aws-eks-auto/cluster.tf at main · nullstone-modules/aws-eks-auto · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
resource "aws_eks_cluster" "this" {
  name     = local.resource_name
  role_arn = aws_iam_role.this.arn
  version  = var.kubernetes_version
  tags     = local.tags

  access_config {
    authentication_mode = "API_AND_CONFIG_MAP" # TODO: Harden to API once platform/catalog supports
  }

  bootstrap_self_managed_addons = false

  dynamic "compute_config" {
    for_each = var.enable_auto_mode ? [1] : []
    content {
      enabled       = true
      node_pools    = ["general-purpose"]
      node_role_arn = aws_iam_role.node[0].arn
    }
  }

  dynamic "storage_config" {
    for_each = var.enable_auto_mode ? [1] : []
    content {
      block_storage {
        enabled = true
      }
    }
  }

  dynamic "kubernetes_network_config" {
    for_each = var.enable_auto_mode ? [1] : []
    content {
      elastic_load_balancing {
        enabled = true
      }
    }
  }

  enabled_cluster_log_types = [
    "api",
    "audit",
    "authenticator",
    "controllerManager",
    "scheduler",
  ]

  encryption_config {
    resources = ["secrets"]

    provider {
      key_arn = aws_kms_key.this.arn
    }
  }

  #bridgecrew:skip=BC_AWS_KUBERNETES_1:Cluster security group is restricted in aws_security_group.node
  #bridgecrew:skip=BC_AWS_KUBERNETES_2:Enabling Nullstone to provision/deploy into Kubernetes cluster
  vpc_config {
    endpoint_public_access  = true
    endpoint_private_access = false
    subnet_ids              = local.private_subnet_ids
    security_group_ids      = [aws_security_group.node.id]
  }

  timeouts {
    delete = "30m"
  }

  depends_on = [
    module.logs,
    aws_iam_role_policy_attachment.this_basic,
    aws_iam_role_policy_attachment.this_service,
    aws_iam_role_policy_attachment.this_vpc,
    aws_iam_role_policy_attachment.node_minimal,
    aws_iam_role_policy_attachment.node_ecr,
  ]
}