Skip to content

Commit 5000254

Browse files
sohanyadavsohanyadav
committed
enable eks auto mode
1 parent c1e5bb3 commit 5000254

File tree

8 files changed

+342
-27
lines changed

8 files changed

+342
-27
lines changed

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,5 @@ eks/kubeconfig.yaml
2020
*~
2121

2222
.idea/
23-
.terraform.lock.hcl
23+
.terraform.lock.hcl
24+
*/kubeconfig

‎cluster.tf‎

Lines changed: 53 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,34 @@ resource "aws_eks_cluster" "cluster" {
3838
}
3939
}
4040
}
41+
bootstrap_self_managed_addons = var.eks_auto_mode_enabled == true ? false : true
42+
# Compute Config (conditional setup for Auto Mode)
43+
dynamic "compute_config" {
44+
for_each = var.eks_auto_mode_enabled ? [1] : []
45+
content {
46+
enabled = true
47+
node_pools = ["general-purpose"]
48+
node_role_arn = aws_iam_role.eks_auto[0].arn
49+
}
50+
}
51+
# Kubernetes Network Config (Auto Mode specific)
52+
dynamic "kubernetes_network_config" {
53+
for_each = var.eks_auto_mode_enabled ? [1] : []
54+
content {
55+
elastic_load_balancing {
56+
enabled = true
57+
}
58+
}
59+
}
60+
# Storage Config (Auto Mode specific)
61+
dynamic "storage_config" {
62+
for_each = var.eks_auto_mode_enabled ? [1] : []
63+
content {
64+
block_storage {
65+
enabled = true
66+
}
67+
}
68+
}
4169
enabled_cluster_log_types = var.cluster_logging
4270

4371
depends_on = [
@@ -76,20 +104,31 @@ data "tls_certificate" "cluster" {
76104
resource "aws_iam_role" "cluster" {
77105
name = "${var.environment_name}-cluster"
78106

79-
assume_role_policy = <<POLICY
80-
{
81-
"Version": "2012-10-17",
82-
"Statement": [
83-
{
84-
"Effect": "Allow",
85-
"Principal": {
86-
"Service": "eks.amazonaws.com"
87-
},
88-
"Action": "sts:AssumeRole"
89-
}
90-
]
91-
}
92-
POLICY
107+
assume_role_policy = var.eks_auto_mode_enabled == false ? jsonencode({
108+
Statement = [{
109+
Action = "sts:AssumeRole"
110+
Effect = "Allow"
111+
Principal = {
112+
Service = "eks.amazonaws.com"
113+
}
114+
}]
115+
Version = "2012-10-17"
116+
}) : jsonencode({
117+
"Version" : "2012-10-17",
118+
"Statement" : [
119+
{
120+
"Sid" : "EKSClusterAssumeRole",
121+
"Effect" : "Allow",
122+
"Principal" : {
123+
"Service" : "eks.amazonaws.com"
124+
},
125+
"Action" : [
126+
"sts:TagSession",
127+
"sts:AssumeRole"
128+
]
129+
}
130+
]
131+
})
93132

