Skip to content

Commit 422a291

Browse files
bonclay7bonclay7
committed
Add local example for empty EKS Cluster
1 parent 0f4300b commit 422a291

File tree

5 files changed

+381
-0
lines changed

5 files changed

+381
-0
lines changed

‎examples/eks-cluster-with-vpc/README.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# EKS Cluster Deployment with new VPC
2+
3+
Note: This example is a subset from [this EKS Blueprint example](https://github.com/aws-ia/terraform-aws-eks-blueprints/tree/main/examples/eks-cluster-with-new-vpc)
4+
5+
This example deploys the following Basic EKS Cluster with VPC
6+
7+
- Creates a new sample VPC, 3 Private Subnets and 3 Public Subnets
8+
- Creates Internet gateway for Public Subnets and NAT Gateway for Private Subnets
9+
- Creates EKS Cluster Control plane with one managed node group
10+
11+
## How to Deploy
12+
13+
### Prerequisites
14+
15+
Ensure that you have installed the following tools in your Mac or Windows Laptop before start working with this module and run Terraform Plan and Apply
16+
17+
1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
18+
2. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
19+
3. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
20+
21+
### Minimum IAM Policy
22+
23+
> **Note**: The policy resource is set as `*` to allow all resources, this is not a recommended practice.
24+
25+
You can find the policy [here](min-iam-policy.json)
26+
27+
28+
### Deployment Steps
29+
30+
#### Step 1: Clone the repo using the command below
31+
32+
```sh
33+
git clone https://github.com/aws-observability/terraform-aws-observability-accelerator.git
34+
```
35+
36+
#### Step 2: Run Terraform INIT
37+
38+
Initialize a working directory with configuration files
39+
40+
```sh
41+
cd examples/eks-cluster-with-vpc/
42+
terraform init
43+
```
44+
45+
#### Step 3: Run Terraform PLAN
46+
47+
Verify the resources created by this execution
48+
49+
```sh
50+
export TF_VAR_aws_region=<ENTER YOUR REGION> # Select your own region
51+
terraform plan
52+
```
53+
54+
#### Step 4: Finally, Terraform APPLY
55+
56+
**Deploy the pattern**
57+
58+
```sh
59+
terraform apply
60+
```
61+
62+
Enter `yes` to apply.
63+
64+
### Configure `kubectl` and test cluster
65+
66+
EKS Cluster details can be extracted from terraform output or from AWS Console to get the name of cluster.
67+
This following command used to update the `kubeconfig` in your local machine where you run kubectl commands to interact with your EKS Cluster.
68+
69+
#### Step 5: Run `update-kubeconfig` command
70+
71+
`~/.kube/config` file gets updated with cluster details and certificate from the below command
72+
73+
aws eks --region <enter-your-region> update-kubeconfig --name <cluster-name>
74+
75+
#### Step 6: List all the worker nodes by running the command below
76+
77+
kubectl get nodes
78+
79+
#### Step 7: List all the pods running in `kube-system` namespace
80+
81+
kubectl get pods -n kube-system
82+
83+
## Cleanup
84+
85+
To clean up your environment, destroy the Terraform modules in reverse order.
86+
87+
Destroy the Kubernetes Add-ons, EKS cluster with Node groups and VPC
88+
89+
```sh
90+
terraform destroy -target="module.eks_blueprints_kubernetes_addons" -auto-approve
91+
terraform destroy -target="module.eks_blueprints" -auto-approve
92+
terraform destroy -target="module.vpc" -auto-approve
93+
```
94+
95+
Finally, destroy any additional resources that are not in the above modules
96+
97+
```sh
98+
terraform destroy -auto-approve
99+
```

