diff --git a/README.md b/README.md index 77df87c..81c57d5 100644 --- a/README.md +++ b/README.md @@ -1,353 +1,134 @@ # tfmod-eks - Create an EKS cluster given the specification of the cluster. -**NOTE:** At this time, the cluster-admin group is not created in AWS due to interactions with the ldap provider. - -The module creates an EKS cluster named `cluster_name` in the `region` using kuberenetes version `cluster_version` with `eks_ng_desired_size` nodes initially. -The services in the cluster will be accessible using hostnames for the services ending with the `cluster_name`.`domain` fully qualified domain name. -The cluster-autoscaler will resize the node group based upon capacity from a minimum of `eks_ng_min_size` to a maximum of `eks_ng_max_size`. -The `eks_instance_types` is a prioritized list of instance types to use as the worker nodes. -Note that it is best if the vCPU and Mem sizes of all of the instance types are the same. +The module creates an EKS cluster named cluster_name in the region using kuberenetes version cluster_version with eks_ng_desired_size nodes initially. The services in the cluster will be accessible using hostnames for the services ending with the cluster_name.domain fully qualified domain name. The cluster-autoscaler will resize the node group based upon capacity from a minimum of eks_ng_min_size to a maximum of eks_ng_max_size. The eks_instance_types is a prioritized list of instance types to use as the worker nodes. Note that it is best if the vCPU and Mem sizes of all of the instance types are the same. The cluster is configured with an oidc provider allowing service accounts to be configured with IRSA roles as needed. Addons installed: -- aws-efs-csi-driver -- aws-ebs-csi-driver -- coredns -- kube-proxy -- vpc-cni - -Note that at this stage, the csi-drivers are not configured. -The csi-driver configuration takes place in the eks-configuration module. - -## Required Inputs - -**cluster_name** `string` - -The name of the cluster to create. - - -**vpc_name** `string` - -The VPC named that will be used by this cluster. - - -**domain** `string` - -"The DNS domain name of the cluster." - -## Optional Inputs - -**cluster_version** `string` - -The Kuberentes version number to use for this EKS cluster. See https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html - -Default: `"1.27"` - - -**subnets_name** `string` - -Define the name of the subnets to be used by this cluster. - -Default: `"*-container-*"` - - -**eks_instance_disk_size** `number` - -The size of the disk of the worker nodes in gigabytes. 40 is the approximate minimum. Needs to hold the all of the normal operating system files plus every image that will be used in the cluster. - -Default: `40` - - -**eks_instance_types** `list(string)` - -EKS worker node instance types - -Default: `[ "t3.xlarge" ]` - - -**eks_ng_min_size** `number` - -The node group minimum size. - -Default: `4` - - -**eks_ng_desired_size** `number` - -The node group desired size - -Default: `4` - - -**eks_ng_max_size** `number` - -The node group maximum size - -Default: `15` - - -**operators_ns** `string` - -Namespace to create where operators will be installed. - -Default: `"operators"` - - -**census_private_cidr** `list(string)` - -Census Private CIR Blocks - -Default : `["148.129.0.0/16", "172.16.0.0/12", "192.168.0.0/16"]1 - -**tag_costallocation** `string` - -The cost allocation group. - -Default: `"csvd:infrastructure"` - - -**tags** `map(string)` - -AWS Tags to apply to appropriate resources - -Default: `{}` - - -**aws_environment** `string` - -AWS Environment (govcloud | east-west) - -Default: `""` +aws-efs-csi-driver +aws-ebs-csi-driver +coredns +kube-proxy + +# CHANGELOG +- created content in the README + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.13 | +| [aws](#requirement\_aws) | >= 5.14.0 | +| [cloudinit](#requirement\_cloudinit) | >= 2.3.2 | +| [http](#requirement\_http) | >= 3.4.0 | +| [null](#requirement\_null) | >= 3.2.1 | +| [time](#requirement\_time) | >= 0.9.1 | +| [tls](#requirement\_tls) | >= 4.0.4 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | >= 5.14.0 | +| [null](#provider\_null) | >= 3.2.1 | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [cluster](#module\_cluster) | git@github.e.it.census.gov:SCT-Engineering/terraform-aws-eks.git | v20.8.5 | +| [cluster\_autoscaler\_irsa\_role](#module\_cluster\_autoscaler\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | n/a | +| [ebs\_csi\_irsa\_role](#module\_ebs\_csi\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | n/a | +| [efs\_csi\_irsa\_role](#module\_efs\_csi\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | n/a | +| [vpc\_cni\_irsa\_role](#module\_vpc\_cni\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | n/a | + +## Resources + +| Name | Type | +|------|------| +| [aws_security_group.additional_eks_cluster_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | +| [aws_security_group.all_worker_mgmt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | +| [aws_security_group_rule.allow_sidecar_injection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [null_resource.kube_config_create](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source | +| [aws_kms_key.ebs_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_key) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | +| [aws_subnet.subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source | +| [aws_subnets.subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source | +| [aws_vpc.eks_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [access\_entries](#input\_access\_entries) | Map of access entries to add to the cluster | `any` | `{}` | no | +| [aws\_environment](#input\_aws\_environment) | AWS Environment (govcloud \| east-west) | `string` | `""` | no | +| [census\_private\_cidr](#input\_census\_private\_cidr) | Census Private CIR Blocks | `list(string)` | 