94133
tags = local.tags
95134
}

‎examples/eks/kubeconfig‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: v1
2+
clusters:
3+
- cluster:
4+
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJVFBjWnMrZUlGRTh3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TlRBeE1UWXdPRE01TURaYUZ3MHpOVEF4TVRRd09EUTBNRFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUNuR0ZSNmg3eFBkMUYycWRRNGhST1BwV3g3TUlyN1p4T1N4ZWU5b0lUelEvTHFmNWMxUmJnb21PZUIKZUFidlR3ajc3bk1pY1Y5QkNTMFE3SU9QQ05jRFNwZ3l0U05DY1g0SUdvUFBWcmgzSHBOS0E3VjVlbTFJVEIvOAo4YTd5L0NGaitoekt5MldpN2JCWkZmSDBaUkRZdGxCTklsdE5KREI4d1UwS09TYWV0WjhPTFI2R0pjQ3plbUhtCmk4cUVzVXJoN2pscHNnTThxL2ZuSzhyajJUY0JRazVmVkZFdXRLeGZUZXlaR0t2Tm8wOHZUS0xkMkQ0MHZZdk0KMmsrZU1uR0hmYnEzVjFESUJTOHdiTEMvdTM2NGdZT3B4RW5zL2lxZi9uQzBzUWJpL0psYTlNd0t1ZXQ1YzhRagpGbmNsZWU4UDNBS0I3Yk1tQ1lxeDc1ZHQ4bnVkQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJUMVpOWlNDL3hLSnhZZG1oU0VYNWFlZ0tzNjJUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1hKcW4zNjNFWgppSzhiVm1vam5MQVNYWG9adGNrRFB6L0ozTUMxZlNUdW1mTWNpeGtSd3hUQ2QyaDhaUngvMEsvVG5KcVAxVlVPCjYrTjAvbVJLb0NGVnFCZlJ0bkJXdzB3SU5FMzdqRmNJYjRub202NzdVVzIwOHFNNGhYM2FpZnp0RTZBd1ducEYKSVUyblNXUElyVEdJb0lYdGltRi9wMFF4TXhiMGdHbFZGYVFjWmhsMzErNzJZdWpDOStKVDJzdWFLd1ZWSDRLSwozWEgySGlEbzQzckY3eGtJeUllaXZmMUNFWTBET1hRd1YwS0hwKzNVeTZuS0hBcjVCUlpMdDlyNkJUY3hSa25iCnpVU0xyUENQMW5LU0dqV0h6NStVTFZqSVUyYUVVNVJ1K1BhUnpTZ1VHVHdIa0lDSU8wVjJMRko3c3JYM1lTK3AKTWU5aWJWcFk1VjEyCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
5+
server: https://C6D3754A9A424C41D2F00D4CBEF31519.gr7.us-east-1.eks.amazonaws.com
6+
name: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
7+
contexts:
8+
- context:
9+
cluster: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
10+
user: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
11+
name: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
12+
current-context: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
13+
kind: Config
14+
preferences: {}
15+
users:
16+
- name: arn:aws:eks:us-east-1:908027411800:cluster/auguria-pj5za11
17+
user:
18+
exec:
19+
apiVersion: client.authentication.k8s.io/v1beta1
20+
args:
21+
- --region
22+
- us-east-1
23+
- eks
24+
- get-token
25+
- --cluster-name
26+
- auguria-pj5za11
27+
- --output
28+
- json
29+
command: aws
30+
env:
31+
- name: AWS_PROFILE
32+
value: auguria-pj5za

‎examples/eks/main.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ module "opszero-eks" {
3535
"us-east-1b"
3636
]
3737

38-
cluster_version = "1.27"
38+
cluster_version = "1.31"
3939
environment_name = local.environment_name
4040
iam_users = {
4141
"abhi@opszero.com" = {
@@ -105,5 +105,4 @@ module "helm-common" {
105105

106106
nginx_min_replicas = 1
107107
nginx_max_replicas = 3
108-
}
109-
108+
}

‎karpenter.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,13 @@ spec:
8787
httpPutResponseHopLimit: ${var.karpenter_metadata_options.httpPutResponseHopLimit}
8888
httpTokens: ${var.karpenter_metadata_options.httpTokens}
8989
blockDeviceMappings:
90-
%{ for mapping in var.karpenter_block_device_mappings }
90+
%{for mapping in var.karpenter_block_device_mappings}
9191
- deviceName: ${mapping.deviceName}
9292
ebs:
9393
volumeSize: ${mapping.ebs.volumeSize}
9494
volumeType: ${mapping.ebs.volumeType}
9595
encrypted: ${mapping.ebs.encrypted}
96-
%{ endfor }
96+
%{endfor}
9797
amiFamily: ${var.karpenter_ami_family}
9898
role: ${aws_iam_role.node.name}
9999
securityGroupSelectorTerms:
@@ -102,9 +102,9 @@ spec:
102102
- id: ${aws_subnet.public[0].id}
103103
- id: ${aws_subnet.public[1].id}
104104
amiSelectorTerms:
105-
%{ for term in var.karpenter_ami_selector_terms }
105+
%{for term in var.karpenter_ami_selector_terms}
106106
- alias: ${term.alias}
107-
%{ endfor }
107+
%{endfor}
108108
EOT
109109

