kubernetes-env-template.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: |
  This Cloudformation Template creates a Kubernetes Cluster on Ubuntu 20.04 of Spot EC2 Instances.
  Kubernetes cluster comprises of one master node and one worker node.
  Once the Master node is up and running, Worker node automatically joins the Cluster.
  Managers security group allows all protocols from all ports within itself and from the Workers.
  Workers security group allows all protocols from all ports within itself and from the Managers.
  Both Security groups allows SSH (22) connections from anywhere.
  User needs to select appropriate key name when launching the template.
  This template is designed for us-east-1 (N. Virginia) region. If you work on another region, do not forget to change instances imageId

Parameters:
  keyPairName:
    Description: Enter the name of your Key Pair for SSH connections.
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: Must be one of the existing EC2 KeyPair

  #  myAZs:
  #    Description: Select at least 2 AZs
  #    Type: List<AWS::EC2::AvailabilityZone::Name>

  InstanceType:
    Description: Select instance type
    Type: String
    Default: t3.medium
    AllowedValues:
      - t3a.medium
      - t3.medium
      - c3.large
      - m4.large
      - m5.large

#Mappings:
#  RegionImageMap:
#    us-east-1:
#      AMI: ami-0dc2d3e4c0f9ebd18
#    us-east-2:
#      AMI: ami-0233c2d874b811deb
#    us-west-1:
#      AMI: ami-0ed05376b59b90e46
#    us-west-2:
#      AMI: ami-0dc8f589abe99f538
#    eu-west-1:
#      AMI: ami-058b1b7fe545997ae

Resources:
  InstanceConnectPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      PolicyDocument: #required
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - ec2-instance-connect:SendSSHPublicKey
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
            Condition: { "StringEquals": { "ec2:osuser": "ubuntu" } }
          - Effect: Allow
            Action:
              - ec2:DescribeInstances
            Resource: "*"

  EC2InstanceConnect:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - !Ref InstanceConnectPolicy

  EC2ConnectProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles: #required
        - !Ref EC2InstanceConnect

  ManagersSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH for Kube Masters
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 30000
          ToPort: 32767
          CidrIp: 0.0.0.0/0

  WorkersSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH for Kube Workers
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 30000
          ToPort: 32767
          CidrIp: 0.0.0.0/0

  ManagersSGIngress1:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !GetAtt ManagersSecurityGroup.GroupId
      IpProtocol: -1 #required
      SourceSecurityGroupId: !GetAtt ManagersSecurityGroup.GroupId

  ManagersSGIngress2:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !GetAtt ManagersSecurityGroup.GroupId
      IpProtocol: -1 #required
      SourceSecurityGroupId: !GetAtt WorkersSecurityGroup.GroupId

  WorkersSGIngress1:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !GetAtt WorkersSecurityGroup.GroupId
      IpProtocol: -1 #required
      SourceSecurityGroupId: !GetAtt WorkersSecurityGroup.GroupId

  WorkersSGIngress2:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !GetAtt WorkersSecurityGroup.GroupId
      IpProtocol: -1 #required
      SourceSecurityGroupId: !GetAtt ManagersSecurityGroup.GroupId

  KubernetesLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    DependsOn:
      - EC2ConnectProfile
    Properties:
      LaunchTemplateData:
        ImageId: ami-0dba2cb6798deb6d8
        InstanceType: !Ref InstanceType
        InstanceMarketOptions:
          MarketType: spot
          SpotOptions:
            MaxPrice: 0.0125
            InstanceInterruptionBehavior: terminate
            SpotInstanceType: one-time
        KeyName:
          Ref: keyPairName
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: CFN EC2 Spot Instance

