xpk/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/terraform-aws-modules/terraform-aws-eks.git synced 2025-09-09 19:32:58 +08:00
Code Activity

feat!: Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#3412)

Browse Source 
* feat!: Upgrade min AWS provider and Terraform versions to `6.0` and `1.5.7` respectively

* fix: Remove deprecated arguments in AWS v6.0 provider, upgrade Helm provider to v3.0, bump VPC module to v6.0

* fix: Remove `aws-auth` sub-module

* fix: Remove `platform` and `cluster_service_ipv4_cidr` variables from `user-data` sub-module

* fix: Resolve all marked `todos` that have been accumulated

* fix: Set default `http_put_response_hop_limit` to `1`

* fix: Remove IRSA support from Karpenter sub-module

* fix: Avoid making GET requests from data sources unless absolutely necessary

* feat: Add variable optional attribute definitions

* feat: Bump KMS key module version to latest, add remaining variable attribute definitions

* fix: Remove `cluster_` prefix from variable names to better match the underlying API

* fix: Move all EFA logic to the nodegroup itself

* fix: Remove arguments that do not make sense in EKS

* fix: Updates from plan validation

* fix: Remove more self-managed node group attributes that are commonly not used in EKS clusters

* fix: Remove data plane compute `*_defaults` variables that do not work with variable optional attributes

