Skip to content

Commit 1e05b23

Browse files
ciriskedcirisked
committed
wip
1 parent 6a09587 commit 1e05b23

File tree

6 files changed

+113
-133
lines changed

6 files changed

+113
-133
lines changed

‎examples/eks/eks_private_link/README.MD‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,12 @@ Example configuration should be analysed in the following order:
1717
| cluster_name = "" | Name of cluster |
1818
| cluster_region = "" | Name of region of cluster |
1919
| castai_api_token = "" | Cast api token |
20+
| rest_api_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint. |
21+
| grpc_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint |
22+
| api_grpc_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint |
23+
| files_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint |
24+
| kvisor_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint |
25+
| telemetry_service_name = "" | The name of the AWS PrivateLink service for the CAST AI endpoint |
2026

21-
3. Initialize Terraform. Under example root folder run:
22-
```
23-
terraform init
24-
```
25-
4. Run Terraform apply:
26-
```
27-
terraform apply -var-file=tf.vars
28-
```
29-
5. To destroy resources created by this example:
30-
```
31-
terraform destroy -var-file=tf.vars
32-
```
27+
Actual PrivateLink endpoints you can find here: https://github.com/castai/privatelink-aws
3328

34-
Please refer to this guide if you run into any issues https://docs.cast.ai/docs/terraform-troubleshooting

‎examples/eks/eks_private_link/eks.tf‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,26 +10,29 @@ module "eks" {
1010
cluster_endpoint_public_access = true
1111

1212
cluster_addons = {
13-
coredns = {
14-
most_recent = true
15-
}
16-
kube-proxy = {
17-
most_recent = true
13+
coredns = {}
14+
eks-pod-identity-agent = {
15+
before_compute = true
1816
}
17+
kube-proxy = {}
1918
vpc-cni = {
20-
most_recent = true
19+
before_compute = true
2120
}
2221
}
2322

2423
vpc_id = module.vpc.vpc_id
2524
subnet_ids = module.vpc.private_subnets
2625

2726
eks_managed_node_groups = {
28-
node_group_1 = {
27+
default = {
2928
name = "${var.cluster_name}-ng-1"
3029
instance_types = ["m5.large", "m5.xlarge", "t3.large"]
3130
desired_size = 2
3231
subnets = module.vpc.private_subnets
32+
33+
iam_role_additional_policies = {
34+
ssm = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
35+
}
3336
}
3437
}
3538

@@ -48,3 +51,4 @@ module "eks" {
4851
]
4952

5053
}
54+

examples/eks/eks_private_link/endpoints.tf renamed to examples/eks/eks_private_link/network.tf

Lines changed: 85 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,34 @@
1+
#1. Create VPC.
2+
data "aws_availability_zones" "available" {}
3+
4+
module "vpc" {
5+
source = "terraform-aws-modules/vpc/aws"
6+
version = "5.0.0"
7+
8+
name = var.cluster_name
9+
cidr = "10.0.0.0/16"
10+
11+
azs = data.aws_availability_zones.available.names
12+
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
13+
public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
14+
enable_dns_hostnames = true
15+
enable_dns_support = true
16+
enable_nat_gateway = true
17+
single_nat_gateway = true
18+
19+
20+
tags = {
21+
"kubernetes.io/cluster/${var.cluster_name}" = "shared"
22+
}
23+
24+
private_subnet_tags = {
25+
"kubernetes.io/cluster/${var.cluster_name}" = "shared"
26+
"kubernetes.io/role/internal-elb" = 1
27+
"cast.ai/routable" = "true"
28+
}
29+
}
30+
31+
132
resource "aws_security_group" "cast_ai_vpc_service" {
233
name = "SG used by NGINX proxy VMs"
334
vpc_id = module.vpc.vpc_id
@@ -16,35 +47,65 @@ resource "aws_security_group" "cast_ai_vpc_service" {
1647
]
1748
}
1849

50+
locals {
51+
gateway_endpoints = [
52+
"s3"
53+
]
54+
}
55+
56+
resource "aws_vpc_endpoint" "gateway" {
57+
for_each = toset(local.gateway_endpoints)
58+
vpc_id = module.vpc.vpc_id
59+
service_name = "com.amazonaws.${var.cluster_region}.${each.value}"
60+
vpc_endpoint_type = "Gateway"
61+
route_table_ids = module.vpc.private_route_table_ids
62+
tags = {
63+
Name = "${var.cluster_name}-${each.value}-vpce"
64+
}
65+
66+
depends_on = [
67+
module.vpc
68+
]
69+
}
70+
1971
locals {
2072
interface_endpoints = [
73+
"ec2",
74+
"ec2messages",
75+
"ssm",
76+
"ssmmessages",
77+
"monitoring",
78+
"logs",
2179
"ecr.api",
2280
"ecr.dkr",
23-
"logs",
24-
"sts"
81+
"secretsmanager",
82+
"sts",
83+
"ecs-agent",
84+
"ecs-telemetry"
2585
]
2686
}
2787

