resource.mcp_client_prod.object
3+
current_mcp_client_prod_deploy = data.kubernetes_resource.mcp_client_prod.object
44

55
current_containers = concat(
66
try(local.current_archivematica_prod_deploy.spec.template.spec.containers),

‎archivematica/prod_cluster/terraform.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ terraform {
1010
required_providers {
1111
aws = {
1212
source = "hashicorp/aws"
13-
version = "~> 4.46.0"
13+
version = "~> 6.14.1"
1414
}
1515

1616
random = {
@@ -39,5 +39,5 @@ terraform {
3939
}
4040
}
4141

42-
required_version = "~> 1.3"
42+
required_version = "~> 1.5"
4343
}

‎archivematica/prod_cluster/variables.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,6 @@ variable "whitelisted_cidrs" {
7474

7575
variable "image_overrides" {
7676
description = "A map of docker images to be updated"
77-
type = map(string)
78-
default = {}
77+
type = map(string)
78+
default = {}
7979
}

‎archivematica/test_cluster/eks-cluster.tf‎

Lines changed: 62 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,49 @@
11
module "eks" {
22
source = "terraform-aws-modules/eks/aws"
3-
version = "19.0.4"
3+
version = "21.2.0"
44

5-
cluster_name = local.cluster_name
6-
cluster_version = "1.32"
5+
name = local.cluster_name
6+
kubernetes_version = "1.32"
77

88
vpc_id = var.vpc_id
99
subnet_ids = var.subnet_ids
10-
cluster_endpoint_public_access = true
11-
cluster_security_group_id = var.dev_security_group_id
12-
aws_auth_users = [
13-
{
14-
userarn = "arn:aws:iam::364159549467:user/liam"
15-
username = "liam"
16-
groups = ["system:masters"]
10+
endpoint_public_access = true
11+
security_group_id = var.dev_security_group_id
12+
access_entries = {
13+
liam = {
14+
principal_arn = "arn:aws:iam::364159549467:user/liam"
15+
user_name = "liam"
16+
kubernetes_groups = ["eks-admins"]
1717
},
18-
{
19-
userarn = "arn:aws:iam::364159549467:user/cecilia"
20-
username = "cecilia"
21-
groups = ["system:masters"]
18+
cecilia = {
19+
principal_arn = "arn:aws:iam::364159549467:user/cecilia"
20+
user_name = "cecilia"
21+
kubernetes_groups = ["eks-admins"]
2222
}
23-
]
24-
25-
eks_managed_node_group_defaults = {
26-
ami_type = "AL2_x86_64"
27-
28-
block_device_mappings = {
29-
xvda = {
30-
device_name = "/dev/xvda"
31-
ebs = {
32-
volume_size = 32
33-
volume_type = "gp2"
34-
delete_on_termination = true
35-
encrypted = true
36-
}
37-
}
23+
}
24+
25+
addons = {
26+
coredns = {
27+
most_recent = true
28+
resolve_conflicts_on_create = "OVERWRITE"
29+
resolve_conflicts = "OVERWRITE"
30+
}
31+
kube-proxy = {
32+
most_recent = true
33+
resolve_conflicts_on_create = "OVERWRITE"
34+
resolve_conflicts = "OVERWRITE"
35+
}
36+
vpc-cni = {
37+
most_recent = true
38+
resolve_conflicts_on_create = "OVERWRITE"
39+
resolve_conflicts = "OVERWRITE"
3840
}
3941
}
4042

4143
eks_managed_node_groups = {
4244
one = {
4345
name = "node-group-1"
46+
ami_type = "AL2023_x86_64_STANDARD"
4447

4548
vpc_security_group_ids = [var.dev_security_group_id, var.staging_security_group_id]
4649

@@ -49,6 +52,36 @@ module "eks" {
4952
min_size = 3
5053
max_size = 3
5154
desired_size = 3
55+
56+
block_device_mappings = {
57+
xvda = {
58+
device_name = "/dev/xvda"
59+
ebs = {
60+
volume_size = 32
61+
volume_type = "gp2"
62+
delete_on_termination = true
63+
encrypted = true
64+
}
65+
}
66+
}
5267
}
5368
}
5469
}
70+
71+
resource "kubernetes_cluster_role_binding" "eks_admins_cluster_admin" {
72+
metadata {
73+
name = "eks-admins-cluster-admin"
74+
}
75+
76+
role_ref {
77+
api_group = "rbac.authorization.k8s.io"
78+
kind = "ClusterRole"
79+
name = "cluster-admin"
80+
}
81+
82+
subject {
83+
kind = "Group"
84+
name = "eks-admins"
85+
api_group = "rbac.authorization.k8s.io"
86+
}
87+
}

‎archivematica/test_cluster/terraform.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ terraform {
1010
required_providers {
1111
aws = {
1212
source = "hashicorp/aws"
13-
version = "~> 4.46.0"
13+
version = "~> 6.14.1"
1414
}
1515

1616
random = {
@@ -39,5 +39,5 @@ terraform {
3939
}
4040
}
4141

42-
required_version = "~> 1.3"
42+
required_version = "~> 1.5"
4343
}

0 commit comments

Comments
 (0)