Skip to content

Commit e506592

Browse files
VardyNgVardyNg
committed
add customize cluster dns example
1 parent 3752250 commit e506592

11 files changed

Lines changed: 315 additions & 1 deletion

File tree

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
## This template illustrate the use of custom launch template in Managed Node Group
2+
3+
Key configuration `clusterDomain`:
4+
```
5+
Content-Type: multipart/mixed; boundary="BOUNDARY"
6+
MIME-Version: 1.0
7+
8+
--BOUNDARY
9+
Content-Transfer-Encoding: 7bit
10+
Content-Type: application/node.eks.aws
11+
Mime-Version: 1.0
12+
13+
---
14+
apiVersion: node.eks.aws/v1alpha1
15+
kind: NodeConfig
16+
spec:
17+
cluster:
18+
name: ${module.eks.cluster_name}
19+
apiServerEndpoint: ${module.eks.cluster_endpoint}
20+
certificateAuthority: ${module.eks.cluster_certificate_authority_data}
21+
cidr: ${module.eks.cluster_service_cidr}
22+
kubelet:
23+
config:
24+
clusterDomain: test.example # <- here
25+
```

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/data.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
data "aws_partition" "current" {}
2+
data "aws_caller_identity" "current" {}
3+
data "aws_availability_zones" "available" {}
4+
data "aws_eks_cluster_auth" "this" {
5+
name = module.eks.cluster_name
6+
}
7+
locals {
8+
name = basename(path.cwd)
9+
region = var.region
10+
11+
vpc_cidr = "10.0.0.0/16"
12+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
13+
14+
tags = {
15+
project = local.name
16+
}
17+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/eks.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
module "eks" {
2+
source = "terraform-aws-modules/eks/aws"
3+
version = "~> 20.0"
4+
5+
cluster_name = local.name
6+
cluster_version = var.eks_version
7+
cluster_endpoint_public_access = true
8+
cluster_endpoint_private_access = true
9+
10+
vpc_id = module.vpc.vpc_id
11+
subnet_ids = module.vpc.private_subnets
12+
13+
access_entries = {
14+
# One access entry with a policy associated
15+
admin = {
16+
kubernetes_groups = []
17+
principal_arn = data.aws_caller_identity.current.arn
18+
19+
policy_associations = {
20+
admin = {
21+
policy_arn = "arn:${data.aws_partition.current.partition}:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
22+
access_scope = {
23+
type = "cluster"
24+
}
25+
}
26+
}
27+
}
28+
}
29+
30+
tags = local.tags
31+
}
32+
33+
data "aws_ssm_parameter" "windows_ami" {
34+
name = "/aws/service/eks/optimized-ami/1.29/amazon-linux-2023/x86_64/standard/recommended/image_id"
35+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/iam.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# IAM Role for EKS worker nodes
2+
resource "aws_iam_role" "eks_worker_role" {
3+
name = "${local.name}-eks-worker-role"
4+
5+
assume_role_policy = jsonencode({
6+
Version = "2012-10-17"
7+
Statement = [
8+
{
9+
Effect = "Allow"
10+
Principal = {
11+
Service = "ec2.amazonaws.com"
12+
}
13+
Action = "sts:AssumeRole"
14+
}
15+
]
16+
})
17+
}
18+
19+
# Attach the AmazonEKSWorkerNodePolicy to the IAM Role
20+
resource "aws_iam_role_policy_attachment" "eks_worker_node_policy" {
21+
role = aws_iam_role.eks_worker_role.name
22+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
23+
}
24+
25+
# Attach the AmazonEC2ContainerRegistryReadOnly policy to allow access to ECR
26+
resource "aws_iam_role_policy_attachment" "eks_ecr_readonly_policy" {
27+
role = aws_iam_role.eks_worker_role.name
28+
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
29+
}
30+
31+
# Attach the AmazonEKS_CNI_Policy for networking permissions
32+
resource "aws_iam_role_policy_attachment" "eks_cni_policy" {
33+
role = aws_iam_role.eks_worker_role.name
34+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
35+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/k8s.tf‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
resource "kubernetes_daemonset" "dnsutils" {
2+
metadata {
3+
name = "dnsutils"
4+
namespace = "default"
5+
}
6+
spec {
7+
selector {
8+
match_labels = {
9+
name = "dnsutils"
10+
}
11+
}
12+
template {
13+
metadata {
14+
labels = {
15+
name = "dnsutils"
16+
}
17+
}
18+
spec {
19+
container {
20+
name = "dnsutils"
21+
image = "tutum/dnsutils"
22+
command = ["sleep", "3600"]
23+
}
24+
}
25+
}
26+
}
27+
}
28+
29+
resource "kubernetes_deployment" "nginx" {
30+
metadata {
31+
name = "nginx-sample"
32+
namespace = "default"
33+
labels = {
34+
app = "nginx-sample"
35+
}
36+
}
37+
spec {
38+
replicas = 2
39+
selector {
40+
match_labels = {
41+
app = "nginx-sample"
42+
}
43+
}
44+
template {
45+
metadata {
46+
labels = {
47+
app = "nginx-sample"
48+
}
49+
}
50+
spec {
51+
container {
52+
name = "nginx"
53+
image = "nginx:latest"
54+
port {
55+
container_port = 80
56+
}
57+
}
58+
}
59+
}
60+
}
61+
}
62+
63+
resource "kubernetes_service" "nginx" {
64+
metadata {
65+
name = "nginx-sample"
66+
namespace = "default"
67+
}
68+
spec {
69+
selector = {
70+
app = kubernetes_deployment.nginx.metadata[0].labels["app"]
71+
}
72+
port {
73+
port = 80
74+
target_port = 80
75+
}
76+
type = "ClusterIP"
77+
}
78+
}
79+

