Skip to content

Commit a0a834f

Browse files
Nidhi GuptaNidhi Gupta
Nidhi Gupta
authored and
Nidhi Gupta
committed
terraform code
1 parent 5e049ab commit a0a834f

File tree

15 files changed

+477
-105
lines changed

15 files changed

+477
-105
lines changed

‎terraform/automode/access.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,20 @@
22
1️⃣ Create an IAM Group (eks-admin-group)
33
44
This group will contain users who need admin access to EKS.
5-
2️⃣ Create an IAM Role (k8s-admin-role)
5+
2️⃣ Create an IAM Role (eks-admin-role)
66
77
Allows users in the eks-admin-group to assume this role for EKS admin tasks.
88
Trust policy ensures only eks-admin-group members can assume the role.
99
3️⃣ Create an IAM Policy (eks-assume-role-policy)
1010
11-
Grants sts:AssumeRole permission for the k8s-admin-role.
11+
Grants sts:AssumeRole permission for the eks-admin-role.
1212
Attached to the eks-admin-group, allowing its users to assume the role.
1313
4️⃣ Register IAM Role with EKS (aws_eks_access_entry)
1414
15-
Associates k8s-admin-role with the EKS cluster.
15+
Associates eks-admin-role with the EKS cluster.
1616
5️⃣ Attach EKS Admin Policy (aws_eks_access_policy_association)
1717
18-
Grants k8s-admin-role full EKS administrative access
18+
Grants eks-admin-role full EKS administrative access
1919
*/
2020
resource "aws_iam_group" "admin_group" {
2121
name = "eks-admin-group"

‎terraform/automode/data.tf‎

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,5 @@
11
data "aws_caller_identity" "current" {}
22

3-
4-
data "aws_subnets" "private_subnets" {
5-
filter {
6-
name = "vpc-id"
7-
values = [module.vpc.vpc_id]
8-
}
9-
filter {
10-
name = "tag:Name"
11-
values = ["*private*"] # This matches all subnets with a Name tag
12-
}
13-
}
14-
15-
data "aws_subnets" "public_subnets" {
16-
filter {
17-
name = "vpc-id"
18-
values = [module.vpc.vpc_id]
19-
}
20-
filter {
21-
name = "tag:Name"
22-
values = ["*public*"] # This matches all subnets with a Name tag
23-
}
24-
}
25-
263
data "aws_eks_cluster_auth" "cluster" {
274
name = module.eks.cluster_name
285
}

‎terraform/automode/eks.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
module "eks" {
2-
depends_on = [null_resource.wait_60_seconds]
32
source = "terraform-aws-modules/eks/aws"
43
version = "~> 20.31"
54
cluster_name = "eks-automode"
@@ -16,7 +15,7 @@ module "eks" {
1615
support_type = "STANDARD"
1716
}
1817
vpc_id = module.vpc.vpc_id
19-
subnet_ids = data.aws_subnets.private_subnets.ids
18+
subnet_ids = module.vpc.private_subnets
2019

2120
tags = {
2221
Environment = "dev"

‎terraform/automode/kubernetes.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
resource "kubectl_manifest" "ingress_class_params" {
2+
depends_on = [ module.eks ]
23
yaml_body = jsonencode({
34
apiVersion = "eks.amazonaws.com/v1"
45
kind = "IngressClassParams"
@@ -7,17 +8,25 @@ resource "kubectl_manifest" "ingress_class_params" {
78
}
89
spec = {
910
scheme = "internet-facing"
11+
group = {
12+
name = "myapp" /// uses for same ALB for multiple services
13+
}
1014
}
15+
1116
})
1217
}
1318

1419
resource "kubectl_manifest" "ingress_class" {
20+
depends_on = [ module.eks ]
1521
yaml_body = jsonencode({
1622
apiVersion = "networking.k8s.io/v1"
1723
kind = "IngressClass"
1824
metadata = {
1925
name = "eks-auto-alb"
2026
}
27+
annotations = {
28+
"alb.ingress.kubernetes.io/group.name" = "myapp"
29+
}
2130
spec = {
2231
controller = "eks.amazonaws.com/alb"
2332
parameters = {

