-
Notifications
You must be signed in to change notification settings - Fork 1
/
eks-cluster.tf
96 lines (83 loc) · 2.32 KB
/
eks-cluster.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
variable "cluster-name" {
default = "terraform-eks-demo"
type = string
}
resource "aws_iam_role" "eks-demo-cluster-iam" {
name = "eks-demo-cluster-iam"
assume_role_policy = jsonencode({
Statement = [{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "eks.amazonaws.com"
}
}]
Version = "2012-10-17"
})
}
resource "aws_iam_role_policy_attachment" "eks-demo-cluster-iam-AmazonEKSClusterPolicy" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
role = aws_iam_role.eks-demo-cluster-iam.name
}
resource "aws_iam_role_policy_attachment" "eks-demo-cluster-iam-AmazonEKSServicePolicy" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
role = aws_iam_role.eks-demo-cluster-iam.name
}
resource "aws_security_group" "eks-demo-cluster-sg" {
name = "terraform-eks-demo-cluster"
description = "Cluster communication with worker nodes"
vpc_id = aws_vpc.eks-demo-vpc.id
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "terraform-eks-demo"
}
}
resource "aws_eks_cluster" "eks-demo-cluster" {
name = var.cluster-name
role_arn = aws_iam_role.eks-demo-cluster-iam.arn
vpc_config {
security_group_ids = [aws_security_group.eks-demo-cluster-sg.id]
subnet_ids = aws_subnet.eks-demo-subnet.*.id
}
depends_on = [
aws_iam_role_policy_attachment.eks-demo-cluster-iam-AmazonEKSClusterPolicy,
aws_iam_role_policy_attachment.eks-demo-cluster-iam-AmazonEKSServicePolicy,
]
}
locals {
kubeconfig = <<-KUBECONFIG
---
apiVersion: v1
clusters:
- cluster:
server: ${aws_eks_cluster.eks-demo-cluster.endpoint}
certificate-authority-data: ${aws_eks_cluster.eks-demo-cluster.certificate_authority.0.data}
name: eks-test
contexts:
- context:
cluster: eks-test
user: aws
name: eks-test
current-context: eks-test
kind: Config
preferences: {}
users:
- name: aws
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: aws-iam-authenticator
args:
- "token"
- "-i"
- "${var.cluster-name}"
KUBECONFIG
}
output "kubeconfig" {
value = "${local.kubeconfig}"
}