Merge pull request #38 from bbgu1/main

feat: Add Qdrant addon

qdrant.tf

@@ -0,0 +1,105 @@
+locals {
+ qdrant_name = "qdrant"
+ qdrant_repository = "https://qdrant.github.io/qdrant-helm"
+ qdrant_version = "0.7.6"
+
+ qdrant_namespace = try(var.qdrant_helm_config["namespace"], local.qdrant_name)
+ qdrant_set_values = []
+
+ qdrant_default_values = <<-EOT
+replicaCount: 3
+
+env:
+ - name: QDRANT__TELEMETRY_DISABLED
+ value: true
+
+service:
+ type: LoadBalancer
+
+resources:
+ limits:
+ cpu: 200m
+ memory: 1Gi
+ requests:
+ cpu: 200m
+ memory: 1Gi
+
+persistence:
+ storageClassName: gp2
+
+metrics:
+ serviceMonitor:
+ enabled: true
+
+apiKey: false
+
+EOT
+
+ qdrant_merged_values_yaml = yamlencode(merge(
+ yamldecode(local.qdrant_default_values),
+ try(yamldecode(var.qdrant_helm_config.values[0]), {})
+ ))
+
+}
+
+resource "helm_release" "qdrant" {
+ count = var.enable_qdrant ? 1 : 0
+
+ name = try(var.qdrant_helm_config["name"], local.qdrant_name)
+ repository = try(var.qdrant_helm_config["repository"], local.qdrant_repository)
+ chart = try(var.qdrant_helm_config["chart"], local.qdrant_name)
+ version = try(var.qdrant_helm_config["version"], local.qdrant_version)
+ timeout = try(var.qdrant_helm_config["timeout"], 300)
+ values = [local.qdrant_merged_values_yaml]
+ create_namespace = try(var.qdrant_helm_config["create_namespace"], true)
+ namespace = local.qdrant_namespace
+ lint = try(var.qdrant_helm_config["lint"], false)
+ description = try(var.qdrant_helm_config["description"], "")
+ repository_key_file = try(var.qdrant_helm_config["repository_key_file"], "")
+ repository_cert_file = try(var.qdrant_helm_config["repository_cert_file"], "")
+ repository_username = try(var.qdrant_helm_config["repository_username"], "")
+ repository_password = try(var.qdrant_helm_config["repository_password"], "")
+ verify = try(var.qdrant_helm_config["verify"], false)
+ keyring = try(var.qdrant_helm_config["keyring"], "")
+ disable_webhooks = try(var.qdrant_helm_config["disable_webhooks"], false)
+ reuse_values = try(var.qdrant_helm_config["reuse_values"], false)
+ reset_values = try(var.qdrant_helm_config["reset_values"], false)
+ force_update = try(var.qdrant_helm_config["force_update"], false)
+ recreate_pods = try(var.qdrant_helm_config["recreate_pods"], false)
+ cleanup_on_fail = try(var.qdrant_helm_config["cleanup_on_fail"], false)
+ max_history = try(var.qdrant_helm_config["max_history"], 0)
+ atomic = try(var.qdrant_helm_config["atomic"], false)
+ skip_crds = try(var.qdrant_helm_config["skip_crds"], false)
+ render_subchart_notes = try(var.qdrant_helm_config["render_subchart_notes"], true)
+ disable_openapi_validation = try(var.qdrant_helm_config["disable_openapi_validation"], false)
+ wait = try(var.qdrant_helm_config["wait"], true)
+ wait_for_jobs = try(var.qdrant_helm_config["wait_for_jobs"], false)
+ dependency_update = try(var.qdrant_helm_config["dependency_update"], false)
+ replace = try(var.qdrant_helm_config["replace"], false)
+
+ postrender {
+ binary_path = try(var.qdrant_helm_config["postrender"], "")
+ }
+
+ dynamic "set" {
+ iterator = each_item
+ for_each = distinct(concat(try(var.qdrant_helm_config.set, []), local.qdrant_set_values))
+
+ content {
+ name = each_item.value.name
+ value = each_item.value.value
+ type = try(each_item.value.type, null)
+ }
+ }
+
+ dynamic "set_sensitive" {
+ iterator = each_item
+ for_each = try(var.qdrant_helm_config["set_sensitive"], [])
+
+ content {
+ name = each_item.value.name
+ value = each_item.value.value
+ type = try(each_item.value.type, null)
+ }
+ }
+}