110110
depends_on = [

‎node_role.tf‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ resource "aws_iam_role_policy_attachment" "node-AmazonEC2ContainerRegistryReadOn
3030
role = aws_iam_role.node.name
3131
}
3232

33+
resource "aws_iam_role_policy_attachment" "node_AmazonEKSWorkerNodeMinimalPolicy" {
34+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
35+
role = aws_iam_role.node.name
36+
}
37+
3338
resource "aws_iam_role_policy_attachment" "node_role_policies" {
3439
count = length(var.node_role_policies)
3540
policy_arn = var.node_role_policies[count.index]
@@ -74,3 +79,207 @@ resource "aws_iam_instance_profile" "node" {
7479
role = aws_iam_role.node.name
7580
tags = local.tags
7681
}
82+
83+
resource "aws_iam_role" "eks_auto" {
84+
count = var.eks_auto_mode_enabled ? 1 : 0
85+
name = "${var.environment_name}-eks-auto-mode-node"
86+
87+
assume_role_policy = jsonencode({
88+
"Version" : "2012-10-17",
89+
"Statement" : [
90+
{
91+
"Sid" : "EKSAutoNodeAssumeRole",
92+
"Effect" : "Allow",
93+
"Principal" : {
94+
"Service" : "ec2.amazonaws.com"
95+
},
96+
"Action" : [
97+
"sts:TagSession",
98+
"sts:AssumeRole"
99+
]
100+
}
101+
]
102+
})
103+
104+
tags = local.tags
105+
}
106+
107+
locals {
108+
iam_role_policy_prefix = "arn:${local.partition}:iam::aws:policy"
109+
# EKS cluster with EKS auto mode enabled
110+
eks_auto_mode_iam_role_policies = { for k, v in {
111+
AmazonEKSClusterPolicy = "${local.iam_role_policy_prefix}/AmazonEKSClusterPolicy"
112+
AmazonEKSComputePolicy = "${local.iam_role_policy_prefix}/AmazonEKSComputePolicy"
113+
AmazonEKSBlockStoragePolicy = "${local.iam_role_policy_prefix}/AmazonEKSBlockStoragePolicy"
114+
AmazonEKSLoadBalancingPolicy = "${local.iam_role_policy_prefix}/AmazonEKSLoadBalancingPolicy"
115+
AmazonEKSNetworkingPolicy = "${local.iam_role_policy_prefix}/AmazonEKSNetworkingPolicy"
116+
} : k => v if var.eks_auto_mode_enabled }
117+
}
118+
119+
resource "aws_iam_role_policy_attachment" "this" {
120+
for_each = { for k, v in {
121+
AmazonEKSWorkerNodeMinimalPolicy = "${local.iam_role_policy_prefix}/AmazonEKSWorkerNodeMinimalPolicy",
122+
AmazonEC2ContainerRegistryPullOnly = "${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryPullOnly",
123+
} : k => v if var.eks_auto_mode_enabled }
124+
125+
policy_arn = each.value
126+
role = aws_iam_role.eks_auto[0].name
127+
}
128+
129+
resource "aws_iam_role_policy_attachment" "cluster" {
130+
for_each = { for k, v in merge(
131+
local.eks_auto_mode_iam_role_policies,
132+
) : k => v if var.eks_auto_mode_enabled }
133+
134+
policy_arn = each.value
135+
role = aws_iam_role.cluster.name
136+
}
137+
138+
data "aws_iam_policy_document" "custom" {
139+
count = var.eks_auto_mode_enabled ? 1 : 0
140+
141+
dynamic "statement" {
142+
for_each = var.eks_auto_mode_enabled ? [1] : []
143+
144+
content {
145+
sid = "Compute"
146+
actions = [
147+
"ec2:CreateFleet",
148+
"ec2:RunInstances",
149+
"ec2:CreateLaunchTemplate",
150+
]
151+
resources = ["*"]
152+
153+
condition {
154+
test = "StringEquals"
155+
variable = "aws:RequestTag/eks:eks-cluster-name"
156+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
157+
}
158+
159+
