fix: Move prefix delegation env var code from eks module to kubernetes terraform. Also bump up the kubernetes provider version and make a few related tweaks. (#222)

Author: bmonkman

templates/kubernetes/terraform/modules/kubernetes/logging/cloudwatch/cloudwatch_agent.tf

@@ -170,11 +170,11 @@ resource "kubernetes_daemonset" "cloudwatch_agent" {
             value = "k8s/1.0.0"
           }
           resources {
-            limits {
+            limits = {
               cpu    = "200m"
               memory = "200Mi"
             }
-            requests {
+            requests = {
               memory = "200Mi"
               cpu    = "200m"
             }

templates/kubernetes/terraform/modules/kubernetes/logging/cloudwatch/fluentd.tf

@@ -183,10 +183,10 @@ resource "kubernetes_daemonset" "fluentd_cloudwatch" {
             value = "-q"
           }
           resources {
-            limits {
+            limits = {
               memory = "200Mi"
             }
-            requests {
+            requests = {
               cpu    = "100m"
               memory = "200Mi"
             }

templates/kubernetes/terraform/modules/kubernetes/logging/kibana/fluentd.tf

@@ -144,10 +144,10 @@ resource "kubernetes_daemonset" "fluentd" {
           # }
 
           resources {
-            limits {
+            limits = {
               memory = "200Mi"
             }
-            requests {
+            requests = {
               cpu    = "100m"
               memory = "200Mi"
             }

templates/kubernetes/terraform/modules/kubernetes/main.tf

@@ -39,3 +39,19 @@ resource "kubernetes_namespace" "app_namespace" {
     name = var.project
   }
 }
+
+
+# Enable prefix delegation - this will enable many more IPs to be allocated per-node.
+# See https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html
+resource "null_resource" "enable_prefix_delegation" {
+
+  # This is a static value so it won't be run multiple times.
+  # If these env vars get removed somehow, this value can just be incremented.
+  triggers = {
+    "version" = "1"
+  }
+
+  provisioner "local-exec" {
+    command = "kubectl set env daemonset aws-node ${local.k8s_exec_context} -n kube-system ENABLE_PREFIX_DELEGATION=true WARM_PREFIX_TARGET=1"
+  }
+}

templates/kubernetes/terraform/modules/kubernetes/provider.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "~> 1.11"
+      version = "~> 2.4"
     }
   }
 }
@@ -46,7 +46,6 @@ provider "kubernetes" {
   host                   = data.aws_eks_cluster.cluster.endpoint
   cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
   token                  = data.aws_eks_cluster_auth.cluster.token
-  load_config_file       = false
 }
 
 provider "helm" {

templates/kubernetes/terraform/modules/kubernetes/vpn.tf

@@ -186,11 +186,11 @@ resource "kubernetes_deployment" "wireguard" {
           }
 
           resources {
-            limits {
+            limits = {
               memory = "256Mi"
             }
 
-            requests {
+            requests = {
               cpu    = "100m"
               memory = "64Mi"
             }

templates/terraform/modules/environment/main.tf

@@ -56,7 +56,7 @@ data "aws_caller_identity" "current" {}
 # Provision the EKS cluster
 module "eks" {
   source  = "commitdev/zero/aws//modules/eks"
-  version = "0.5.0"
+  version = "0.5.1"
   providers = {
     aws = aws.for_eks
   }

templates/terraform/modules/environment/provider.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "~> 1.11"
+      version = "~> 2.4"
     }
   }
 }
@@ -44,5 +44,4 @@ provider "kubernetes" {
   host                   = data.aws_eks_cluster.cluster.endpoint
   cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
   token                  = data.aws_eks_cluster_auth.cluster.token
-  load_config_file       = false
 }