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/mng.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
resource "aws_launch_template" "eks_custom_lt" {
2+
name_prefix = "${local.name}-lt"
3+
image_id = data.aws_ssm_parameter.eks_al2023_ami.value
4+
instance_type = "t3.medium"
5+
6+
user_data = base64encode(<<-EOF
7+
Content-Type: multipart/mixed; boundary="BOUNDARY"
8+
MIME-Version: 1.0
9+
10+
--BOUNDARY
11+
Content-Transfer-Encoding: 7bit
12+
Content-Type: application/node.eks.aws
13+
Mime-Version: 1.0
14+
15+
---
16+
apiVersion: node.eks.aws/v1alpha1
17+
kind: NodeConfig
18+
spec:
19+
cluster:
20+
name: ${module.eks.cluster_name}
21+
apiServerEndpoint: ${module.eks.cluster_endpoint}
22+
certificateAuthority: ${module.eks.cluster_certificate_authority_data}
23+
cidr: ${module.eks.cluster_service_cidr}
24+
kubelet:
25+
config:
26+
clusterDomain: test.example
27+
--BOUNDARY--
28+
EOF
29+
)
30+
}
31+
32+
data "aws_ssm_parameter" "eks_al2023_ami" {
33+
name = "/aws/service/eks/optimized-ami/1.31/amazon-linux-2023/x86_64/standard/recommended/image_id"
34+
}
35+
36+
37+
resource "aws_eks_node_group" "mng-custom" {
38+
cluster_name = module.eks.cluster_name
39+
node_group_name = "mng-custom"
40+
node_role_arn = aws_iam_role.eks_worker_role.arn
41+
42+
subnet_ids = module.vpc.private_subnets
43+
44+
scaling_config {
45+
desired_size = 2
46+
max_size = 5
47+
min_size = 1
48+
}
49+
50+
launch_template {
51+
id = aws_launch_template.eks_custom_lt.id
52+
version = "$Latest"
53+
}
54+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/output.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "configure_kubectl" {
2+
description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
3+
value = "aws eks --region ${local.region} update-kubeconfig --name ${module.eks.cluster_name}"
4+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/terraform.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
terraform {
2+
required_version = ">= 1.3"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.34"
8+
}
9+
helm = {
10+
source = "hashicorp/helm"
11+
version = ">= 2.9"
12+
}
13+
kubernetes = {
14+
source = "hashicorp/kubernetes"
15+
version = ">= 2.20"
16+
}
17+
kubectl = {
18+
source = "gavinbunney/kubectl"
19+
version = ">= 1.14"
20+
}
21+
}
22+
}
23+
24+
provider "aws" {
25+
region = local.region
26+
}
27+
28+
provider "kubernetes" {
29+
host = module.eks.cluster_endpoint
30+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
31+
token = data.aws_eks_cluster_auth.this.token
32+
}
33+
34+
provider "kubectl" {
35+
apply_retry_count = 10
36+
host = module.eks.cluster_endpoint
37+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
38+
load_config_file = false
39+
token = data.aws_eks_cluster_auth.this.token
40+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/variable.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
variable "region" {
2+
type = string
3+
}
4+
5+
variable "eks_version" {
6+
type = string
7+
default = "1.31"
8+
}

‎KaaS/Elastic Kubernetes Service(EKS)/Terraform/custom-cluster-domain/vpc.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
module "vpc" {
2+
source = "terraform-aws-modules/vpc/aws"
3+
version = "~> 5.0"
4+
5+
name = local.name
6+
cidr = local.vpc_cidr
7+
8+
azs = local.azs
9+
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
10+
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
11+
12+
enable_nat_gateway = true
13+
single_nat_gateway = true
14+
15+
tags = local.tags
16+
}

0 commit comments

Comments
 (0)