mirror of
https://github.com/external-secrets/external-secrets.git
synced 2024-12-14 11:57:59 +00:00
145 lines
3.2 KiB
HCL
145 lines
3.2 KiB
HCL
provider "aws" {
|
|
region = local.region
|
|
}
|
|
|
|
locals {
|
|
name = var.cluster_name
|
|
cluster_version = "1.27"
|
|
region = var.cluster_region
|
|
|
|
serviceaccount_name = var.irsa_sa_name
|
|
serviceaccount_namespace = var.irsa_sa_namespace
|
|
|
|
tags = {
|
|
Example = local.name
|
|
GithubRepo = "external-secrets"
|
|
GithubOrg = "external-secrets"
|
|
}
|
|
}
|
|
|
|
module "eks" {
|
|
source = "git::https://github.com/terraform-aws-modules/terraform-aws-eks?ref=v18.2.0"
|
|
|
|
cluster_name = local.name
|
|
cluster_version = local.cluster_version
|
|
cluster_endpoint_private_access = true
|
|
cluster_endpoint_public_access = true
|
|
|
|
cluster_addons = {
|
|
coredns = {
|
|
resolve_conflicts = "OVERWRITE"
|
|
}
|
|
kube-proxy = {}
|
|
vpc-cni = {
|
|
resolve_conflicts = "OVERWRITE"
|
|
}
|
|
|
|
}
|
|
|
|
vpc_id = module.vpc.vpc_id
|
|
subnet_ids = module.vpc.private_subnets
|
|
enable_irsa = true
|
|
|
|
# EKS Managed Node Group(s)
|
|
eks_managed_node_group_defaults = {
|
|
ami_type = "AL2_x86_64"
|
|
disk_size = 50
|
|
instance_types = ["t3.large"]
|
|
vpc_security_group_ids = [aws_security_group.additional.id]
|
|
}
|
|
|
|
|
|
eks_managed_node_groups = {
|
|
example = {
|
|
desired_size = 2
|
|
|
|
instance_types = ["t3.large"]
|
|
tags = local.tags
|
|
|
|
}
|
|
}
|
|
|
|
tags = local.tags
|
|
}
|
|
|
|
################################################################################
|
|
# Supporting resources
|
|
################################################################################
|
|
|
|
module "vpc" {
|
|
source = "terraform-aws-modules/vpc/aws"
|
|
version = "~> 3.14"
|
|
|
|
name = local.name
|
|
cidr = "10.0.0.0/16"
|
|
|
|
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
|
|
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
|
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
|
|
|
|
enable_nat_gateway = true
|
|
single_nat_gateway = true
|
|
enable_dns_hostnames = true
|
|
|
|
enable_flow_log = false
|
|
create_flow_log_cloudwatch_iam_role = false
|
|
create_flow_log_cloudwatch_log_group = false
|
|
|
|
public_subnet_tags = {
|
|
"kubernetes.io/cluster/${local.name}" = "shared"
|
|
"kubernetes.io/role/elb" = 1
|
|
}
|
|
|
|
private_subnet_tags = {
|
|
"kubernetes.io/cluster/${local.name}" = "shared"
|
|
"kubernetes.io/role/internal-elb" = 1
|
|
}
|
|
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_security_group" "additional" {
|
|
name_prefix = "${local.name}-additional"
|
|
vpc_id = module.vpc.vpc_id
|
|
|
|
ingress {
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
cidr_blocks = [
|
|
"10.0.0.0/8",
|
|
"172.16.0.0/12",
|
|
"192.168.0.0/16",
|
|
]
|
|
}
|
|
|
|
# allow control-plane to access webhook
|
|
ingress {
|
|
from_port = 9443
|
|
to_port = 9443
|
|
protocol = "tcp"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
ipv6_cidr_blocks = ["::/0"]
|
|
}
|
|
|
|
ingress {
|
|
from_port = 443
|
|
to_port = 443
|
|
protocol = "tcp"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
ipv6_cidr_blocks = ["::/0"]
|
|
}
|
|
|
|
|
|
# 443, 53, 123 is already allowed
|
|
egress {
|
|
from_port = 80
|
|
to_port = 80
|
|
protocol = "tcp"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
ipv6_cidr_blocks = ["::/0"]
|
|
}
|
|
|
|
|
|
tags = local.tags
|
|
}
|