condition {
160+
test = "StringLike"
161+
variable = "aws:RequestTag/eks:kubernetes-node-class-name"
162+
values = ["*"]
163+
}
164+
165+
condition {
166+
test = "StringLike"
167+
variable = "aws:RequestTag/eks:kubernetes-node-pool-name"
168+
values = ["*"]
169+
}
170+
}
171+
}
172+
173+
dynamic "statement" {
174+
for_each = var.eks_auto_mode_enabled ? [1] : []
175+
176+
content {
177+
sid = "Storage"
178+
actions = [
179+
"ec2:CreateVolume",
180+
"ec2:CreateSnapshot",
181+
]
182+
resources = [
183+
"arn:${local.partition}:ec2:*:*:volume/*",
184+
"arn:${local.partition}:ec2:*:*:snapshot/*",
185+
]
186+
187+
condition {
188+
test = "StringEquals"
189+
variable = "aws:RequestTag/eks:eks-cluster-name"
190+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
191+
}
192+
}
193+
}
194+
195+
dynamic "statement" {
196+
for_each = var.eks_auto_mode_enabled ? [1] : []
197+
198+
content {
199+
sid = "Networking"
200+
actions = ["ec2:CreateNetworkInterface"]
201+
resources = ["*"]
202+
203+
condition {
204+
test = "StringEquals"
205+
variable = "aws:RequestTag/eks:eks-cluster-name"
206+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
207+
}
208+
209+
condition {
210+
test = "StringEquals"
211+
variable = "aws:RequestTag/eks:kubernetes-cni-node-name"
212+
values = ["*"]
213+
}
214+
}
215+
}
216+
217+
dynamic "statement" {
218+
for_each = var.eks_auto_mode_enabled ? [1] : []
219+
220+
content {
221+
sid = "LoadBalancer"
222+
actions = [
223+
"elasticloadbalancing:CreateLoadBalancer",
224+
"elasticloadbalancing:CreateTargetGroup",
225+
"elasticloadbalancing:CreateListener",
226+
"elasticloadbalancing:CreateRule",
227+
"ec2:CreateSecurityGroup",
228+
]
229+
resources = ["*"]
230+
231+
condition {
232+
test = "StringEquals"
233+
variable = "aws:RequestTag/eks:eks-cluster-name"
234+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
235+
}
236+
}
237+
}
238+
239+
dynamic "statement" {
240+
for_each = var.eks_auto_mode_enabled ? [1] : []
241+
242+
content {
243+
sid = "ShieldProtection"
244+
actions = ["shield:CreateProtection"]
245+
resources = ["*"]
246+
247+
condition {
248+
test = "StringEquals"
249+
variable = "aws:RequestTag/eks:eks-cluster-name"
250+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
251+
}
252+
}
253+
}
254+
255+
dynamic "statement" {
256+
for_each = var.eks_auto_mode_enabled ? [1] : []
257+
258+
content {
259+
sid = "ShieldTagResource"
260+
actions = ["shield:TagResource"]
261+
resources = ["arn:${local.partition}:shield::*:protection/*"]
262+
263+
condition {
264+
test = "StringEquals"
265+
variable = "aws:RequestTag/eks:eks-cluster-name"
266+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
267+
}
268+
}
269+
}
270+
}
271+
272+
resource "aws_iam_policy" "custom" {
273+
count = var.eks_auto_mode_enabled ? 1 : 0
274+
275+
name = "${var.environment_name}-eks-auto-mode-cluster"
276+
policy = data.aws_iam_policy_document.custom[0].json
277+
278+
}
279+
280+
resource "aws_iam_role_policy_attachment" "custom" {
281+
count = var.eks_auto_mode_enabled ? 1 : 0
282+
283+
policy_arn = aws_iam_policy.custom[0].arn
284+
role = aws_iam_role.cluster.name
285+
}

0 commit comments

Comments
 (0)