Skip to content

Commit b01f5d4

Browse files
bryantbiggsbryantbiggs
committed
chore: Clean up examples and tests
1 parent c726f71 commit b01f5d4

25 files changed

+328
-466
lines changed

‎README.md‎

Lines changed: 164 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,140 @@ Please note that we strive to provide a comprehensive suite of documentation for
2525

2626
## Usage
2727

28+
### EKS Auto Mode
29+
30+
```hcl
31+
module "eks" {
32+
source = "terraform-aws-modules/eks/aws"
33+
version = "~> 20.31"
34+
35+
cluster_name = "example"
36+
cluster_version = "1.31"
37+
38+
# Optional
39+
cluster_endpoint_public_access = true
40+
41+
# Optional: Adds the current caller identity as an administrator via cluster access entry
42+
enable_cluster_creator_admin_permissions = true
43+
44+
cluster_compute_config = {
45+
enabled = true
46+
node_pools = ["general-purpose"]
47+
}
48+
49+
vpc_id = "vpc-1234556abcdef"
50+
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
51+
52+
tags = {
53+
Environment = "dev"
54+
Terraform = "true"
55+
}
56+
}
57+
```
58+
59+
### EKS Hybrid Nodes
60+
61+
```hcl
62+
locals {
63+
# RFC 1918 IP ranges supported
64+
remote_network_cidr = "172.16.0.0/16"
65+
remote_node_cidr = cidrsubnet(local.remote_network_cidr, 2, 0)
66+
remote_pod_cidr = cidrsubnet(local.remote_network_cidr, 2, 1)
67+
}
68+
69+
# SSM and IAM Roles Anywhere supported - SSM is default
70+
module "eks_hybrid_node_role" {
71+
source = "terraform-aws-modules/eks/aws//modules/hybrid-node-role"
72+
version = "~> 20.31"
73+
74+
tags = {
75+
Environment = "dev"
76+
Terraform = "true"
77+
}
78+
}
79+
80+
module "eks" {
81+
source = "terraform-aws-modules/eks/aws"
82+
version = "~> 20.31"
83+
84+
cluster_name = "example"
85+
cluster_version = "1.31"
86+
87+
cluster_addons = {
88+
coredns = {}
89+
eks-pod-identity-agent = {}
90+
kube-proxy = {}
91+
vpc-cni = {}
92+
}
93+
94+
# Optional
95+
cluster_endpoint_public_access = true
96+
97+
# Optional: Adds the current caller identity as an administrator via cluster access entry
98+
enable_cluster_creator_admin_permissions = true
99+
100+
cluster_security_group_additional_rules = {
101+
hybrid-all = {
102+
cidr_blocks = [local.remote_network_cidr]
103+
description = "Allow all HTTPS traffic from remote node/pod network"
104+
from_port = 443
105+
to_port = 443
106+
protocol = "tcp"
107+
type = "ingress"
108+
}
109+
}
110+
111+
node_security_group_additional_rules = {
112+
hybrid-all = {
113+
cidr_blocks = [local.remote_network_cidr]
114+
description = "Allow all traffic from remote node/pod network"
115+
from_port = "-1"
116+
to_port = "-1"
117+
protocol = "all"
118+
type = "ingress"
119+
}
120+
}
121+
122+
vpc_id = "vpc-1234556abcdef"
123+
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
124+
125+
access_entries = {
126+
hybrid-node-role = {
127+
principal_arn = module.eks_hybrid_node_role.arn
128+
type = "HYBRID_LINUX"
129+
}
130+
}
131+
132+
cluster_remote_network_config = {
133+
remote_node_networks = {
134+
cidrs = [local.remote_node_cidr]
135+
}
136+
# Required if running webhooks on Hybrid nodes
137+
remote_pod_networks = {
138+
cidrs = [local.remote_pod_cidr]
139+
}
140+
}
141+
142+
# Optional
143+
eks_managed_node_groups = {
144+
default = {
145+
instance_types = ["m6i.large"]
146+
147+
min_size = 2
148+
max_size = 5
149+
desired_size = 2
150+
}
151+
}
152+
153+
tags = {
154+
Environment = "dev"
155+
Terraform = "true"
156+
}
157+
}
158+
```
159+
160+
### EKS Managed Node Group
161+
28162
```hcl
29163
module "eks" {
30164
source = "terraform-aws-modules/eks/aws"
@@ -33,15 +167,19 @@ module "eks" {
33167
cluster_name = "my-cluster"
34168
cluster_version = "1.31"
35169
36-
cluster_endpoint_public_access = true
37-
38170
cluster_addons = {
39171
coredns = {}
40172
eks-pod-identity-agent = {}
41173
kube-proxy = {}
42174
vpc-cni = {}
43175
}
44176
177+
# Optional
178+
cluster_endpoint_public_access = true
179+
180+
# Optional: Adds the current caller identity as an administrator via cluster access entry
181+
enable_cluster_creator_admin_permissions = true
182+
45183
vpc_id = "vpc-1234556abcdef"
46184
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
47185
control_plane_subnet_ids = ["subnet-xyzde987", "subnet-slkjf456", "subnet-qeiru789"]
@@ -63,14 +201,30 @@ module "eks" {
63201
}
64202
}
65203
66-
# Cluster access entry
67-
# To add the current caller identity as an administrator
68-
enable_cluster_creator_admin_permissions = true
204+
tags = {
205+
Environment = "dev"
206+
Terraform = "true"
207+
}
208+
}
209+
```
210+
211+
### Cluster Access Entry
212+
213+
When enabling `authentication_mode = "API_AND_CONFIG_MAP"`, EKS will automatically create an access entry for the IAM role(s) used by managed node group(s) and Fargate profile(s). There are no additional actions required by users. For self-managed node groups and the Karpenter sub-module, this project automatically adds the access entry on behalf of users so there are no additional actions required by users.
214+
215+
On clusters that were created prior to CAM support, there will be an existing access entry for the cluster creator. This was previously not visible when using `aws-auth` ConfigMap, but will become visible when access entry is enabled.
216+
217+
```hcl
218+
module "eks" {
219+
source = "terraform-aws-modules/eks/aws"
220+
version = "~> 20.0"
221+
222+
# Truncated for brevity ...
69223
70224
access_entries = {
71225
# One access entry with a policy associated
72226
example = {
73-
principal_arn = "arn:aws:iam::123456789012:role/something"
227+
principal_arn = "arn:aws:iam::123456789012:role/something"
74228
75229
policy_associations = {
76230
example = {
@@ -83,20 +237,9 @@ module "eks" {
83237
}
84238
}
85239
}
86-
87-
tags = {
88-
Environment = "dev"
89-
Terraform = "true"
90-
}
91240
}
92241
```
93242