* fix: Ignore changes to `bootstrap_self_managed_addons` to aid in upgrade

* feat: Add support for `region` argument on relevant resources

* feat: Initial pass on upgrade guide

* fix: Updates from testing and validating EKS managed node group

* fix: Updates from testing and validating self-managed node group

* docs: Ensure addon ussage documented is aligned

* feat: Switch to dualstack OIDC issuer URL

* feat: Allow sourcing over overriding the Karpenter assume role policy

* fix: Use `Bool` instead of `StringEquals` for DenyHTTP queue policy

* fix: Correct use of `nullable` and default value propagation
This commit is contained in:
Bryant Biggs
2025-07-23 15:11:01 -05:00
committed by GitHub
parent 8a0efdbbc8
commit 416515a0da
84 changed files with 4111 additions and 3339 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/eks-fargate-profile/README.md
+4 -4
View File
@@ -17,14 +17,14 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
## Providers
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.95, < 6.0.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
## Modules
@@ -33,7 +33,7 @@ Note that this example may create resources which cost money. Run `terraform des
| <a name="module_disabled_fargate_profile"></a> [disabled\_fargate\_profile](#module\_disabled\_fargate\_profile) | ../../modules/fargate-profile | n/a |
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
| <a name="module_fargate_profile"></a> [fargate\_profile](#module\_fargate\_profile) | ../../modules/fargate-profile | n/a |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
## Resources
tests/eks-fargate-profile/main.tf
+14 -16
View File
@@ -11,9 +11,9 @@ data "aws_availability_zones" "available" {
}
locals {
name = "ex-${basename(path.cwd)}"
cluster_version = "1.33"
region = "eu-west-1"
name = "ex-${basename(path.cwd)}"
kubernetes_version = "1.33"
region = "eu-west-1"
vpc_cidr = "10.0.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
@@ -32,11 +32,11 @@ locals {
module "eks" {
source = "../.."
cluster_name = local.name
cluster_version = local.cluster_version
cluster_endpoint_public_access = true
name = local.name
kubernetes_version = local.kubernetes_version
endpoint_public_access = true
cluster_addons = {
addons = {
kube-proxy = {}
vpc-cni = {}
coredns = {
@@ -51,14 +51,8 @@ module "eks" {
control_plane_subnet_ids = module.vpc.intra_subnets
# Fargate profiles use the cluster primary security group so these are not utilized
create_cluster_security_group = false
create_node_security_group = false
fargate_profile_defaults = {
iam_role_additional_policies = {
additional = aws_iam_policy.additional.arn
}
}
create_security_group = false
create_node_security_group = false
fargate_profiles = {
example = {
@@ -78,6 +72,10 @@ module "eks" {
}
]
iam_role_additional_policies = {
additional = aws_iam_policy.additional.arn
}
# Using specific subnets instead of the subnets supplied for the cluster itself
subnet_ids = [module.vpc.private_subnets[1]]
@@ -125,7 +123,7 @@ module "disabled_fargate_profile" {
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
version = "~> 6.0"
name = local.name
cidr = local.vpc_cidr
tests/eks-fargate-profile/versions.tf
+2 -2
View File
@@ -1,10 +1,10 @@
terraform {
required_version = ">= 1.3.2"
required_version = ">= 1.5.7"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.95, < 6.0.0"
version = ">= 6.0"
}
}
}
tests/eks-hybrid-nodes/README.md
+2 -2
View File
@@ -17,8 +17,8 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4.0 |
## Providers
tests/eks-hybrid-nodes/versions.tf
+2 -2
View File
@@ -1,10 +1,10 @@
terraform {
required_version = ">= 1.3.2"
required_version = ">= 1.5.7"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.95, < 6.0.0"
version = ">= 6.0"
}
tls = {
source = "hashicorp/tls"
tests/eks-managed-node-group/README.md
+5 -5
View File
@@ -17,14 +17,14 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
## Providers
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.95, < 6.0.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
## Modules
@@ -33,11 +33,11 @@ Note that this example may create resources which cost money. Run `terraform des
| <a name="module_aws_vpc_cni_ipv6_pod_identity"></a> [aws\_vpc\_cni\_ipv6\_pod\_identity](#module\_aws\_vpc\_cni\_ipv6\_pod\_identity) | terraform-aws-modules/eks-pod-identity/aws | ~> 1.6 |
| <a name="module_disabled_eks"></a> [disabled\_eks](#module\_disabled\_eks) | ../.. | n/a |
| <a name="module_disabled_eks_managed_node_group"></a> [disabled\_eks\_managed\_node\_group](#module\_disabled\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
| <a name="module_ebs_kms_key"></a> [ebs\_kms\_key](#module\_ebs\_kms\_key) | terraform-aws-modules/kms/aws | ~> 2.1 |
| <a name="module_ebs_kms_key"></a> [ebs\_kms\_key](#module\_ebs\_kms\_key) | terraform-aws-modules/kms/aws | ~> 4.0 |
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
