eks.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: EKS with RDS Multi-AZ

Parameters:
  ExistingEKSRole:
    Type: String
    Default: ""
    Description: "If an existing IAM role name is provided, the stack will use that instead of creating a new one."

Conditions:
  CreateNewEKSRole: !Equals [ !Ref ExistingEKSRole, "" ]

Resources:
  # VPC
  DevVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: DevVPC

  # Public Subnet (NAT Gateway)
  PublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: PublicSubnetA
  PublicSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: PublicSubnetB

  # EKS Private Subnets
  EKSPrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.3.0/24
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: EKSPrivateSubnetA

  EKSPrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.4.0/24
      AvailabilityZone: ap-northeast-2c
      Tags:
        - Key: Name
          Value: EKSPrivateSubnetB

  # RDS Private Subnets
  RDSPrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.5.0/24
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: RDSPrivateSubnetA

  RDSPrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.6.0/24
      AvailabilityZone: ap-northeast-2c
      Tags:
        - Key: Name
          Value: RDSPrivateSubnetB

  # Internet Gateway
  DevIGW:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: DevIGW

  AttachIGW:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref DevVPC
      InternetGatewayId: !Ref DevIGW

  # NAT Gateway
  NatEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatEIP.AllocationId  
      SubnetId: !Ref PublicSubnet
      Tags:
        - Key: Name
          Value: DevNGW

  # Route Tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref DevVPC
      Tags:
        - Key: Name
          Value: PublicRouteTable

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref DevIGW

  AssociatePublicSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetA
      RouteTableId: !Ref PublicRouteTable

  AssociatePublicSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetB
      RouteTableId: !Ref PublicRouteTable

  PrivateRouteTableA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref DevVPC
      Tags:
        - Key: Name
          Value: PrivateRouteTableB

  PrivateRouteA:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTableA
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateRouteTableB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref DevVPC
      Tags:
        - Key: Name
          Value: PrivateRouteTableB

  PrivateRouteB:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTableB
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  AssociatePrivateSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref EKSPrivateSubnetA
      RouteTableId: !Ref PrivateRouteTableA

  AssociatePrivateSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref EKSPrivateSubnetB
      RouteTableId: !Ref PrivateRouteTableB

  RDSPrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref DevVPC
      Tags:
        - Key: Name
          Value: RDSPrivateRouteTable

  RDSPrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  RDSAssociatePrivateSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref RDSPrivateSubnetA
      RouteTableId: !Ref RDSPrivateRouteTable

  RDSAssociatePrivateSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref RDSPrivateSubnetB
      RouteTableId: !Ref RDSPrivateRouteTable

  # EKS cluster
  DevEKS:
    Type: AWS::EKS::Cluster
    Properties:
      Name: DevEKS
      RoleArn: !GetAtt EKSRole.Arn
      Logging:
        ClusterLogging:
          EnabledTypes:
            - Type: api
            - Type: audit
            - Type: authenticator
            - Type: controllerManager
            - Type: scheduler
      KubernetesNetworkConfig:
        IpFamily: ipv4
      ResourcesVpcConfig:
        SubnetIds:
          - !Ref EKSPrivateSubnetA
          - !Ref EKSPrivateSubnetB
      Tags:
        - Key: Name
          Value: DevEKS

  # ALB Controller IAM Role
  ALBControllerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ALBControllerRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
        - arn:aws:iam::aws:policy/AmazonEKSServicePolicy

  ALBControllerPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ALBControllerPolicy
      Roles:
        - !Ref ALBControllerRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - elasticloadbalancing:*
              - ec2:Describe*
              - iam:CreateServiceLinkedRole
              - iam:GetRole
              - iam:ListRoles
              - iam:PassRole
              - cognito-idp:DescribeUserPoolClient
              - acm:ListCertificates
              - acm:DescribeCertificate
            Resource: "*"

  ALBControllerLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: !Sub "ALBControllerTemplate-${AWS::StackName}"
      LaunchTemplateData:
        UserData:
          Fn::Base64: !Sub |
            MIME-Version: 1.0
            Content-Type: multipart/mixed; boundary="==MYBOUNDARY=="

            --==MYBOUNDARY==
            Content-Type: text/cloud-config; charset="us-ascii"

            #cloud-config
            packages:
              - aws-cli
              - jq

            --==MYBOUNDARY==
            Content-Type: text/x-shellscript; charset="us-ascii"

            #!/bin/bash
            set -o xtrace

            # Mark that ALB has been installed to prevent re-installation
            touch /tmp/alb_installed

            # Install AWS CLI & jq
            yum install -y aws-cli jq

            # Wait for EKS NodeGroup to become active
            echo "Waiting for EKS NodeGroup to be active..."
            aws eks wait nodegroup-active --cluster-name ${DevEKS} --nodegroup-name EKSNodeGroup

            # Configure kubectl
            echo "Configuring kubectl..."
            aws eks update-kubeconfig --region ${AWS::Region} --name ${DevEKS}

