The following requirements are needed by this module:
-
terraform (>= 0.13.1)
-
aws (>= 3.40.0)
-
http (>= 2.4.1)
-
kubernetes (>= 1.11.1)
-
local (>= 1.4)
The following providers are used by this module:
-
aws (3.45.0)
-
http (2.4.1)
-
kubernetes (2.3.2)
-
local (2.1.0)
The following Modules are called:
Source: ./modules/addons
Version:
Source: ./modules/fargate
Version:
Source: ./modules/node_groups
Version:
The following resources are used by this module:
- aws_autoscaling_group.workers (resource)
- aws_autoscaling_group.workers_launch_template (resource)
- aws_cloudwatch_log_group.this (resource)
- aws_eks_cluster.this (resource)
- aws_iam_instance_profile.workers (resource)
- aws_iam_instance_profile.workers_launch_template (resource)
- aws_iam_openid_connect_provider.oidc_provider (resource)
- aws_iam_policy.cluster_elb_sl_role_creation (resource)
- aws_iam_role.cluster (resource)
- aws_iam_role.workers (resource)
- aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy (resource)
- aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy (resource)
- aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceControllerPolicy (resource)
- aws_iam_role_policy_attachment.cluster_elb_sl_role_creation (resource)
- aws_iam_role_policy_attachment.workers_AmazonEC2ContainerRegistryReadOnly (resource)
- aws_iam_role_policy_attachment.workers_AmazonEKSWorkerNodePolicy (resource)
- aws_iam_role_policy_attachment.workers_AmazonEKS_CNI_Policy (resource)
- aws_iam_role_policy_attachment.workers_additional_policies (resource)
- aws_launch_configuration.workers (resource)
- aws_launch_template.workers_launch_template (resource)
- aws_security_group.cluster (resource)
- aws_security_group.workers (resource)
- aws_security_group_rule.cluster_egress_internet (resource)
- aws_security_group_rule.cluster_https_worker_ingress (resource)
- aws_security_group_rule.cluster_primary_ingress_workers (resource)
- aws_security_group_rule.cluster_private_access_cidrs_source (resource)
- aws_security_group_rule.cluster_private_access_sg_source (resource)
- aws_security_group_rule.workers_egress_internet (resource)
- aws_security_group_rule.workers_ingress_cluster (resource)
- aws_security_group_rule.workers_ingress_cluster_https (resource)
- aws_security_group_rule.workers_ingress_cluster_kubelet (resource)
- aws_security_group_rule.workers_ingress_cluster_primary (resource)
- aws_security_group_rule.workers_ingress_self (resource)
- kubernetes_config_map.aws_auth (resource)
- local_file.kubeconfig (resource)
- aws_ami.eks_worker (data source)
- aws_ami.eks_worker_windows (data source)
- aws_caller_identity.current (data source)
- aws_iam_instance_profile.custom_worker_group_iam_instance_profile (data source)
- aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile (data source)
- aws_iam_policy_document.cluster_assume_role_policy (data source)
- aws_iam_policy_document.cluster_elb_sl_role_creation (data source)
- aws_iam_policy_document.workers_assume_role_policy (data source)
- aws_iam_role.custom_cluster_iam_role (data source)
- aws_partition.current (data source)
- http_http.wait_for_cluster (data source)
The following input variables are required:
Description: Name of the EKS cluster. Also used as a prefix in names of related resources.
Type: string
Description: Kubernetes version to use for the EKS cluster.
Type: string
Description: A list of subnets to place the EKS cluster and workers within.
Type: list(string)
Description: VPC where the cluster and workers will be deployed.
Type: string
The following input variables are optional (have default values):
Description: A map of tags to add to addons.
Type: map(string)
Default: {}
Description: Whether to attach the Amazon managed AmazonEKS_CNI_Policy IAM policy to the default worker IAM role. WARNING: If set false the permissions must be assigned to the aws-node DaemonSet pods via another method or nodes will not be able to join the cluster. Note: Set to false if you enable the vpc_cni addon with create_vpc_cni_addon = true
Type: bool
Default: true
Description: Additional kubernetes labels applied on aws-auth ConfigMap
Type: map(string)
Default: {}
Description: Whether to create security group rules for the access to the Amazon EKS private API server endpoint. When is true, cluster_endpoint_private_access_cidrs must be setted.