| <a name="module_eks_managed_node_group"></a> [eks\_managed\_node\_group](#module\_eks\_managed\_node\_group) | ../../modules/eks-managed-node-group | n/a |
| <a name="module_key_pair"></a> [key\_pair](#module\_key\_pair) | terraform-aws-modules/key-pair/aws | ~> 2.0 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
## Resources
tests/eks-managed-node-group/main.tf
+18 -31
View File
@@ -13,9 +13,9 @@ data "aws_availability_zones" "available" {
}
locals {
name = "ex-${replace(basename(path.cwd), "_", "-")}"
cluster_version = "1.33"
region = "eu-west-1"
name = "ex-${replace(basename(path.cwd), "_", "-")}"
kubernetes_version = "1.33"
region = "eu-west-1"
vpc_cidr = "10.0.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
@@ -34,21 +34,17 @@ locals {
module "eks" {
source = "../.."
cluster_name = local.name
cluster_version = local.cluster_version
cluster_endpoint_public_access = true
name = local.name
kubernetes_version = local.kubernetes_version
endpoint_public_access = true
# IPV6
cluster_ip_family = "ipv6"
ip_family = "ipv6"
create_cni_ipv6_iam_policy = true
enable_cluster_creator_admin_permissions = true
# Enable EFA support by adding necessary security group rules
# to the shared node security group
enable_efa_support = true
cluster_addons = {
addons = {
coredns = {
most_recent = true
}
@@ -79,11 +75,11 @@ module "eks" {
}
}
cluster_upgrade_policy = {
upgrade_policy = {
support_type = "STANDARD"
}
cluster_zonal_shift_config = {
zonal_shift_config = {
enabled = true
}
@@ -91,11 +87,6 @@ module "eks" {
subnet_ids = module.vpc.private_subnets
control_plane_subnet_ids = module.vpc.intra_subnets
eks_managed_node_group_defaults = {
ami_type = "AL2023_x86_64_STANDARD"
instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
}
eks_managed_node_groups = {
# Default node group - as provided by AWS EKS
default_node_group = {
@@ -114,8 +105,8 @@ module "eks" {
placement_group = {
create_placement_group = true
# forces the subnet lookup to be restricted to this availability zone
placement_group_az = element(local.azs, 3)
subnet_ids = slice(module.vpc.private_subnets, 0, 1)
instance_types = ["m5.large", "m5n.large", "m5zn.large"]
}
# AL2023 node group utilizing new user data format which utilizes nodeadm
@@ -135,8 +126,6 @@ module "eks" {
kubelet:
config:
shutdownGracePeriod: 30s
featureGates:
DisableKubeletCloudCredentialProviders: true
EOT
}
]
@@ -238,8 +227,6 @@ module "eks" {
kubelet:
config:
shutdownGracePeriod: 30s
featureGates:
DisableKubeletCloudCredentialProviders: true
EOT
content_type = "application/node.eks.aws"
}]
@@ -359,7 +346,7 @@ module "eks" {
# This will:
# 1. Create a placement group to place the instances close to one another
# 2. Ignore subnets that reside in AZs that do not support the instance type
# 2. Create and attach the necessary security group rules (and security group)
# 3. Expose all of the available EFA interfaces on the launch template
enable_efa_support = true
enable_efa_only = true
@@ -476,7 +463,7 @@ module "disabled_eks_managed_node_group" {
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
version = "~> 6.0"
name = local.name
cidr = local.vpc_cidr
@@ -523,7 +510,7 @@ module "aws_vpc_cni_ipv6_pod_identity" {
module "ebs_kms_key" {
source = "terraform-aws-modules/kms/aws"
version = "~> 2.1"
version = "~> 4.0"
description = "Customer managed key to encrypt EKS managed node group volumes"
@@ -605,7 +592,7 @@ data "aws_ami" "eks_default" {
filter {
name = "name"
values = ["amazon-eks-node-al2023-x86_64-standard-${local.cluster_version}-v*"]
values = ["amazon-eks-node-al2023-x86_64-standard-${local.kubernetes_version}-v*"]
}
}
@@ -615,7 +602,7 @@ data "aws_ami" "eks_default_arm" {
filter {
name = "name"
values = ["amazon-eks-node-al2023-arm64-standard-${local.cluster_version}-v*"]
values = ["amazon-eks-node-al2023-arm64-standard-${local.kubernetes_version}-v*"]
}
}
@@ -625,7 +612,7 @@ data "aws_ami" "eks_default_bottlerocket" {
filter {
name = "name"
values = ["bottlerocket-aws-k8s-${local.cluster_version}-x86_64-*"]
values = ["bottlerocket-aws-k8s-${local.kubernetes_version}-x86_64-*"]
}
}
tests/eks-managed-node-group/versions.tf
+2 -2
View File
@@ -1,10 +1,10 @@
terraform {
required_version = ">= 1.3.2"
required_version = ">= 1.5.7"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.95, < 6.0.0"
version = ">= 6.0"
}
}
}
tests/fast-addons/README.md
-92
View File
@@ -1,92 +0,0 @@
# Fast Addons
Refer to https://github.com/terraform-aws-modules/terraform-aws-eks/pull/3214 for additional information.
<!-- TODO - remove this at next breaking change since the defaults will be in place -->
## Usage
To provision the provided configurations you need to execute:
```bash
$ terraform init
$ terraform plan
$ terraform apply --auto-approve
```
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
<!-- BEGIN_TF_DOCS -->