‎examples/eks-cluster-with-vpc/main.tf

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
5+
provider "kubernetes" {
6+
host = module.eks_blueprints.eks_cluster_endpoint
7+
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
8+
token = data.aws_eks_cluster_auth.this.token
9+
}
10+
11+
provider "helm" {
12+
kubernetes {
13+
host = module.eks_blueprints.eks_cluster_endpoint
14+
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
15+
token = data.aws_eks_cluster_auth.this.token
16+
}
17+
}
18+
19+
data "aws_eks_cluster_auth" "this" {
20+
name = module.eks_blueprints.eks_cluster_id
21+
}
22+
23+
data "aws_availability_zones" "available" {}
24+
25+
locals {
26+
name = basename(path.cwd)
27+
cluster_name = coalesce(var.cluster_name, local.name)
28+
region = var.aws_region
29+
30+
vpc_cidr = "10.0.0.0/16"
31+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
32+
33+
tags = {
34+
Blueprint = local.name
35+
GithubRepo = "github.com/aws-observability/terraform-aws-observability-accelerator"
36+
}
37+
}
38+
39+
#---------------------------------------------------------------
40+
# EKS Blueprints
41+
#---------------------------------------------------------------
42+
43+
module "eks_blueprints" {
44+
source = "github.com/aws-ia/terraform-aws-eks-blueprints"
45+
46+
cluster_name = local.cluster_name
47+
cluster_version = "1.23"
48+
49+
vpc_id = module.vpc.vpc_id
50+
private_subnet_ids = module.vpc.private_subnets
51+
52+
managed_node_groups = {
53+
mg_5 = {
54+
node_group_name = "managed-ondemand"
55+
instance_types = ["m5.large"]
56+
min_size = 2
57+
subnet_ids = module.vpc.private_subnets
58+
}
59+
}
60+
61+
tags = local.tags
62+
}
63+
64+
module "eks_blueprints_kubernetes_addons" {
65+
source = "github.com/aws-ia/terraform-aws-eks-blueprints/modules/kubernetes-addons"
66+
67+
eks_cluster_id = module.eks_blueprints.eks_cluster_id
68+
eks_cluster_endpoint = module.eks_blueprints.eks_cluster_endpoint
69+
eks_oidc_provider = module.eks_blueprints.oidc_provider
70+
eks_cluster_version = module.eks_blueprints.eks_cluster_version
71+
72+
# EKS Managed Add-ons
73+
enable_amazon_eks_vpc_cni = true
74+
enable_amazon_eks_coredns = true
75+
enable_amazon_eks_kube_proxy = true
76+
enable_amazon_eks_aws_ebs_csi_driver = true
77+
78+
tags = local.tags
79+
}
80+
81+
#---------------------------------------------------------------
82+
# Supporting Resources
83+
#---------------------------------------------------------------
84+
85+
module "vpc" {
86+
source = "terraform-aws-modules/vpc/aws"
87+
version = "~> 3.0"
88+
89+
name = local.name
90+
cidr = local.vpc_cidr
91+
92+
azs = local.azs
93+
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
94+
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 10)]
95+
96+
enable_nat_gateway = true
97+
single_nat_gateway = true
98+
enable_dns_hostnames = true
99+
100+
# Manage so we can name
101+
manage_default_network_acl = true
102+
default_network_acl_tags = { Name = "${local.name}-default" }
103+
manage_default_route_table = true
104+
default_route_table_tags = { Name = "${local.name}-default" }
105+
manage_default_security_group = true
106+
default_security_group_tags = { Name = "${local.name}-default" }
107+
108+
public_subnet_tags = {
109+
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
110+
"kubernetes.io/role/elb" = 1
111+
}
112+
113+
private_subnet_tags = {
114+
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
115+
"kubernetes.io/role/internal-elb" = 1
116+
}
117+
118+
tags = local.tags
119+
}