test/main.tf

@@ -2,6 +2,13 @@ provider "aws" {
  region = local.region
 }
 
+# ECR always authenticates with `us-east-1` region
+# Docs -> https://docs.aws.amazon.com/AmazonECR/latest/public/public-registries.html
+provider "aws" {
+ alias = "ecr"
+ region = "us-east-1"
+}
+
 provider "kubernetes" {
  host = module.eks.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
@@ -14,17 +21,22 @@ provider "kubernetes" {
  }
 }
 
+data "aws_eks_cluster_auth" "this" {
+ name = module.eks.cluster_name
+}
+
 provider "helm" {
  kubernetes {
  host = module.eks.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
 
- exec {
- api_version = "client.authentication.k8s.io/v1beta1"
- command = "aws"
- # This requires the awscli to be installed locally where Terraform is executed
- args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
- }
+ token = data.aws_eks_cluster_auth.this.token
+ #exec {
+ # api_version = "client.authentication.k8s.io/v1beta1"
+ # command = "aws"
+ # # This requires the awscli to be installed locally where Terraform is executed
+ # args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
+ #}
  }
 }
 
@@ -35,6 +47,10 @@ data "aws_ecr_authorization_token" "token" {
  registry_id = "895885662937"
 }
 
+data "aws_ecrpublic_authorization_token" "token" {
+ provider = aws.ecr
+}
+
 data "aws_availability_zones" "available" {}
 
 locals {
@@ -58,48 +74,167 @@ module "doeks_data_addons" {
  enable_aws_efa_k8s_device_plugin = true
  enable_aws_neuron_device_plugin = true
  enable_emr_spark_operator = true
- enable_flink_operator = true
- enable_jupyterhub = true
- enable_kubecost = true
- enable_nvidia_gpu_operator = true
- enable_kuberay_operator = true
- enable_spark_history_server = true
  emr_spark_operator_helm_config = {
  repository_username = data.aws_ecr_authorization_token.token.user_name
  repository_password = data.aws_ecr_authorization_token.token.password
  }
 
- enable_spark_operator = true
+ enable_flink_operator = true
+ flink_operator_helm_config = {
+ version = "1.8.0"
+ }
+ enable_jupyterhub = true
+ enable_kubecost = true
+ kubecost_helm_config = {
+ repository_username = data.aws_ecrpublic_authorization_token.token.user_name
+ repository_password = data.aws_ecrpublic_authorization_token.token.password
+ values = [
+ <<-EOT
+ global:
+ prometheus:
+ fqdn: http://kube-prometheus-stack-prometheus.kube-prometheus-stack.svc:9090
+ enabled: false
+ EOT
+ ]
+ }
+
+ enable_nvidia_gpu_operator = true
+ enable_kuberay_operator = true
+ kuberay_operator_helm_config = {
+ version = "1.1.0"
+ }
+
+ enable_spark_history_server = true
+ enable_spark_operator = true
  # With custom values
  spark_operator_helm_config = {
  values = [templatefile("${path.module}/helm-values/spark-operator-values.yaml", {})]
  }
+
  enable_strimzi_kafka_operator = true
  enable_yunikorn = true
+ yunikorn_helm_config = {
+ version = "1.5.0"
+ }
+
+ enable_qdrant = true
+
+}
+
+module "eks_blueprints_addons" {
+ source = "aws-ia/eks-blueprints-addons/aws"
+ version = "~> 1.0" #ensure to update this to the latest/desired version
+ cluster_name = module.eks.cluster_name
+ cluster_endpoint = module.eks.cluster_endpoint
+ cluster_version = module.eks.cluster_version
+ oidc_provider_arn = module.eks.oidc_provider_arn
+
+ enable_aws_load_balancer_controller = true
+ enable_kube_prometheus_stack = true
+ kube_prometheus_stack = {
+ values = [
+ <<-EOT
+ prometheus:
+ prometheusSpec:
+ serviceMonitorSelectorNilUsesHelmValues: false
+ EOT
+ ]
+ }
+
+ enable_metrics_server = true
+ enable_cert_manager = true
+
+}
+
+module "ebs_csi_driver_irsa" {
+ source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+ version = "~> 5.20"
+ role_name_prefix = format("%s-%s-", local.name, "ebs-csi-driver")
+ attach_ebs_csi_policy = true
+ oidc_providers = {
+ main = {
+ provider_arn = module.eks.oidc_provider_arn
+ namespace_service_accounts = ["kube-system:ebs-csi-controller-sa"]
+ }
+ }
+ tags = local.tags
 }
 