## Requirements
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
## Providers
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.95, < 6.0.0 |
## Modules
| Name | Source | Version |
|------|--------|---------|
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
## Resources
| Name | Type |
|------|------|
| [aws_route_table_association.custom_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
| [aws_subnet.custom_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
| [aws_vpc_ipv4_cidr_block_association.custom_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipv4_cidr_block_association) | resource |
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
## Inputs
No inputs.
## Outputs
| Name | Description |
|------|-------------|
| <a name="output_access_entries"></a> [access\_entries](#output\_access\_entries) | Map of access entries created and their attributes |
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster |
| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
| <a name="output_cluster_dualstack_oidc_issuer_url"></a> [cluster\_dualstack\_oidc\_issuer\_url](#output\_cluster\_dualstack\_oidc\_issuer\_url) | Dual-stack compatible URL on the EKS cluster for the OpenID Connect identity provider |
| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server |
| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster |
| <a name="output_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#output\_cluster\_iam\_role\_name) | IAM role name of the EKS cluster |
| <a name="output_cluster_iam_role_unique_id"></a> [cluster\_iam\_role\_unique\_id](#output\_cluster\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts |
| <a name="output_cluster_identity_providers"></a> [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled |
| <a name="output_cluster_ip_family"></a> [cluster\_ip\_family](#output\_cluster\_ip\_family) | The IP family used by the cluster (e.g. `ipv4` or `ipv6`) |
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster |
| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider |
| <a name="output_cluster_platform_version"></a> [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster |
| <a name="output_cluster_primary_security_group_id"></a> [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console |
| <a name="output_cluster_security_group_arn"></a> [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group |
| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group |
| <a name="output_cluster_service_cidr"></a> [cluster\_service\_cidr](#output\_cluster\_service\_cidr) | The CIDR block where Kubernetes pod and service IP addresses are assigned from |
| <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` |
| <a name="output_cluster_tls_certificate_sha1_fingerprint"></a> [cluster\_tls\_certificate\_sha1\_fingerprint](#output\_cluster\_tls\_certificate\_sha1\_fingerprint) | The SHA1 fingerprint of the public key of the cluster's certificate |
| <a name="output_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created |
| <a name="output_eks_managed_node_groups_autoscaling_group_names"></a> [eks\_managed\_node\_groups\_autoscaling\_group\_names](#output\_eks\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by EKS managed node groups |
| <a name="output_fargate_profiles"></a> [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created |
| <a name="output_kms_key_arn"></a> [kms\_key\_arn](#output\_kms\_key\_arn) | The Amazon Resource Name (ARN) of the key |
| <a name="output_kms_key_id"></a> [kms\_key\_id](#output\_kms\_key\_id) | The globally unique identifier for the key |
| <a name="output_kms_key_policy"></a> [kms\_key\_policy](#output\_kms\_key\_policy) | The IAM resource policy set on the key |
| <a name="output_node_security_group_arn"></a> [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group |
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
| <a name="output_oidc_provider"></a> [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) |
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
| <a name="output_self_managed_node_groups_autoscaling_group_names"></a> [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups |
<!-- END_TF_DOCS -->
tests/fast-addons/main.tf
-159
View File
@@ -1,159 +0,0 @@
provider "aws" {
region = local.region
}
locals {
name = "ex-${basename(path.cwd)}"
cluster_version = "1.33"
region = "eu-west-1"
tags = {
Test = local.name
GithubRepo = "terraform-aws-eks"
GithubOrg = "terraform-aws-modules"
}
}
################################################################################
# EKS Module
################################################################################
module "eks" {
source = "../.."
cluster_name = local.name
cluster_version = local.cluster_version
cluster_endpoint_public_access = true
enable_cluster_creator_admin_permissions = true