94-
### Cluster Access Entry
95-
96-
When enabling `authentication_mode = "API_AND_CONFIG_MAP"`, EKS will automatically create an access entry for the IAM role(s) used by managed node group(s) and Fargate profile(s). There are no additional actions required by users. For self-managed node groups and the Karpenter sub-module, this project automatically adds the access entry on behalf of users so there are no additional actions required by users.
97-
98-
On clusters that were created prior to CAM support, there will be an existing access entry for the cluster creator. This was previously not visible when using `aws-auth` ConfigMap, but will become visible when access entry is enabled.
99-
100243
### Bootstrap Cluster Creator Admin Permissions
101244

102245
Setting the `bootstrap_cluster_creator_admin_permissions` is a one time operation when the cluster is created; it cannot be modified later through the EKS API. In this project we are hardcoding this to `false`. If users wish to achieve the same functionality, we will do that through an access entry which can be enabled or disabled at any time of their choosing using the variable `enable_cluster_creator_admin_permissions`
@@ -157,9 +300,11 @@ module "eks" {
157300

158301
## Examples
159302

160-
- [EKS Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks-managed-node-group): EKS Cluster using EKS managed node groups
303+
- [EKS Auto Mode](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks-auto-mode): EKS Cluster with EKS Auto Mode
304+
- [EKS Hybrid Nodes](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks-hybrid-nodes): EKS Cluster with EKS Hybrid nodes
305+
- [EKS Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks-managed-node-group): EKS Cluster with EKS managed node group(s)
161306
- [Karpenter](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/karpenter): EKS Cluster with [Karpenter](https://karpenter.sh/) provisioned for intelligent data plane management
162-
- [Self Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/self-managed-node-group): EKS Cluster using self-managed node groups
307+
- [Self Managed Node Group](https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/self-managed-node-group): EKS Cluster with self-managed node group(s)
163308

164309
## Contributing
165310

‎tests/eks-auto-mode/README.md‎ renamed to ‎examples/eks-auto-mode/README.md‎

File renamed without changes.

‎tests/eks-auto-mode/deployment.yaml‎ renamed to ‎examples/eks-auto-mode/deployment.yaml‎

File renamed without changes.

‎tests/eks-auto-mode/main.tf‎ renamed to ‎examples/eks-auto-mode/main.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,6 @@ module "eks" {
3737
cluster_endpoint_public_access = true
3838

3939
enable_cluster_creator_admin_permissions = true
40-
bootstrap_self_managed_addons = false
41-
42-
authentication_mode = "API"
4340

4441
cluster_compute_config = {
4542
enabled = true

‎tests/eks-auto-mode/outputs.tf‎ renamed to ‎examples/eks-auto-mode/outputs.tf‎

File renamed without changes.