‎terraform/automode/providers.tf‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,3 @@ provider "kubectl" {
2121
token =data.aws_eks_cluster_auth.cluster.token
2222
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
2323
}
24-
25-
/*provider "kubernetes" {
26-
host = module.eks.cluster_endpoint
27-
token =data.aws_eks_cluster_auth.cluster.token
28-
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
29-
30-
}*/

‎terraform/automode/wait.tf‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎terraform/eks_nodegroup/access.tf‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/*
2+
1️⃣ Create an IAM Group (eks-admin-group)
3+
4+
This group will contain users who need admin access to EKS.
5+
2️⃣ Create an IAM Role (k8s-admin-role)
6+
7+
Allows users in the eks-admin-group to assume this role for EKS admin tasks.
8+
Trust policy ensures only eks-admin-group members can assume the role.
9+
3️⃣ Create an IAM Policy (eks-assume-role-policy)
10+
11+
Grants sts:AssumeRole permission for the k8s-admin-role.
12+
Attached to the eks-admin-group, allowing its users to assume the role.
13+
4️⃣ Register IAM Role with EKS (aws_eks_access_entry)
14+
15+
Associates k8s-admin-role with the EKS cluster.
16+
5️⃣ Attach EKS Admin Policy (aws_eks_access_policy_association)
17+
18+
Grants k8s-admin-role full EKS administrative access
19+
*/
20+
resource "aws_iam_group" "admin_group" {
21+
name = "eks-admin-group"
22+
}
23+
resource "aws_iam_role" "admin_role" {
24+
name = "eks-admin-role"
25+
assume_role_policy = jsonencode({
26+
Version = "2012-10-17",
27+
Statement = [
28+
{
29+
Effect = "Allow",
30+
Principal = {
31+
"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id
32+
}:root"
33+
},
34+
Action = "sts:AssumeRole"
35+
}
36+
]
37+
})
38+
}
39+
40+
resource "aws_iam_role_policy_attachment" "admin_permissions" {
41+
role = aws_iam_role.admin_role.name
42+
policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
43+
}
44+
# Create IAM Policy for AssumeRole
45+
resource "aws_iam_policy" "eks_assume_role_policy" {
46+
name = "eks-assume-role-policy"
47+
description = "Allows users in the group to assume the eks-admins-role"
48+
policy = jsonencode({
49+
Version = "2012-10-17"
50+
Statement = [
51+
{
52+
Effect = "Allow"
53+
Action = "sts:AssumeRole"
54+
Resource = "arn:aws:iam::936379345511:role/${aws_iam_role.admin_role.name}"
55+
}
56+
]
57+
})
58+
}
59+
60+
# Attach Policy to IAM Group
61+
resource "aws_iam_group_policy_attachment" "attach_assume_role_policy" {
62+
group = aws_iam_group.admin_group.name
63+
policy_arn = aws_iam_policy.eks_assume_role_policy.arn
64+
}
65+
66+
resource "aws_eks_access_entry" "example" {
67+
cluster_name = module.eks.cluster_name
68+
principal_arn = aws_iam_role.admin_role.arn
69+
type = "STANDARD"
70+
}
71+
72+
resource "aws_eks_access_policy_association" "example" {
73+
cluster_name = module.eks.cluster_name
74+
policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
75+
principal_arn = aws_iam_role.admin_role.arn
76+
access_scope {
77+
type = "cluster"
78+
}
79+
}
80+
81+
82+

‎terraform/eks_nodegroup/data.tf‎

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,5 @@
1-
data "aws_subnets" "private_subnets" {
2-
filter {
3-
name = "vpc-id"
4-
values = [module.vpc.vpc_id]
5-
}
6-
filter {
7-
name = "tag:Name"
8-
values = ["*private*"] # This matches all subnets with a Name tag
9-
}
10-
}
1+
data "aws_caller_identity" "current" {}
112