# Disable the default self-managed addons to avoid the penalty of adopting them later
bootstrap_self_managed_addons = false
# Addons will be provisioned net new via the EKS addon API
cluster_addons = {
coredns = {
most_recent = true
}
eks-pod-identity-agent = {
before_compute = true
most_recent = true
}
kube-proxy = {
most_recent = true
}
vpc-cni = {
most_recent = true
before_compute = true
configuration_values = jsonencode({
env = {
# Use subnet tags to avoid the need to inject the ENIConfig
# which requires a live API server endpoint which leads to a dependency of:
# Control plane -> API request to create ENIConfig -> VPC CNI addon -> nodes/compute
# With the subnet discovery feature, we can avoid this dependency:
# Control plane -> VPC CNI addon -> nodes/compute
ENABLE_SUBNET_DISCOVERY = "true"
}
})
}
}
vpc_id = module.vpc.vpc_id
subnet_ids = module.vpc.private_subnets
eks_managed_node_groups = {
example = {
instance_types = ["m6i.large"]
min_size = 2
max_size = 5
desired_size = 2
}
}
tags = local.tags
}
################################################################################
# VPC
################################################################################
data "aws_availability_zones" "available" {
# Exclude local zones
filter {
name = "opt-in-status"
values = ["opt-in-not-required"]
}
}
locals {
vpc_cidr = "10.0.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
name = local.name
cidr = local.vpc_cidr
azs = local.azs
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
enable_nat_gateway = true
single_nat_gateway = true
public_subnet_tags = {
"kubernetes.io/role/elb" = 1
}
tags = local.tags
}
################################################################################
# Custom Networking
################################################################################
locals {
custom_network_vpc_cidr = "10.99.0.0/16"
custom_network_subnets = [for k, v in local.azs : cidrsubnet(local.custom_network_vpc_cidr, 4, k)]
}
resource "aws_vpc_ipv4_cidr_block_association" "custom_network" {
vpc_id = module.vpc.vpc_id
cidr_block = local.custom_network_vpc_cidr
}
resource "aws_subnet" "custom_network" {
count = length(local.custom_network_subnets)
vpc_id = module.vpc.vpc_id
cidr_block = element(local.custom_network_subnets, count.index)
tags = merge(
local.tags,
{
# Tag for subnet discovery
"kubernetes.io/role/cni" = 1
"kubernetes.io/role/internal-elb" = 1
}
)
depends_on = [
aws_vpc_ipv4_cidr_block_association.custom_network
]
}
resource "aws_route_table_association" "custom_network" {
count = length(local.custom_network_subnets)
subnet_id = element(aws_subnet.custom_network[*].id, count.index)
route_table_id = element(module.vpc.private_route_table_ids, 0)
depends_on = [
aws_vpc_ipv4_cidr_block_association.custom_network
]
}
tests/fast-addons/outputs.tf
-226
View File
@@ -1,226 +0,0 @@
################################################################################
# Cluster
################################################################################
output "cluster_arn" {
description = "The Amazon Resource Name (ARN) of the cluster"
value = module.eks.cluster_arn
}
output "cluster_certificate_authority_data" {
description = "Base64 encoded certificate data required to communicate with the cluster"
value = module.eks.cluster_certificate_authority_data
}
output "cluster_endpoint" {
description = "Endpoint for your Kubernetes API server"
value = module.eks.cluster_endpoint
}
output "cluster_id" {
description = "The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts"
value = module.eks.cluster_id
}
output "cluster_name" {
description = "The name of the EKS cluster"
value = module.eks.cluster_name
}
output "cluster_oidc_issuer_url" {
description = "The URL on the EKS cluster for the OpenID Connect identity provider"
value = module.eks.cluster_oidc_issuer_url
}
output "cluster_dualstack_oidc_issuer_url" {
description = "Dual-stack compatible URL on the EKS cluster for the OpenID Connect identity provider"
value = module.eks.cluster_dualstack_oidc_issuer_url
}
output "cluster_platform_version" {
description = "Platform version for the cluster"
value = module.eks.cluster_platform_version
}
output "cluster_status" {
description = "Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`"
value = module.eks.cluster_status
}
output "cluster_primary_security_group_id" {
description = "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console"
value = module.eks.cluster_primary_security_group_id
}
output "cluster_service_cidr" {
description = "The CIDR block where Kubernetes pod and service IP addresses are assigned from"
value = module.eks.cluster_service_cidr
}
output "cluster_ip_family" {
description = "The IP family used by the cluster (e.g. `ipv4` or `ipv6`)"
value = module.eks.cluster_ip_family
}
################################################################################
# Access Entry
################################################################################