  KubeMaster1:
    Type: AWS::EC2::Instance
    DependsOn:
      - KubernetesLaunchTemplate
    Properties:
      LaunchTemplate:
        LaunchTemplateId:
          Ref: KubernetesLaunchTemplate
        Version: 1
      IamInstanceProfile: !Ref EC2ConnectProfile
      #      AvailabilityZone: !Ref myAZs
      AvailabilityZone: us-east-1a
      SecurityGroupIds:
        - !GetAtt ManagersSecurityGroup.GroupId
      Tags:
        - Key: Name
          Value: !Sub Kube Master 1st on Ubuntu 20.04 of ${AWS::StackName}
      UserData:
        Fn::Base64: !Sub |
          #! /bin/bash
          apt-get update -y
          apt-get upgrade -y
          hostnamectl set-hostname kube-master
          chmod 777 /etc/sysctl.conf
          echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
          sysctl -p
          chmod 644 /etc/sysctl.conf
          apt install -y docker.io
          systemctl start docker
          mkdir /etc/docker
          cat <<EOF | tee /etc/docker/daemon.json
          {
            "exec-opts": ["native.cgroupdriver=systemd"],
            "log-driver": "json-file",
            "log-opts": {
              "max-size": "100m"
            },
            "storage-driver": "overlay2"
          }
          EOF
          systemctl enable docker
          sudo systemctl daemon-reload
          sudo systemctl restart docker
          usermod -aG docker ubuntu
          newgrp docker
          apt install -y apt-transport-https
          curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
          apt-add-repository "deb http://apt.kubernetes.io/ kubernetes-xenial main"
          apt update
          apt install -y kubelet kubeadm kubectl
          systemctl start kubelet
          systemctl enable kubelet
          kubeadm init --pod-network-cidr=172.16.0.0/16 --ignore-preflight-errors=All
          mkdir -p /home/ubuntu/.kube
          cp -i /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
          chown ubuntu:ubuntu /home/ubuntu/.kube/config
          su - ubuntu -c 'kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml'          
          echo "alias k='kubectl'" >> ~/.bashrc

  KubeWorker1:
    Type: AWS::EC2::Instance
    DependsOn:
      - KubeMaster1
    Properties:
      LaunchTemplate:
        LaunchTemplateId:
          Ref: KubernetesLaunchTemplate
        Version: 1
      IamInstanceProfile: !Ref EC2ConnectProfile
      #      AvailabilityZone: !Ref myAZs
      AvailabilityZone: us-east-1a
      SecurityGroupIds:
        - !GetAtt WorkersSecurityGroup.GroupId
      Tags:
        - Key: Name
          Value: !Sub Kube Worker 1st on Ubuntu 20.04 of ${AWS::StackName}
      UserData:
        Fn::Base64: !Sub |
          #! /bin/bash
          apt-get update -y
          apt-get upgrade -y
          hostnamectl set-hostname kube-worker-1
          chmod 777 /etc/sysctl.conf
          echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
          sysctl -p
          chmod 644 /etc/sysctl.conf
          apt install -y docker.io
          systemctl start docker
          cat <<EOF | tee /etc/docker/daemon.json
          {
            "exec-opts": ["native.cgroupdriver=systemd"],
            "log-driver": "json-file",
            "log-opts": {
              "max-size": "100m"
            },
            "storage-driver": "overlay2"
          }
          EOF
          systemctl enable docker
          sudo systemctl daemon-reload
          sudo systemctl restart docker
          usermod -aG docker ubuntu
          newgrp docker
          apt install -y apt-transport-https
          curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
          apt-add-repository "deb http://apt.kubernetes.io/ kubernetes-xenial main"
          apt update
          apt install -y kubelet kubeadm kubectl
          systemctl start kubelet
          systemctl enable kubelet
          apt install -y python3-pip
          pip3 install ec2instanceconnectcli
          apt install -y mssh
          until [[ $(mssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -r ${AWS::Region} ubuntu@${KubeMaster1} kubectl get no | awk 'NR == 2 {print $2}') == Ready ]]; do echo "master node is not ready"; sleep 3; done;
          kubeadm join ${KubeMaster1.PrivateIp}:6443 --token $(mssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -r ${AWS::Region} ubuntu@${KubeMaster1} kubeadm token list | awk 'NR == 2 {print $1}') --discovery-token-ca-cert-hash sha256:$(mssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -r ${AWS::Region} ubuntu@${KubeMaster1} openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //') --ignore-preflight-errors=All

Outputs:
  1stKubeMasterPublicDNSName:
    Description: Kube Master 1st Public DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt KubeMaster1.PublicDnsName
  1stKubeMasterPrivateDNSName:
    Description: Kube Master 1st Private DNS Name
    Value: !Sub
      - ${PrivateAddress}
      - PrivateAddress: !GetAtt KubeMaster1.PrivateDnsName
  1stKubeWorkerPublicDNSName:
    Description: Kube Worker 1st Public DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt KubeWorker1.PublicDnsName
  1stKubeWorkerPrivateDNSName:
    Description: Kube Worker 1st Private DNS Name
    Value: !Sub
      - ${PrivateAddress}
      - PrivateAddress: !GetAtt KubeWorker1.PrivateDnsName