Type: bool
Default: false
Description: Whether to create a security group for the cluster or attach the cluster to cluster_security_group_id.
Type: bool
Default: true
Description: Timeout value when creating the EKS cluster.
Type: string
Default: "30m"
Description: Timeout value when deleting the EKS cluster.
Type: string
Default: "15m"
Description: List of CIDR blocks that are permitted for cluster egress traffic.
Type: list(string)
Default:
[
"0.0.0.0/0"
]Description: A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
Type: list(string)
Default: []
Description: Configuration block with encryption configuration for the cluster. See examples/secrets_encryption/main.tf for example format
Type:
list(object({
provider_key_arn = string
resources = list(string)
}))Default: []
Description: Indicates whether or not the Amazon EKS private API server endpoint is enabled.
Type: bool
Default: false
Description: List of CIDR blocks which can access the Amazon EKS private API server endpoint. To use this cluster_endpoint_private_access and cluster_create_endpoint_private_access_sg_rule must be set to true.
Type: list(string)
Default: null
Description: List of security group IDs which can access the Amazon EKS private API server endpoint. To use this cluster_endpoint_private_access and cluster_create_endpoint_private_access_sg_rule must be set to true.
Type: list(string)
Default: null
Description: Indicates whether or not the Amazon EKS public API server endpoint is enabled. When it's set to false ensure to have a proper private access with cluster_endpoint_private_access = true.
Type: bool
Default: true
Description: List of CIDR blocks which can access the Amazon EKS public API server endpoint.
Type: list(string)
Default:
[
"0.0.0.0/0"
]Description: IAM role name for the cluster. If manage_cluster_iam_resources is set to false, set this to reuse an existing IAM role. If manage_cluster_iam_resources is set to true, set this to force the created role name.
Type: string
Default: ""
Description: If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)
Type: string
Default: ""
Description: Number of days to retain log events. Default retention - 90 days.
Type: number
Default: 90
Description: If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers
Type: string
Default: ""
Description: service ipv4 cidr for the kubernetes cluster
Type: string
Default: null
Description: Controls if coredns addon should be deployed
Type: bool
Default: false
Description: Controls if EKS resources should be created (it affects almost all resources)
Type: bool
Default: true
Description: Controls if the EKS Fargate pod execution IAM role should be created.
Type: bool
Default: true
Description: Controls if kube proxy addon should be deployed
Type: bool
Default: false
Description: Controls if vpc cni addon should be deployed
Type: bool
Default: false
Description: Thumbprint of Root CA for EKS OIDC, Valid until 2037
Type: string
Default: "9e99a48a9960b14926bb7f3b02e22da2b0ab7280"
Description: Whether to create OpenID Connect Provider for EKS to enable IRSA
Type: bool
Default: false
Description: The IAM Role that provides permissions for the EKS Fargate Profile.
Type: string
Default: null
Description: Fargate profiles to create. See fargate_profile keys section in fargate submodule's README.md for more details
Type: any
Default: {}
Description: If provided, all IAM roles will be created on this path.
Type: string
Default: "/"
Description: Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"].
Type: list(string)
Default: []
Description: Command to use to fetch AWS EKS credentials.
Type: string
Default: "aws-iam-authenticator"
Description: Default arguments passed to the authenticator command. Defaults to [token -i $cluster_name].
Type: list(string)
Default: []
Description: Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"}.
Type: map(string)
Default: {}
Description: File permission of the Kubectl config file containing cluster configuration saved to kubeconfig_output_path.
Type: string
Default: "0600"
Description: Override the default name used for items kubeconfig.
Type: string
Default: ""
Description: Where to save the Kubectl config file (if write_kubeconfig = true). Assumed to be a directory if the value ends with a forward slash /.
Type: string
Default: "./"
Description: Whether to apply the aws-auth configmap file.
Type: bool
Default: true
Description: Whether to let the module manage cluster IAM resources. If set to false, cluster_iam_role_name must be specified.
Type: bool
Default: true
Description: Whether to let the module manage worker IAM resources. If set to false, iam_instance_profile_name must be specified for workers.
Type: bool
Default: true
Description: Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format.
Type: list(string)
Default: []
Description: Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format.
Type:
list(object({
rolearn = string
username = string
groups = list(string)
}))Default: []
Description: Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format.