output "access_entries" {
description = "Map of access entries created and their attributes"
value = module.eks.access_entries
}
################################################################################
# KMS Key
################################################################################
output "kms_key_arn" {
description = "The Amazon Resource Name (ARN) of the key"
value = module.eks.kms_key_arn
}
output "kms_key_id" {
description = "The globally unique identifier for the key"
value = module.eks.kms_key_id
}
output "kms_key_policy" {
description = "The IAM resource policy set on the key"
value = module.eks.kms_key_policy
}
################################################################################
# Security Group
################################################################################
output "cluster_security_group_arn" {
description = "Amazon Resource Name (ARN) of the cluster security group"
value = module.eks.cluster_security_group_arn
}
output "cluster_security_group_id" {
description = "ID of the cluster security group"
value = module.eks.cluster_security_group_id
}
################################################################################
# Node Security Group
################################################################################
output "node_security_group_arn" {
description = "Amazon Resource Name (ARN) of the node shared security group"
value = module.eks.node_security_group_arn
}
output "node_security_group_id" {
description = "ID of the node shared security group"
value = module.eks.node_security_group_id
}
################################################################################
# IRSA
################################################################################
output "oidc_provider" {
description = "The OpenID Connect identity provider (issuer URL without leading `https://`)"
value = module.eks.oidc_provider
}
output "oidc_provider_arn" {
description = "The ARN of the OIDC Provider if `enable_irsa = true`"
value = module.eks.oidc_provider_arn
}
output "cluster_tls_certificate_sha1_fingerprint" {
description = "The SHA1 fingerprint of the public key of the cluster's certificate"
value = module.eks.cluster_tls_certificate_sha1_fingerprint
}
################################################################################
# IAM Role
################################################################################
output "cluster_iam_role_name" {
description = "IAM role name of the EKS cluster"
value = module.eks.cluster_iam_role_name
}
output "cluster_iam_role_arn" {
description = "IAM role ARN of the EKS cluster"
value = module.eks.cluster_iam_role_arn
}
output "cluster_iam_role_unique_id" {
description = "Stable and unique string identifying the IAM role"
value = module.eks.cluster_iam_role_unique_id
}
################################################################################
# EKS Addons
################################################################################
output "cluster_addons" {
description = "Map of attribute maps for all EKS cluster addons enabled"
value = module.eks.cluster_addons
}
################################################################################
# EKS Identity Provider
################################################################################
output "cluster_identity_providers" {
description = "Map of attribute maps for all EKS identity providers enabled"
value = module.eks.cluster_identity_providers
}
################################################################################
# CloudWatch Log Group
################################################################################
output "cloudwatch_log_group_name" {
description = "Name of cloudwatch log group created"
value = module.eks.cloudwatch_log_group_name
}
output "cloudwatch_log_group_arn" {
description = "Arn of cloudwatch log group created"
value = module.eks.cloudwatch_log_group_arn
}
################################################################################
# Fargate Profile
################################################################################
output "fargate_profiles" {
description = "Map of attribute maps for all EKS Fargate Profiles created"
value = module.eks.fargate_profiles
}
################################################################################
# EKS Managed Node Group
################################################################################
output "eks_managed_node_groups" {
description = "Map of attribute maps for all EKS managed node groups created"
value = module.eks.eks_managed_node_groups
}
output "eks_managed_node_groups_autoscaling_group_names" {
description = "List of the autoscaling group names created by EKS managed node groups"
value = module.eks.eks_managed_node_groups_autoscaling_group_names
}