 # checkov:skip=CKV_TF_1
 #tfsec:ignore:aws-eks-enable-control-plane-logging
 module "eks" {
- source = "terraform-aws-modules/eks/aws"
- version = "~> 19.13"
+ source = "terraform-aws-modules/eks/aws"
+ version = "~> 20.8"
+ depends_on = [module.vpc]
 
- cluster_name = local.name
- cluster_version = "1.26"
- cluster_endpoint_public_access = true
+ cluster_name = local.name
+ cluster_version = "1.29"
+ cluster_endpoint_public_access = true
+ cluster_endpoint_private_access = true
 
  vpc_id = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets
 
- manage_aws_auth_configmap = true
+ cluster_addons = {
+ coredns = {
+ most_recent = true
+ }
+ kube-proxy = {
+ most_recent = true
+ }
+ vpc-cni = {
+ most_recent = true
+ }
+ aws-ebs-csi-driver = {
+ most_recent = true
+ service_account_role_arn = module.ebs_csi_driver_irsa.iam_role_arn
+ }
+ }
+
+ eks_managed_node_group_defaults = {
+ iam_role_additional_policies = {
+ # Not required, but used in the example to access the nodes to inspect mounted volumes
+ AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+ }
+ }
+
+ enable_cluster_creator_admin_permissions = true
 
  eks_managed_node_groups = {
- initial = {
- instance_types = ["m5.xlarge"]
+ # We recommend to have a MNG to place your critical workloads and add-ons
+ # Then rely on Karpenter to scale your workloads
+ # You can also make uses on nodeSelector and Taints/tolerations to spread workloads on MNG or Karpenter provisioners
+ core_node_group = {
+ name = "core-node-group"
+ description = "EKS managed node group example launch template"
+ subnet_ids = module.vpc.private_subnets
+
+ min_size = 1
+ max_size = 9
+ desired_size = 7
+
+ force_update_version = true
+ instance_types = ["m6g.xlarge"]
+ ami_type = "AL2_ARM_64"
+ ebs_optimized = true
+ block_device_mappings = {
+ xvda = {
+ device_name = "/dev/xvda"
+ ebs = {
+ volume_size = 100
+ volume_type = "gp3"
+ }
+ }
+ }
+
+ labels = {
+ WorkerType = "ON_DEMAND"
+ NodeGroupType = "core"
+ }
 
- min_size = 4
- max_size = 10
- desired_size = 4
+ tags = {
+  Name = "core-node-grp"
+ }
  }
  }
 

test/versions.tf

@@ -1,5 +1,5 @@
 terraform {
- required_version = ">= 1.0"
+ required_version = ">= 1.2"
 
  required_providers {
  aws = {

variables.tf

@@ -365,12 +365,27 @@ variable "superset_helm_config" {
  default = {}
 }
 
+#---------------------------------------------------
+# Qdrant
+#---------------------------------------------------
+variable "enable_qdrant" {
+ description = "Enable Qdrant Vector Database add-on"
+ type = bool
+ default = false
+}
+
 variable "enable_nvidia_triton_server" {
  description = "Enable NVIDIA Triton Server add-on"
  type = bool
  default = false
 }
 
+variable "qdrant_helm_config" {
+ description = "Helm configuration for Qdrant"
+ type = any
+ default = {}
+}
+
 variable "nvidia_triton_server_helm_config" {
  description = "Helm configuration for NVIDIA Triton Server"
  type = any