‎tests/eks-auto-mode/variables.tf‎ renamed to ‎examples/eks-auto-mode/variables.tf‎

File renamed without changes.

‎tests/eks-auto-mode/versions.tf‎ renamed to ‎examples/eks-auto-mode/versions.tf‎

File renamed without changes.

‎tests/eks-hybrid-node/.gitignore‎ renamed to ‎examples/eks-hybrid-nodes/.gitignore‎

File renamed without changes.

‎examples/eks-hybrid-nodes/README.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# EKS Hybrid Node IAM Role
2+
3+
## Usage
4+
5+
To provision the provided configurations you need to execute:
6+
7+
```bash
8+
terraform init
9+
terraform apply -target=module.remote_node_vpc -target=local_file.key_pem --auto-approve
10+
cd ami && packer build -var 'ssh_keypair_name=hybrid-node' -var 'ssh_private_key_file=../key.pem' . && cd -
11+
terraform apply --auto-approve
12+
./join.sh
13+
```
14+
15+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGIN_TF_DOCS -->
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.75 |
24+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.16 |
25+
| <a name="requirement_http"></a> [http](#requirement\_http) | >= 3.4 |
26+
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 2.5 |
27+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4.0 |
28+
29+
## Providers
30+
31+
| Name | Version |
32+
|------|---------|
33+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.75 |
34+
| <a name="provider_aws.remote"></a> [aws.remote](#provider\_aws.remote) | >= 5.75 |
35+
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.16 |
36+
| <a name="provider_http"></a> [http](#provider\_http) | >= 3.4 |
37+
| <a name="provider_local"></a> [local](#provider\_local) | >= 2.5 |
38+
39+
## Modules
40+
41+
| Name | Source | Version |
42+
|------|--------|---------|
43+
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
44+
| <a name="module_eks_hybrid_node_role"></a> [eks\_hybrid\_node\_role](#module\_eks\_hybrid\_node\_role) | ../../modules/hybrid-node-role | n/a |
45+
| <a name="module_key_pair"></a> [key\_pair](#module\_key\_pair) | terraform-aws-modules/key-pair/aws | ~> 2.0 |
46+
| <a name="module_remote_node_vpc"></a> [remote\_node\_vpc](#module\_remote\_node\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
47+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
48+
49+
## Resources
50+
51+
| Name | Type |
52+
|------|------|
53+
| [aws_instance.hybrid_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
54+
| [aws_route.peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
55+
| [aws_route.remote_node_private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
56+
| [aws_route.remote_node_public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
57+
| [aws_security_group.remote_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
58+
| [aws_ssm_activation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_activation) | resource |
59+
| [aws_vpc_peering_connection.remote_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection) | resource |
60+
| [aws_vpc_peering_connection_accepter.peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection_accepter) | resource |
61+
| [aws_vpc_security_group_egress_rule.remote_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
62+
| [aws_vpc_security_group_ingress_rule.remote_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
63+
| [helm_release.cilium](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
64+
| [local_file.join](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
65+
| [local_file.key_pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
66+
| [local_file.key_pub_pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
67+
| [aws_ami.hybrid_node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
68+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
69+
| [aws_availability_zones.remote](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
70+
| [http_http.icanhazip](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source |
71+
72+
## Inputs
73+
74+
No inputs.
75+
76+
## Outputs
77+
78+
No outputs.
79+
<!-- END_TF_DOCS -->

‎tests/eks-hybrid-node/ami/amazon-eks-ubuntu.pkr.hcl‎ renamed to ‎examples/eks-hybrid-nodes/ami/amazon-eks-ubuntu.pkr.hcl‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ locals {
1111
}
1212

1313
data "amazon-parameterstore" "this" {
14-
# name = "/aws/service/canonical/ubuntu/server-minimal/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id"
1514
name = "/aws/service/canonical/ubuntu/server-minimal/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id"
1615
region = var.region
1716
}
@@ -297,7 +296,7 @@ build {
297296

298297
"snap install aws-cli --classic",
299298
"snap switch --channel=candidate amazon-ssm-agent",
300-
"aws s3 cp s3://eks-hybrid-beta/v0.0.0-beta.1/bin/linux/amd64/nodeadm /usr/bin/nodeadm",
299+
"curl -OL https://hybrid-assets.eks.amazonaws.com/releases/latest/bin/linux/amd64/nodeadm /usr/bin/",
301300
"chmod +x /usr/bin/nodeadm",
302301
"nodeadm install ${var.eks_version} --credential-provider ${var.credential_provider}",
303302
]

0 commit comments

Comments
 (0)