mirror of
https://github.com/terraform-aws-modules/terraform-aws-eks.git
synced 2025-09-09 19:32:58 +08:00
Bryant Biggs
416515a0da
* feat!: Upgrade min AWS provider and Terraform versions to `6.0` and `1.5.7` respectively * fix: Remove deprecated arguments in AWS v6.0 provider, upgrade Helm provider to v3.0, bump VPC module to v6.0 * fix: Remove `aws-auth` sub-module * fix: Remove `platform` and `cluster_service_ipv4_cidr` variables from `user-data` sub-module * fix: Resolve all marked `todos` that have been accumulated * fix: Set default `http_put_response_hop_limit` to `1` * fix: Remove IRSA support from Karpenter sub-module * fix: Avoid making GET requests from data sources unless absolutely necessary * feat: Add variable optional attribute definitions * feat: Bump KMS key module version to latest, add remaining variable attribute definitions * fix: Remove `cluster_` prefix from variable names to better match the underlying API * fix: Move all EFA logic to the nodegroup itself * fix: Remove arguments that do not make sense in EKS * fix: Updates from plan validation * fix: Remove more self-managed node group attributes that are commonly not used in EKS clusters * fix: Remove data plane compute `*_defaults` variables that do not work with variable optional attributes * fix: Ignore changes to `bootstrap_self_managed_addons` to aid in upgrade * feat: Add support for `region` argument on relevant resources * feat: Initial pass on upgrade guide * fix: Updates from testing and validating EKS managed node group * fix: Updates from testing and validating self-managed node group * docs: Ensure addon ussage documented is aligned * feat: Switch to dualstack OIDC issuer URL * feat: Allow sourcing over overriding the Karpenter assume role policy * fix: Use `Bool` instead of `StringEquals` for DenyHTTP queue policy * fix: Correct use of `nullable` and default value propagation
58 lines
1.6 KiB
Terraform
58 lines
1.6 KiB
Terraform
module "eks_bottlerocket" {
|
|
# source = "terraform-aws-modules/eks/aws"
|
|
# version = "~> 20.0"
|
|
source = "../.."
|
|
|
|
name = "${local.name}-bottlerocket"
|
|
kubernetes_version = "1.33"
|
|
|
|
# EKS Addons
|
|
addons = {
|
|
coredns = {}
|
|
eks-pod-identity-agent = {
|
|
before_compute = true
|
|
}
|
|
kube-proxy = {}
|
|
vpc-cni = {
|
|
before_compute = true
|
|
}
|
|
}
|
|
|
|
vpc_id = module.vpc.vpc_id
|
|
subnet_ids = module.vpc.private_subnets
|
|
|
|
eks_managed_node_groups = {
|
|
example = {
|
|
ami_type = "BOTTLEROCKET_x86_64"
|
|
instance_types = ["m6i.large"]
|
|
|
|
min_size = 2
|
|
max_size = 5
|
|
# This value is ignored after the initial creation
|
|
# https://github.com/bryantbiggs/eks-desired-size-hack
|
|
desired_size = 2
|
|
|
|
# This is not required - demonstrates how to pass additional configuration
|
|
# Ref https://bottlerocket.dev/en/os/1.19.x/api/settings/
|
|
bootstrap_extra_args = <<-EOT
|
|
# The admin host container provides SSH access and runs with "superpowers".
|
|
# It is disabled by default, but can be disabled explicitly.
|
|
[settings.host-containers.admin]
|
|
enabled = false
|
|
|
|
# The control host container provides out-of-band access via SSM.
|
|
# It is enabled by default, and can be disabled if you do not expect to use SSM.
|
|
# This could leave you with no way to access the API and change settings on an existing node!
|
|
[settings.host-containers.control]
|
|
enabled = true
|
|
|
|
# extra args added
|
|
[settings.kernel]
|
|
lockdown = "integrity"
|
|
EOT
|
|
}
|
|
}
|
|
|
|
tags = local.tags
|
|
}
|