‎examples/eks-cluster-with-vpc/min-iam-policy.json

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"ec2:AllocateAddress",
8+
"ec2:AssociateRouteTable",
9+
"ec2:AttachInternetGateway",
10+
"ec2:AuthorizeSecurityGroupEgress",
11+
"ec2:AuthorizeSecurityGroupIngress",
12+
"ec2:CreateInternetGateway",
13+
"ec2:CreateNatGateway",
14+
"ec2:CreateNetworkAclEntry",
15+
"ec2:CreateRoute",
16+
"ec2:CreateRouteTable",
17+
"ec2:CreateSecurityGroup",
18+
"ec2:CreateSubnet",
19+
"ec2:CreateTags",
20+
"ec2:CreateVpc",
21+
"ec2:DeleteInternetGateway",
22+
"ec2:DeleteNatGateway",
23+
"ec2:DeleteNetworkAclEntry",
24+
"ec2:DeleteRoute",
25+
"ec2:DeleteRouteTable",
26+
"ec2:DeleteSecurityGroup",
27+
"ec2:DeleteSubnet",
28+
"ec2:DeleteTags",
29+
"ec2:DeleteVpc",
30+
"ec2:DescribeAccountAttributes",
31+
"ec2:DescribeAddresses",
32+
"ec2:DescribeAvailabilityZones",
33+
"ec2:DescribeInternetGateways",
34+
"ec2:DescribeNatGateways",
35+
"ec2:DescribeNetworkAcls",
36+
"ec2:DescribeNetworkInterfaces",
37+
"ec2:DescribeRouteTables",
38+
"ec2:DescribeSecurityGroups",
39+
"ec2:DescribeSubnets",
40+
"ec2:DescribeTags",
41+
"ec2:DescribeVpcAttribute",
42+
"ec2:DescribeVpcClassicLink",
43+
"ec2:DescribeVpcClassicLinkDnsSupport",
44+
"ec2:DescribeVpcs",
45+
"ec2:DetachInternetGateway",
46+
"ec2:DisassociateRouteTable",
47+
"ec2:ModifySubnetAttribute",
48+
"ec2:ModifyVpcAttribute",
49+
"ec2:ReleaseAddress",
50+
"ec2:RevokeSecurityGroupEgress",
51+
"ec2:RevokeSecurityGroupIngress",
52+
"eks:CreateAddon",
53+
"eks:CreateCluster",
54+
"eks:CreateNodegroup",
55+
"eks:DeleteAddon",
56+
"eks:DeleteCluster",
57+
"eks:DeleteNodegroup",
58+
"eks:DescribeAddon",
59+
"eks:DescribeAddonVersions",
60+
"eks:DescribeCluster",
61+
"eks:DescribeNodegroup",
62+
"iam:AddRoleToInstanceProfile",
63+
"iam:AttachRolePolicy",
64+
"iam:CreateInstanceProfile",
65+
"iam:CreateOpenIDConnectProvider",
66+
"iam:CreatePolicy",
67+
"iam:CreateRole",
68+
"iam:CreateServiceLinkedRole",
69+
"iam:DeleteInstanceProfile",
70+
"iam:DeleteOpenIDConnectProvider",
71+
"iam:DeletePolicy",
72+
"iam:DeleteRole",
73+
"iam:DetachRolePolicy",
74+
"iam:GetInstanceProfile",
75+
"iam:GetOpenIDConnectProvider",
76+
"iam:GetPolicy",
77+
"iam:GetPolicyVersion",
78+
"iam:GetRole",
79+
"iam:ListAttachedRolePolicies",
80+
"iam:ListInstanceProfilesForRole",
81+
"iam:ListPolicyVersions",
82+
"iam:ListRolePolicies",
83+
"iam:PassRole",
84+
"iam:RemoveRoleFromInstanceProfile",
85+
"iam:TagInstanceProfile",
86+
"kms:CreateAlias",
87+
"kms:CreateKey",
88+
"kms:DeleteAlias",
89+
"kms:DescribeKey",
90+
"kms:EnableKeyRotation",
91+
"kms:GetKeyPolicy",
92+
"kms:GetKeyRotationStatus",
93+
"kms:ListAliases",
94+
"kms:ListResourceTags",
95+
"kms:PutKeyPolicy",
96+
"kms:ScheduleKeyDeletion",
97+
"kms:TagResource",
98+
"s3:GetObject",
99+
"s3:ListBucket",
100+
"s3:PutObject"
101+
],
102+
"Resource": "*"
103+
}
104+
]
105+
}

‎examples/eks-cluster-with-vpc/outputs.tf

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
output "vpc_private_subnet_cidr" {
2+
description = "VPC private subnet CIDR"
3+
value = module.vpc.private_subnets_cidr_blocks
4+
}
5+
6+
output "vpc_public_subnet_cidr" {
7+
description = "VPC public subnet CIDR"
8+
value = module.vpc.public_subnets_cidr_blocks
9+
}
10+
11+
output "vpc_cidr" {
12+
description = "VPC CIDR"
13+
value = module.vpc.vpc_cidr_block
14+
}
15+
16+
output "eks_cluster_id" {
17+
description = "EKS cluster ID"
18+
value = module.eks_blueprints.eks_cluster_id
19+
}
20+
21+
output "eks_managed_nodegroups" {
22+
description = "EKS managed node groups"
23+
value = module.eks_blueprints.managed_node_groups
24+
}
25+
26+
output "eks_managed_nodegroup_ids" {
27+
description = "EKS managed node group ids"
28+
value = module.eks_blueprints.managed_node_groups_id
29+
}
30+
31+
output "eks_managed_nodegroup_arns" {
32+
description = "EKS managed node group arns"
33+
value = module.eks_blueprints.managed_node_group_arn
34+
}
35+
36+
output "eks_managed_nodegroup_role_name" {
37+
description = "EKS managed node group role name"
38+
value = module.eks_blueprints.managed_node_group_iam_role_names
39+
}
40+
41+
output "eks_managed_nodegroup_status" {
42+
description = "EKS managed node group status"
43+
value = module.eks_blueprints.managed_node_groups_status
44+
}
45+
46+
output "configure_kubectl" {
47+
description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
48+
value = module.eks_blueprints.configure_kubectl
49+
}

‎examples/eks-cluster-with-vpc/variables.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "cluster_name" {
2+
description = "Name of cluster - used by Terratest for e2e test automation"
3+
type = string
4+
default = ""
5+
}
6+
variable "aws_region" {
7+
description = "AWS Region"
8+
type = string
9+
}

0 commit comments

Comments
 (0)