Type:
list(object({
userarn = string
username = string
groups = list(string)
}))Default: []
Description: Map of map of node groups to create. See node_groups module's documentation for more details
Type: any
Default: {}
Description: Map of values to be applied to all node groups. See node_groups module's documentation for more details
Type: any
Default: {}
Description: If provided, all IAM roles will be created with this permissions boundary attached.
Type: string
Default: null
Description: A map of tags to add to all resources except addons. Tags added to launch configuration or templates override these values for ASG Tags only.
Type: map(string)
Default: {}
Description: A timeout (in seconds) to wait for cluster to be available.
Type: number
Default: 300
Description: A list of additional security group ids to attach to worker instances
Type: list(string)
Default: []
Description: Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster_version' is used.
Type: string
Default: ""
Description: Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster_version' is used.
Type: string
Default: ""
Description: The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft').
Type: string
Default: "amazon"
Description: The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft').
Type: string
Default: "amazon"
Description: Whether to create security group rules to allow communication between pods on workers and pods using the primary cluster security group.
Type: bool
Default: false
Description: Whether to create initial lifecycle hooks provided in worker groups.
Type: bool
Default: false
Description: Whether to create a security group for the workers or attach the workers to worker_security_group_id.
Type: bool
Default: true
Description: A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers_group_defaults for valid keys.
Type: any
Default: []
Description: A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers_group_defaults for valid keys.
Type: any
Default: []
Description: If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster.
Type: string
Default: ""
Description: Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443).
Type: number
Default: 1025
Description: Additional policies to be added to workers
Type: list(string)
Default: []
Description: List of CIDR blocks that are permitted for workers egress traffic.
Type: list(string)
Default:
[
"0.0.0.0/0"
]Description: Override default values for target groups. See workers_group_defaults_defaults in local.tf for valid keys.
Type: any
Default: {}
Description: User defined workers role name.
Type: string
Default: ""
Description: Whether to write a Kubectl config file containing the cluster configuration. Saved to kubeconfig_output_path.
Type: bool
Default: true
The following outputs are exported:
Description: Arn of cloudwatch log group created
Description: Name of cloudwatch log group created
Description: The Amazon Resource Name (ARN) of the cluster.
Description: Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster.
Description: The endpoint for your EKS Kubernetes API.
Description: IAM role ARN of the EKS cluster.
Description: IAM role name of the EKS cluster.
Description: The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready.
Description: The URL on the EKS cluster OIDC Issuer
Description: The cluster primary security group ID created by the EKS cluster on 1.14 or later. Referred to as 'Cluster security group' in the EKS console.
Description: Security group ID attached to the EKS cluster. On 1.14 or later, this is the 'Additional security groups' in the EKS console.
Description: The Kubernetes server version for the EKS cluster.
Description: A kubernetes configuration to authenticate to this EKS cluster.
Description: The arn of the CoreDns addon
Description: IAM role ARN for EKS Fargate pods
Description: IAM role name for EKS Fargate pods
Description: Amazon Resource Name (ARN) of the EKS Fargate Profiles.
Description: EKS Cluster name and EKS Fargate Profile names separated by a colon (:).
Description: The arn of the kube-proxy addon
Description: kubectl config file contents for this EKS cluster. Will block on cluster creation until the cluster is really ready.
Description: The filename of the generated kubectl config. Will block on cluster creation until the cluster is really ready.
Description: Outputs from EKS node groups. Map of maps, keyed by var.node_groups keys
Description: The ARN of the OIDC Provider if enable_irsa = true.
Description: Security group rule responsible for allowing pods to communicate with the EKS cluster API.
Description: The arn of the Amazon VPC CNI addon
Description: default IAM instance profile ARN for EKS worker groups
Description: default IAM instance profile name for EKS worker groups
Description: default IAM role ARN for EKS worker groups
Description: default IAM role name for EKS worker groups
Description: Security group ID attached to the EKS workers.
Description: IDs of the autoscaling groups containing workers.
Description: Names of the autoscaling groups containing workers.
Description: ID of the default worker group AMI
Description: ID of the default Windows worker group AMI
Description: ARNs of the worker launch templates.
Description: IDs of the worker launch templates.
Description: Latest versions of the worker launch templates.
Description: User data of worker groups