EBSI
Technical Office
devops
Terraform Aws Eks Blueprints

Repository

    ├── deploy
    │   └── live
    │       └── preprod
    │           └── eu-west-1
    │               └── application
    │                   └── dev
    │                       └── backend.conf
    │                       └── dev.tfvars
    │                       └── main.tf
    │                       └── variables.tf
    │                       └── outputs.tf
    │                   └── test
    │                       └── backend.conf
    │                       └── test.tfvars
    │       └── prod
    │           └── eu-west-1
    │               └── application
    │                   └── prod
    │                       └── backend.conf
    │                       └── prod.tfvars
    │                       └── main.tf
    │                       └── variables.tf
    │                       └── outputs.tf
enable_managed_nodegroups = true
managed_node_groups = {
  mg_m4 = {
    # 1> Node Group configuration
    node_group_name        = "managed-ondemand"
    create_launch_template = true              # false will use the default launch template
    launch_template_os        = "amazonlinux2eks" # amazonlinux2eks or windows or bottlerocket
    public_ip              = false             # Use this to enable public IP for EC2 instances; only for public subnets used in launch templates ;
    pre_userdata           = <<-EOT
            yum install -y amazon-ssm-agent
            systemctl enable amazon-ssm-agent && systemctl start amazon-ssm-agent"
        EOT
    # 2> Node Group scaling configuration
    desired_size    = 3
    max_size        = 3
    min_size        = 3
    max_unavailable = 1 # or percentage = 20

    # 3> Node Group compute configuration
    ami_type       = "AL2_x86_64" # AL2_x86_64, AL2_x86_64_GPU, AL2_ARM_64, CUSTOM
    capacity_type  = "ON_DEMAND"  # ON_DEMAND or SPOT
    instance_types = ["m4.large"] # List of instances used only for SPOT type
    disk_size      = 50

    # 4> Node Group network configuration
    subnet_type = "private" # private or public
    subnet_ids  = []        # Define your private/public subnets list with comma seprated subnet_ids  = ['subnet1','subnet2','subnet3']

    k8s_taints = []

    k8s_labels = {
      Environment = "preprod"
      Zone        = "dev"
      WorkerType  = "ON_DEMAND"
    }
    additional_tags = {
      ExtraTag    = "m4-on-demand"
      Name        = "m4-on-demand"
      subnet_type = "private"
    }
    create_worker_security_group = true
  },
  mg_m5 = {...}
 }
enable_fargate = true

fargate_profiles = {
  default = {
    fargate_profile_name = "default"
    fargate_profile_namespaces = [{
      namespace = "default"
      k8s_labels = {
        Environment = "preprod"
        Zone        = "dev"
        env         = "fargate"
      }
    }]

    subnet_ids = [] # Provide list of private subnets

    additional_tags = {
      ExtraTag = "Fargate"
    }
  },
    finance = {...}
  }
    kubectl apply -f Bottlerocket_k8s.csv.yaml
    kubectl get ClusterServiceVersion Bottlerocket_k8s | jq.'status'
git clone https://github.com/aws-samples/aws-eks-accelerator-for-terraform.git
    path = "local_tf_state/ekscluster/preprod/application/dev/terraform-main.tfstate"
    bucket = "<s3 bucket name>"
    region = "<aws region>"
    key    = "ekscluster/preprod/application/dev/terraform-main.tfstate"
terraform init -backend-config deploy/live/preprod/eu-west-1/application/dev/backend.conf
terraform plan -var-file deploy/live/preprod/eu-west-1/application/dev/dev.tfvars
terraform apply -var-file deploy/live/preprod/eu-west-1/application/dev/<env>.tfvars
$ make tf-plan-eks env=<env> region=<region> account=<account> subenv=<subenv>
e.g.,
$ make tf-plan-eks env=preprod region=eu-west-1 account=application subenv=dev
$ make tf-apply-eks env=<env> region=<region> account=<account> subenv=<subenv>
e.g.,
$ make tf-apply-eks env=preprod region=eu-west-1 account=application subenv=dev
$ make tf-destroy-eks env=<env> region=<region> account=<account> subenv=<subenv>
e.g.,
make tf-destroy-eks env=preprod region=eu-west-1 account=application subenv=dev
$ aws eks --region eu-west-1 update-kubeconfig --name <cluster-name>
$ kubectl get nodes
$ kubectl get pods -n kube-system
    Key = "Kubernetes.io/cluster/${local.cluster_name}"
    Value = "Shared"
      public_subnet_tags = {
        "Kubernetes.io/cluster/${local.cluster_name}" = "shared"
        "Kubernetes.io/role/elb"                      = "1"
      }
      private_subnet_tags = {
        "Kubernetes.io/cluster/${local.cluster_name}" = "shared"
        "Kubernetes.io/role/internal-elb"             = "1"
      }
com.amazonaws.region.aps-workspaces            - For AWS Managed Prometheus Workspace
com.amazonaws.region.ssm                       - Secrets Management
com.amazonaws.region.ec2
com.amazonaws.region.ecr.api
com.amazonaws.region.ecr.dkr
com.amazonaws.region.logs                       – For CloudWatch Logs
com.amazonaws.region.sts                        – If using AWS Fargate or IAM roles for service accounts
com.amazonaws.region.elasticloadbalancing       – If using Application Load Balancers
com.amazonaws.region.autoscaling                – If using Cluster Autoscaler
com.amazonaws.region.s3                         – Creates S3 gateway