            # Ensure kubectl works
            kubectl get nodes

            # Install Kubernetes tools if not already installed
            if ! command -v kubectl &> /dev/null
            then
              curl -o kubectl https://amazon-eks.s3.amazonaws.com/${AWS::Region}/latest/kubernetes_version/bin/linux/amd64/kubectl
              chmod +x ./kubectl
              mv ./kubectl /usr/local/bin/
            fi

            # Install Helm
            echo "Installing Helm..."
            curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash

            # Create IAM OIDC Provider if not exists
            echo "Checking for IAM OIDC Provider..."
            eksctl utils associate-iam-oidc-provider --region ${AWS::Region} --cluster ${DevEKS} --approve

            # Create ServiceAccount for AWS Load Balancer Controller
            echo "Creating ServiceAccount for AWS Load Balancer Controller..."
            kubectl create namespace kube-system || echo "Namespace already exists"
            kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json

            cat <<EOF | kubectl apply -f -
            apiVersion: v1
            kind: ServiceAccount
            metadata:
              name: aws-load-balancer-controller
              namespace: kube-system
              annotations:
                eks.amazonaws.com/role-arn: arn:aws:iam::${AWS::AccountId}:role/AWSLoadBalancerControllerRole
            EOF

            # Add EKS Helm repo
            echo "Adding Helm repo..."
            helm repo add eks https://aws.github.io/eks-charts
            helm repo update

            # Deploy AWS Load Balancer Controller
            echo "Installing AWS Load Balancer Controller..."
            helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
              --namespace kube-system \
              --set clusterName=${DevEKS} \
              --set serviceAccount.create=false \
              --set serviceAccount.name=aws-load-balancer-controller

            --==MYBOUNDARY==--


  # EKS node group
  EKSNodeGroup:
    Type: AWS::EKS::Nodegroup
    DependsOn:
    - ALBControllerLaunchTemplate
    Properties:
      ClusterName: !Ref DevEKS
      NodeRole: !GetAtt EKSNodeRole.Arn
      ScalingConfig:
        MinSize: 2
        MaxSize: 3
        DesiredSize: 2
      Subnets:
        - !Ref EKSPrivateSubnetA
        - !Ref EKSPrivateSubnetB
      InstanceTypes:
        - t3.medium
      Tags:
        Name: "EKSNodeGroup"
      LaunchTemplate:
        Id: !GetAtt ALBControllerLaunchTemplate.LaunchTemplateId
        Version: "1"
  
  #EKS IAM ROLE
  EKSRole:
    Type: AWS::IAM::Role
    Condition: CreateNewEKSRole
    Properties:
      RoleName: EKSRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
        - arn:aws:iam::aws:policy/AmazonEKSServicePolicy
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
        - arn:aws:iam::aws:policy/AmazonEKSVPCResourceController
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Tags:
        - Key: Name
          Value: EKSRole

  # EKS NODE IAM ROLE
  EKSNodeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EKSNodeRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
         - Effect: Allow
           Principal:
             Service:
               - ec2.amazonaws.com
           Action:
            - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
        - arn:aws:iam::605134473022:policy/AWSLoadBalancerControllerIAMPolicy
      Tags:
       - Key: Name
         Value: EKSNodeRole
  # Cloudwatch role
  CloudWatchLogsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: EKSCloudWatchLogsPolicy
      Roles:
        - !Ref EKSRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:DescribeLogStreams
              - logs:PutLogEvents
            Resource: 
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/eks/${DevEKS}/cluster:*"
  # EKS security
  EKSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "EKS Cluster Security Group"
      VpcId: !Ref DevVPC
      Tags:
        - Key: Name
          Value: EKSSecurityGroup

  # RDS Subnet Group
  RDSSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupName: dev-rds-subnet-group
      DBSubnetGroupDescription: "RDS subnet group for Multi-AZ"
      SubnetIds:
        - !Ref RDSPrivateSubnetA
        - !Ref RDSPrivateSubnetB
      Tags:
        - Key: Name
          Value: RDSSubnetGroup

  # RDS Instance (Multi-AZ)
  DevRDS:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: dev-rds
      Engine: mysql
      EngineVersion: "8.0"
      DBInstanceClass: db.t3.micro
      AllocatedStorage: 20
      MultiAZ: true
      MasterUsername: admin
      MasterUserPassword: "SecurePassword123!"
      DBSubnetGroupName: !Ref RDSSubnetGroup
      VPCSecurityGroups:
        - !Ref RDSSecurityGroup
      Tags:
        - Key: Name
          Value: DevRDS
    DeletionPolicy: Delete

  # RDS Security Group
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow MySQL access from EKS nodes"
      VpcId: !Ref DevVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref EKSSecurityGroup
      Tags:
        - Key: Name
          Value: RDSSecurityGroup

Outputs:
  ALBControllerRole:
    Value: !Ref ALBControllerRole
  VPCId:
    Value: !Ref DevVPC
  EKSClusterName:
    Value: !Ref DevEKS
  RDSInstance:
    Value: !Ref DevRDS