28-
resource "aws_vpc_endpoint" "interface_endpoints" {
29-
for_each = toset(local.interface_endpoints)
30-
88+
resource "aws_vpc_endpoint" "interface" {
89+
for_each = toset(local.interface_endpoints)
3190
vpc_id = module.vpc.vpc_id
32-
service_name = "com.amazonaws.${var.cluster_region}.${each.key}"
91+
service_name = "com.amazonaws.${var.cluster_region}.${each.value}"
3392
vpc_endpoint_type = "Interface"
3493
subnet_ids = module.vpc.private_subnets
94+
security_group_ids = [aws_security_group.vpc_endpoint_sg.id]
3595
private_dns_enabled = true
36-
security_group_ids = [aws_security_group.vpce_sg.id]
37-
}
96+
tags = {
97+
Name = "${var.cluster_name}-${each.value}-vpce"
98+
}
3899

39-
resource "aws_vpc_endpoint" "s3" {
40-
vpc_id = module.vpc.vpc_id
41-
service_name = "com.amazonaws.${var.cluster_region}.s3"
42-
route_table_ids = module.vpc.private_route_table_ids
100+
depends_on = [
101+
module.vpc
102+
]
43103
}
44104

45-
resource "aws_security_group" "vpce_sg" {
46-
name = "vpc-endpoints-sg"
47-
description = "Allow access to VPC interface endpoints"
105+
106+
resource "aws_security_group" "vpc_endpoint_sg" {
107+
name = "${var.cluster_name}-vpce-sg"
108+
description = "SG for VPC interface endpoints"
48109
vpc_id = module.vpc.vpc_id
49110

50111
ingress {
@@ -60,15 +121,18 @@ resource "aws_security_group" "vpce_sg" {
60121
protocol = "-1"
61122
cidr_blocks = ["0.0.0.0/0"]
62123
}
124+
125+
tags = {
126+
Name = "${var.cluster_name}-vpce-sg"
127+
}
63128
}
64129

65130
resource "aws_vpc_endpoint" "cast_ai_rest_api" {
66-
vpc_id = module.vpc.vpc_id
67-
service_name = var.rest_api_service_name
68-
vpc_endpoint_type = "Interface"
69-
subnet_ids = module.vpc.private_subnets
70-
security_group_ids = [aws_security_group.cast_ai_vpc_service.id]
71-
private_dns_enabled = true
131+
vpc_id = module.vpc.vpc_id
132+
service_name = var.rest_api_service_name
133+
vpc_endpoint_type = "Interface"
134+
subnet_ids = module.vpc.private_subnets
135+
security_group_ids = [aws_security_group.cast_ai_vpc_service.id]
72136

73137
depends_on = [
74138
module.vpc
@@ -140,4 +204,3 @@ resource "aws_vpc_endpoint" "cast_ai_telemetry" {
140204
]
141205
}
142206

143-

‎examples/eks/eks_private_link/tf.vars.example‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
1-
cluster_name = "<place-holder>"
2-
cluster_region = "<place-holder>"
3-
castai_api_token = "<place-holder>"
4-
profile = "<place-holder>"
1+
cluster_name = ""
2+
cluster_region = ""
3+
castai_api_token = ""
4+
profile = ""
5+
rest_api_service_name = ""
6+
grpc_service_name = ""
7+
api_grpc_service_name = ""
8+
files_service_name = ""
9+
kvisor_service_name = ""
10+
telemetry_service_name = ""

‎examples/eks/eks_private_link/variables.tf‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,3 @@ variable "telemetry_service_name" {
7575
description = "Service name used to access telemetry via gRPC"
7676
}
7777

78-
variable "gcp_api_ip_ranges" {
79-
description = "List of GCP IP ranges to allow outbound to (e.g. for Artifact Registry, Google APIs)"
80-
type = list(string)
81-
}
82-

‎examples/eks/eks_private_link/vpc.tf‎

Lines changed: 0 additions & 82 deletions
This file was deleted.

0 commit comments

Comments
 (0)