12-
data "aws_subnets" "public_subnets" {
13-
filter {
14-
name = "vpc-id"
15-
values = [module.vpc.vpc_id]
16-
}
17-
filter {
18-
name = "tag:Name"
19-
values = ["*public*"] # This matches all subnets with a Name tag
20-
}
3+
data "aws_eks_cluster_auth" "cluster" {
4+
name = module.eks.cluster_name
215
}

‎terraform/eks_nodegroup/eks.tf‎

Lines changed: 5 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11

22
module "eks" {
3-
depends_on = [null_resource.wait_60_seconds]
43
source = "terraform-aws-modules/eks/aws"
54
version = "~> 20.0"
65
cluster_name = "eks-1"
@@ -10,7 +9,6 @@ module "eks" {
109
support_type = "STANDARD"
1110
}
1211
cluster_addons = {
13-
coredns = {}
1412
eks-pod-identity-agent = {}
1513
kube-proxy = {}
1614
vpc-cni = {}
@@ -21,42 +19,13 @@ module "eks" {
2119

2220
# Optional: Adds the current caller identity as an administrator via cluster access entry
2321
enable_cluster_creator_admin_permissions = true
24-
25-
22+
#enable_irsa Determines whether to create an OpenID Connect Provider for EKS to enable IRSA
23+
enable_irsa = true
2624
vpc_id = module.vpc.vpc_id
27-
subnet_ids = data.aws_subnets.private_subnets.ids
28-
control_plane_subnet_ids = data.aws_subnets.private_subnets.ids
29-
tags = {
30-
Environment = "dev"
31-
Terraform = "true"
32-
}
33-
}
34-
35-
module "eks_managed_node_group" {
36-
source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group"
37-
cluster_service_cidr = module.eks.cluster_service_cidr
38-
name = "separate-eks-mng"
39-
cluster_name = module.eks.cluster_name
40-
cluster_version = "1.31"
41-
42-
subnet_ids = data.aws_subnets.private_subnets.ids
43-
cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id
44-
vpc_security_group_ids = [module.eks.node_security_group_id]
45-
min_size = 1
46-
max_size = 2
47-
desired_size = 1
48-
49-
instance_types = ["t3.large"]
50-
capacity_type = "SPOT"
51-
52-
labels = {
53-
Environment = "test"
54-
GithubRepo = "terraform-aws-eks"
55-
GithubOrg = "terraform-aws-modules"
56-
}
57-
25+
subnet_ids = module.vpc.private_subnets
26+
control_plane_subnet_ids = module.vpc.private_subnets
5827
tags = {
5928
Environment = "dev"
6029
Terraform = "true"
6130
}
62-
}
31+
}

‎terraform/eks_nodegroup/helm.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Define the Helm provider
2+
provider "helm" {
3+
kubernetes {
4+
host = module.eks.cluster_endpoint
5+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
6+
token = data.aws_eks_cluster_auth.cluster.token
7+
}
8+
}
9+
10+
# Add the Helm chart repository for AWS Load Balancer Controller
11+
12+
13+
# Install the AWS Load Balancer Controller via Helm
14+
resource "helm_release" "aws_load_balancer_controller" {
15+
depends_on = [module.eks_managed_node_group]
16+
name = "aws-load-balancer-controller"
17+
namespace = "kube-system"
18+
chart = "aws-load-balancer-controller"
19+
repository = "https://aws.github.io/eks-charts"
20+
21+
set {
22+
name = "clusterName"
23+
value = module.eks.cluster_name
24+
}
25+
26+
set {
27+
name = "region"
28+
value = "us-east-1"
29+
}
30+
31+
set {
32+
name = "serviceAccount.create"
33+
value = "true"
34+
}
35+
36+
set {
37+
name = "serviceAccount.name"
38+
value = "aws-load-balancer-controller"
39+
}
40+
41+
set {
42+
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
43+
value = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${aws_iam_role.eks-alb-ingress-controller.name}"
44+
}
45+
}
46+

0 commit comments

Comments
 (0)