aws-eks-managed-node-group/main.tf at main · terrablocks/aws-eks-managed-node-group · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
resource "aws_iam_role" "eks_ng_role" {
  count                 = var.create_ng_role ? 1 : 0
  name_prefix           = "${var.cluster_name}-ng-role-"
  force_detach_policies = true

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}

resource "aws_iam_role_policy_attachment" "ng_worker_policy" {
  count      = var.create_ng_role ? 1 : 0
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = join(", ", aws_iam_role.eks_ng_role[*].name)
}

resource "aws_iam_role_policy_attachment" "ng_cni_policy" {
  count      = var.create_ng_role ? 1 : 0
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
  role       = join(", ", aws_iam_role.eks_ng_role[*].name)
}

resource "aws_iam_role_policy_attachment" "ng_registry_policy" {
  count      = var.create_ng_role ? 1 : 0
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
  role       = join(", ", aws_iam_role.eks_ng_role[*].name)
}

# Policy required for cluster autoscaling
resource "aws_iam_role_policy" "eks_scaling_policy" {
  # checkov:skip=CKV_AWS_290: write access without constraint is required
  # checkov:skip=CKV_AWS_355: "*" for resource is required
  count       = var.create_ng_role ? 1 : 0
  name_prefix = "${var.cluster_name}-ng-role-policy-"
  role        = join(", ", aws_iam_role.eks_ng_role[*].id)

  policy = <<-EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "autoscaling:DescribeAutoScalingGroups",
          "autoscaling:DescribeAutoScalingInstances",
          "autoscaling:DescribeLaunchConfigurations",
          "autoscaling:DescribeTags",
          "autoscaling:SetDesiredCapacity",
          "autoscaling:TerminateInstanceInAutoScalingGroup",
          "ec2:DescribeLaunchTemplateVersions"
        ],
        "Effect": "Allow",
        "Resource": "*"
      }
    ]
  }
  EOF
}

locals {
  node_role_arn = var.create_ng_role ? join(", ", aws_iam_role.eks_ng_role[*].arn) : var.ng_role_arn
}

resource "aws_eks_node_group" "eks_ng" {
  cluster_name         = var.cluster_name
  node_group_name      = var.ng_name == "" ? "${var.cluster_name}-ng" : var.ng_name
  node_role_arn        = local.node_role_arn
  subnet_ids           = var.subnet_ids
  ami_type             = var.ami_type
  release_version      = var.ami_release_version
  disk_size            = var.disk_size
  force_update_version = var.force_update_version
  instance_types       = var.instance_types

  scaling_config {
    desired_size = var.desired_size
    max_size     = var.max_size
    min_size     = var.min_size
  }

  dynamic "launch_template" {
    for_each = length(var.launch_template) == 0 ? [] : [var.launch_template]
    content {
      id      = lookup(launch_template.value, "id", null)
      name    = lookup(launch_template.value, "name", null)
      version = lookup(launch_template.value, "version", null)
    }
  }

  dynamic "remote_access" {
    for_each = length(var.remote_access) == 0 ? [] : [var.remote_access]
    content {
      ec2_ssh_key               = lookup(remote_access.value, "ssh_key_name", null)
      source_security_group_ids = lookup(remote_access.value, "sg_ids", null)
    }
  }

  dynamic "taint" {
    for_each = var.taints
    content {
      key    = lookup(taint.value, "key", null)
      value  = lookup(taint.value, "value", null)
      effect = lookup(taint.value, "effect", null)
    }
  }

  capacity_type = var.capacity_type

  labels = length(var.labels) == 0 ? null : var.labels

  node_repair_config {
    enabled = var.enable_node_auto_repair
  }

  update_config {
    max_unavailable            = var.max_unavailable_type == "count" ? var.max_unavailable : null
    max_unavailable_percentage = var.max_unavailable_type == "percentage" ? var.max_unavailable : null
  }

  # Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
  # Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
  depends_on = [
    aws_iam_role_policy_attachment.ng_worker_policy,
    aws_iam_role_policy_attachment.ng_cni_policy,
    aws_iam_role_policy_attachment.ng_registry_policy,
  ]

  tags = var.tags

  lifecycle {
    ignore_changes = [scaling_config[0].desired_size]
  }
}