diff options
Diffstat (limited to 'astroshop-terraform/modules/eks/main.tf')
| -rw-r--r-- | astroshop-terraform/modules/eks/main.tf | 145 |
1 files changed, 145 insertions, 0 deletions
diff --git a/astroshop-terraform/modules/eks/main.tf b/astroshop-terraform/modules/eks/main.tf new file mode 100644 index 0000000..cee21aa --- /dev/null +++ b/astroshop-terraform/modules/eks/main.tf @@ -0,0 +1,145 @@ +# EKS cluster IAM Role and Policy attachment +resource "aws_iam_role" "cluster" { + name = "${var.cluster_name}-cluster-role" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [{ + Action = "sts:AssumeRole" + Effect = "Allow" + Principal = { + Service = "eks.amazonaws.com" + } + }], + }) + + tags = { + Name = "${var.cluster_name}-cluster-role" + } +} + +resource "aws_iam_role_policy_attachment" "cluster_policy" { + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" + role = aws_iam_role.cluster.name +} + +# EKS Cluster +resource "aws_eks_cluster" "main" { + name = var.cluster_name + version = var.cluster_version + role_arn = aws_iam_role.cluster.arn + + vpc_config { + subnet_ids = var.subnet_ids + endpoint_private_access = var.endpoint_private_access + endpoint_public_access = var.endpoint_public_access + public_access_cidrs = var.public_access_cidrs + } + + depends_on = [ + aws_iam_role_policy_attachment.cluster_policy + ] + tags = { + Name = var.cluster_name + } +} + +# EKS Node Group IAM Role and Policy attachment +resource "aws_iam_role" "node" { + name = "${var.cluster_name}-node-role" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [{ + Action = "sts:AssumeRole" + Effect = "Allow" + Principal = { + Service = "ec2.amazonaws.com" + } + }] + }) + + tags = { + Name = "${var.cluster_name}-node-role" + } +} + +resource "aws_iam_role_policy_attachment" "node_policy" { + for_each = toset([ + "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", + "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", + "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" + ]) + + policy_arn = each.value + role = aws_iam_role.node.name +} + +# EKS Node Groups +resource "aws_eks_node_group" "main" { + for_each = var.node_groups + + cluster_name = aws_eks_cluster.main.name + node_group_name = each.key + node_role_arn = aws_iam_role.node.arn + subnet_ids = var.subnet_ids + + instance_types = each.value.instance_types + capacity_type = each.value.capacity_type + + scaling_config { + desired_size = each.value.scaling_config.desired_size + max_size = each.value.scaling_config.max_size + min_size = each.value.scaling_config.min_size + } + + tags = { + Name = each.key + } + + depends_on = [ + aws_iam_role_policy_attachment.node_policy + ] +} + +# Security Groups for EKS Cluster and Nodes +resource "aws_security_group" "cluster" { + name = "${var.cluster_name}-cluster-sg" + description = "Security group for EKS cluster control plane" + vpc_id = var.vpc_id + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Name = "${var.cluster_name}-cluster-sg" + } +} + +resource "aws_security_group" "node" { + name = "${var.cluster_name}-node-sg" + description = "Security group for EKS nodes" + vpc_id = var.vpc_id + + ingress { + from_port = 1025 + to_port = 65535 + protocol = "tcp" + security_groups = [aws_security_group.cluster.id] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Name = "${var.cluster_name}-node-sg" + } +}
\ No newline at end of file |