################################################################################
# Self Managed Node Group
################################################################################
output "self_managed_node_groups" {
description = "Map of attribute maps for all self managed node groups created"
value = module.eks.self_managed_node_groups
}
output "self_managed_node_groups_autoscaling_group_names" {
description = "List of the autoscaling group names created by self-managed node groups"
value = module.eks.self_managed_node_groups_autoscaling_group_names
}
tests/fast-addons/variables.tf
View File
tests/fast-addons/versions.tf
-10
View File
@@ -1,10 +0,0 @@
terraform {
required_version = ">= 1.3.2"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.95, < 6.0.0"
}
}
}
tests/self-managed-node-group/README.md
+6 -6
View File
@@ -17,14 +17,14 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
## Providers
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.95, < 6.0.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
## Modules
@@ -32,11 +32,11 @@ Note that this example may create resources which cost money. Run `terraform des
|------|--------|---------|
| <a name="module_aws_vpc_cni_ipv4_pod_identity"></a> [aws\_vpc\_cni\_ipv4\_pod\_identity](#module\_aws\_vpc\_cni\_ipv4\_pod\_identity) | terraform-aws-modules/eks-pod-identity/aws | ~> 1.6 |
| <a name="module_disabled_self_managed_node_group"></a> [disabled\_self\_managed\_node\_group](#module\_disabled\_self\_managed\_node\_group) | ../../modules/self-managed-node-group | n/a |
| <a name="module_ebs_kms_key"></a> [ebs\_kms\_key](#module\_ebs\_kms\_key) | terraform-aws-modules/kms/aws | ~> 2.0 |
| <a name="module_ebs_kms_key"></a> [ebs\_kms\_key](#module\_ebs\_kms\_key) | terraform-aws-modules/kms/aws | ~> 4.0 |
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
| <a name="module_key_pair"></a> [key\_pair](#module\_key\_pair) | terraform-aws-modules/key-pair/aws | ~> 2.0 |
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 2.1 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 4.0 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
## Resources
tests/self-managed-node-group/main.tf
+55 -57
View File
@@ -13,9 +13,9 @@ data "aws_availability_zones" "available" {
}
locals {
name = "ex-${replace(basename(path.cwd), "_", "-")}"
cluster_version = "1.33"
region = "eu-west-1"
name = "ex-${replace(basename(path.cwd), "_", "-")}"
kubernetes_version = "1.33"
region = "eu-west-1"
vpc_cidr = "10.0.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
@@ -34,28 +34,26 @@ locals {
module "eks" {
source = "../.."
cluster_name = local.name
cluster_version = local.cluster_version
cluster_endpoint_public_access = true
name = local.name
kubernetes_version = local.kubernetes_version
endpoint_public_access = true
enable_cluster_creator_admin_permissions = true
# Enable EFA support by adding necessary security group rules
# to the shared node security group
enable_efa_support = true
cluster_addons = {
addons = {
coredns = {
most_recent = true
}
eks-pod-identity-agent = {
most_recent = true
before_compute = true
most_recent = true
}
kube-proxy = {
most_recent = true
}
vpc-cni = {
most_recent = true
before_compute = true
most_recent = true
pod_identity_association = [{
role_arn = module.aws_vpc_cni_ipv4_pod_identity.iam_role_arn
service_account = "aws-node"
@@ -69,25 +67,23 @@ module "eks" {
# External encryption key
create_kms_key = false
cluster_encryption_config = {
encryption_config = {
resources = ["secrets"]
provider_key_arn = module.kms.key_arn
}
self_managed_node_group_defaults = {
ami_type = "AL2023_x86_64_STANDARD"
ami_id = data.aws_ami.eks_default.image_id
# enable discovery of autoscaling groups by cluster-autoscaler
autoscaling_group_tags = {
"k8s.io/cluster-autoscaler/enabled" : true,
"k8s.io/cluster-autoscaler/${local.name}" : "owned",
}
}
self_managed_node_groups = {
# Default node group - as provisioned by the module defaults
default_node_group = {}
default_node_group = {
ami_type = "AL2023_x86_64_STANDARD"
ami_id = data.aws_ami.eks_default.image_id
# enable discovery of autoscaling groups by cluster-autoscaler
autoscaling_group_tags = {
"k8s.io/cluster-autoscaler/enabled" : true,
"k8s.io/cluster-autoscaler/${local.name}" : "owned",
}
}
# Bottlerocket node group
bottlerocket = {
@@ -153,16 +149,18 @@ module "eks" {
spot_allocation_strategy = "capacity-optimized"
}
override = [
{
instance_type = "m5.large"
weighted_capacity = "1"
},
{
instance_type = "m6i.large"
weighted_capacity = "2"
},
]
launch_template = {
override = [
{
instance_type = "m5.large"
weighted_capacity = "1"
},
{
instance_type = "m6i.large"
weighted_capacity = "2"
},
]
}
}
}
@@ -232,8 +230,6 @@ module "eks" {
kubelet:
config:
shutdownGracePeriod: 30s
featureGates:
DisableKubeletCloudCredentialProviders: true
EOT
content_type = "application/node.eks.aws"
}]
@@ -263,28 +259,30 @@ module "eks" {