[
  "148.129.0.0/16",
  "172.16.0.0/12",
  "192.168.0.0/16"
]
| no | +| [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | This allows to access the cluster from IEB cloud host | `bool` | `false` | no | +| [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | +| [cluster\_version](#input\_cluster\_version) | The Kubernetes version number to use for this EKS cluster. See https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html | `string` | `"1.27"` | no | +| [domain](#input\_domain) | The DNS domain name of the cluster. | `string` | n/a | yes | +| [eks\_instance\_disk\_size](#input\_eks\_instance\_disk\_size) | The size of the disk of the worker nodes in gigabytes. 40 is the approximate minimum. Needs to hold the all of the normal operating system files plus every image that will be used in the cluster. | `number` | `80` | no | +| [eks\_instance\_types](#input\_eks\_instance\_types) | EKS worker node instance types | `list(string)` | 
[
  "t3.xlarge"
]
| no | +| [eks\_ng\_desired\_size](#input\_eks\_ng\_desired\_size) | Node Group desired size | `number` | `4` | no | +| [eks\_ng\_max\_size](#input\_eks\_ng\_max\_size) | Node Group maximum size | `number` | `15` | no | +| [eks\_ng\_min\_size](#input\_eks\_ng\_min\_size) | Node Group minimum size | `number` | `4` | no | +| [enable\_cluster\_creator\_admin\_permissions](#input\_enable\_cluster\_creator\_admin\_permissions) | Indicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry | `bool` | `false` | no | +| [operators\_ns](#input\_operators\_ns) | Namespace to create where operators will be installed. | `string` | `"operators"` | no | +| [profile](#input\_profile) | AWS config profile | `string` | `""` | no | +| [subnets\_name](#input\_subnets\_name) | Define the name of the subnets to be used by this cluster | `string` | `"*-container-*"` | no | +| [tag\_costallocation](#input\_tag\_costallocation) | Tag CostAllocation (default) | `string` | `"csvd:infrastructure"` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | +| [vpc\_name](#input\_vpc\_name) | Define the VPC name that will be used by this cluster | `string` | n/a | yes | ## Outputs -### Module information - -**module_name** - -Description: The name of this module. - - -**module_version** - -Description: The version of this module. - -### Networking information - -**vpc_id** - -Description: The VPC id where the EKS cluster was deployed. - - -**vpc_cidr_block** - -Description: The CIDR block associated with the VPC. - - -**subnets** - -Description: The subnets configured for the VPC. - - -**security_group_all_worker_mgmt_id** - -Description: The security group to manage all of the worker nodes. - - -**cluster_fqdn** - -Description: The `cluster_name`.`domain` - - -### IRSA Roles Created - -**vpc_cni_irsa_role** - -Description: The arn/name/unique_id of the irsa role for the vpc-cni addon - - -**ebs_csi_irsa_role** - -Description: The arn/name/unique_id of the irsa role for the ebs-csi-driver addon - - -**efs_csi_irsa_role** - -Description: The arn/name/unique_id of the irsa role for the efs-csi-driver addon - - -**cluster_iam_role** - -Description: The arn/name/unique_id of the iam role for the cluster - - -### Cluster information - -**cluster_arn** - -Description: The Amazon Resource Name (ARN) of the cluster - - -**cluster_certificate_authority_data** - -Description: Base64 encoded certificate data required to communicate with the cluster - - -**cluster_endpoint** - -Description: Endpoint for your Kubernetes API server - - -**cluster_id** - -Description: The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts - - -**cluster_name** - -Description: The name of the EKS cluster - - -**cluster_version** - -Description: The Kubernetes version for the cluster - - -**cluster_platform_version** - -Description: Platform version for the cluster - - -**cluster_status** - -Description: Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` - - -### KMS Key - -**kms_key_arn** - -Description: The Amazon Resource Name (ARN) of the key - - -**kms_key_id** - -Description: The globally unique identifier for the key - - -**kms_key_policy** - -Description: The IAM resource policy set on the key - - -### Cluster Security Group - -**cluster_security_group_arn** - -Description: Amazon Resource Name (ARN) of the cluster security group - - -**cluster_security_group_id** - -Description: ID of the cluster security group - - -**cluster_primary_security_group_id** - -Description: Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console - - -### Node Security Group - -**node_security_group_arn** - -Description: Amazon Resource Name (ARN) of the node shared security group - - -**node_security_group_id** - -Description: ID of the node shared security group - - -### IRSA - -**oidc_provider** - -Description: The OpenID Connect identity provider (issuer URL without leading `https://`) - - -**oidc_provider_arn** - -Description: The ARN of the OIDC Provider if `enable_irsa = true` - - -**cluster_oidc_issuer_url** - -Description: The URL on the EKS cluster for the OpenID Connect identity provider - - -**cluster_tls_certificate_sha1_fingerprint** - -Description: The SHA1 fingerprint of the public key of the cluster's certificate - - -### EKS Addons - -**cluster_addons** - -Description: Map of attribute maps for all EKS cluster addons enabled - - -### EKS Identity Provider - -**cluster_identity_providers** - -Description: Map of attribute maps for all EKS identity providers enabled - - -### Cloudwatch Log Group - -**cloudwatch_log_group_arn** - -Description: Arn of cloudwatch log group created - - -**cloudwatch_log_group_name** - -Description: Name of cloudwatch log group created - - -### Fargate profile - -**fargate_profiles** - -Description: Map of attribute maps for all EKS Fargate Profiles created - - -### EKS Managed Node Group - -**eks_managed_node_groups** - -Description: Map of attribute maps for all EKS managed node groups created - - -**eks_managed_node_groups_autoscaling_group_names** - -Description: List of the autoscaling group names created by EKS managed node groups - - -### Self Managed Node Group - -**self_managed_node_groups** - -Description: Map of attribute maps for all self managed node groups created - - -**self_managed_node_groups_autoscaling_group_names** - -Description: List of the autoscaling group names created by self-managed node groups - +| Name | Description | +|------|-------------| +| [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created | +| [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created | +| [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled | +| [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster | +| [cluster\_autoscaler\_role\_name](#output\_cluster\_autoscaler\_role\_name) | ############################################################################### Additional ############################################################################### | +| [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster | +| [cluster\_endpoint](#output\_cluster\_endpoint) | Endpoint for your Kubernetes API server | +| [cluster\_fqdn](#output\_cluster\_fqdn) | The cluster\_name.domain | +| [cluster\_iam\_role](#output\_cluster\_iam\_role) | The arn/name/unique\_id of the iam role for the cluster | +| [cluster\_id](#output\_cluster\_id) | The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts | +| [cluster\_identity\_providers](#output\_cluster\_identity\_providers) | Map of attribute maps for all EKS identity providers enabled | +| [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster | +| [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster for the OpenID Connect identity provider | +| [cluster\_platform\_version](#output\_cluster\_platform\_version) | Platform version for the cluster | +| [cluster\_primary\_security\_group\_id](#output\_cluster\_primary\_security\_group\_id) | Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console | +| [cluster\_security\_group\_arn](#output\_cluster\_security\_group\_arn) | Amazon Resource Name (ARN) of the cluster security group | +| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | ID of the cluster security group | +| [cluster\_status](#output\_cluster\_status) | Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED` | +| [cluster\_tls\_certificate\_sha1\_fingerprint](#output\_cluster\_tls\_certificate\_sha1\_fingerprint) | The SHA1 fingerprint of the public key of the cluster's certificate | +| [cluster\_version](#output\_cluster\_version) | The Kubernetes version for the cluster | +| [ebs\_csi\_irsa\_role](#output\_ebs\_csi\_irsa\_role) | The arn/name/unique\_id of the irsa role for the ebs-csi-driver addon | +| [efs\_csi\_irsa\_role](#output\_efs\_csi\_irsa\_role) | The arn/name/unique\_id of the irsa role for the efs-csi-driver addon | +| [eks\_managed\_node\_groups](#output\_eks\_managed\_node\_groups) | Map of attribute maps for all EKS managed node groups created | +| [eks\_managed\_node\_groups\_autoscaling\_group\_names](#output\_eks\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by EKS managed node groups | +| [fargate\_profiles](#output\_fargate\_profiles) | Map of attribute maps for all EKS Fargate Profiles created | +| [kms\_key\_arn](#output\_kms\_key\_arn) | The Amazon Resource Name (ARN) of the key | +| [kms\_key\_id](#output\_kms\_key\_id) | The globally unique identifier for the key | +| [kms\_key\_policy](#output\_kms\_key\_policy) | The IAM resource policy set on the key | +| [module\_name](#output\_module\_name) | The name of this module. | +| [module\_version](#output\_module\_version) | The version of this module. | +| [node\_security\_group\_arn](#output\_node\_security\_group\_arn) | Amazon Resource Name (ARN) of the node shared security group | +| [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group | +| [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) | +| [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` | +| [security\_group\_all\_worker\_mgmt\_id](#output\_security\_group\_all\_worker\_mgmt\_id) | The security group to manage all of the worker nodes. | +| [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created | +| [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups | +| [subnets](#output\_subnets) | The subnets configured for the VPC. | +| [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | The CIDR block associated with the VPC. | +| [vpc\_cni\_irsa\_role](#output\_vpc\_cni\_irsa\_role) | The arn/name/unique\_id of the irsa role for the vpc-cni addon | +| [vpc\_id](#output\_vpc\_id) | The VPC id where the EKS cluster was deployed. | + \ No newline at end of file