}
# ASG configuration
override = [
{
instance_requirements = {
cpu_manufacturers = ["intel"]
instance_generations = ["current", "previous"]
spot_max_price_percentage_over_lowest_price = 100
launch_template = {
override = [
{
instance_requirements = {
cpu_manufacturers = ["intel"]
instance_generations = ["current", "previous"]
spot_max_price_percentage_over_lowest_price = 100
vcpu_count = {
min = 1
vcpu_count = {
min = 1
}
allowed_instance_types = ["t*", "m*"]
}
allowed_instance_types = ["t*", "m*"]
}
}
]
]
}
}
}
metadata_options = {
http_endpoint = "enabled"
http_tokens = "required"
http_put_response_hop_limit = 2
http_put_response_hop_limit = 1
instance_metadata_tags = "disabled"
}
@@ -334,7 +332,7 @@ module "eks" {
# This will:
# 1. Create a placement group to place the instances close to one another
# 2. Ignore subnets that reside in AZs that do not support the instance type
# 2. Create and attach the necessary security group rules (and security group)
# 3. Expose all of the available EFA interfaces on the launch template
enable_efa_support = true
enable_efa_only = true
@@ -378,7 +376,7 @@ module "disabled_self_managed_node_group" {
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
version = "~> 6.0"
name = local.name
cidr = local.vpc_cidr
@@ -420,7 +418,7 @@ data "aws_ami" "eks_default" {
filter {
name = "name"
values = ["amazon-eks-node-al2023-x86_64-standard-${local.cluster_version}-v*"]
values = ["amazon-eks-node-al2023-x86_64-standard-${local.kubernetes_version}-v*"]
}
}
@@ -430,7 +428,7 @@ data "aws_ami" "eks_default_bottlerocket" {
filter {
name = "name"
values = ["bottlerocket-aws-k8s-${local.cluster_version}-x86_64-*"]
values = ["bottlerocket-aws-k8s-${local.kubernetes_version}-x86_64-*"]
}
}
@@ -446,7 +444,7 @@ module "key_pair" {
module "ebs_kms_key" {
source = "terraform-aws-modules/kms/aws"
version = "~> 2.0"
version = "~> 4.0"
description = "Customer managed key to encrypt EKS managed node group volumes"
@@ -470,7 +468,7 @@ module "ebs_kms_key" {
module "kms" {
source = "terraform-aws-modules/kms/aws"
version = "~> 2.1"
version = "~> 4.0"
aliases = ["eks/${local.name}"]
description = "${local.name} cluster encryption key"
tests/self-managed-node-group/versions.tf
+2 -2
View File
@@ -1,10 +1,10 @@
terraform {
required_version = ">= 1.3.2"
required_version = ">= 1.5.7"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.95, < 6.0.0"
version = ">= 6.0"
}
}
}
tests/user-data/README.md
+1 -1
View File
@@ -17,7 +17,7 @@ $ terraform apply --auto-approve
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 2.4 |
## Providers
tests/user-data/main.tf
+14 -1
View File
@@ -15,13 +15,15 @@ locals {
module "eks_mng_al2_disabled" {
source = "../../modules/_user_data"
create = false
ami_type = "AL2_x86_64"
create = false
}
module "eks_mng_al2_no_op" {
source = "../../modules/_user_data"
# Hard requirement
ami_type = "AL2_x86_64"
cluster_service_cidr = local.cluster_service_cidr
}
@@ -29,6 +31,7 @@ module "eks_mng_al2_additional" {
source = "../../modules/_user_data"
# Hard requirement
ami_type = "AL2_x86_64"
cluster_service_cidr = local.cluster_service_cidr
pre_bootstrap_user_data = <<-EOT
@@ -39,6 +42,7 @@ module "eks_mng_al2_additional" {
module "eks_mng_al2_custom_ami" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
cluster_name = local.name
cluster_endpoint = local.cluster_endpoint
cluster_auth_base64 = local.cluster_auth_base64
@@ -60,6 +64,7 @@ module "eks_mng_al2_custom_ami" {
module "eks_mng_al2_custom_ami_ipv6" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
cluster_name = local.name
cluster_endpoint = local.cluster_endpoint
cluster_auth_base64 = local.cluster_auth_base64
@@ -82,6 +87,7 @@ module "eks_mng_al2_custom_ami_ipv6" {
module "eks_mng_al2_custom_template" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
cluster_name = local.name
cluster_endpoint = local.cluster_endpoint
cluster_auth_base64 = local.cluster_auth_base64
@@ -364,12 +370,15 @@ module "self_mng_al2_no_op" {
is_eks_managed_node_group = false
# Hard requirement
ami_type = "AL2_x86_64"
cluster_service_cidr = local.cluster_service_cidr
}
module "self_mng_al2_bootstrap" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
enable_bootstrap_user_data = true
is_eks_managed_node_group = false
@@ -393,6 +402,8 @@ module "self_mng_al2_bootstrap" {
module "self_mng_al2_bootstrap_ipv6" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
enable_bootstrap_user_data = true
is_eks_managed_node_group = false
@@ -417,6 +428,8 @@ module "self_mng_al2_bootstrap_ipv6" {
module "self_mng_al2_custom_template" {
source = "../../modules/_user_data"
ami_type = "AL2_x86_64"
enable_bootstrap_user_data = true
is_eks_managed_node_group = false
tests/user-data/versions.tf
+1 -1
View File
@@ -1,5 +1,5 @@
terraform {
required_version = ">= 1.3.2"
required_version = ">= 1.5.7"
required_providers {
local = {