From 7d7c607f86b8167a0a73720dfdfbbc0e101dc46e Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 00:18:45 +0200 Subject: [PATCH 01/21] deploy --- .github/workflows/tofu.yaml | 4 ++-- tofu/vars/vars.yaml | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/tofu.yaml b/.github/workflows/tofu.yaml index 981eae4..9dfe345 100644 --- a/.github/workflows/tofu.yaml +++ b/.github/workflows/tofu.yaml @@ -5,13 +5,13 @@ on: push: branches: - main - - dev + - deploy paths: - tofu/* pull_request: branches: - main - - dev + - deploy paths: - tofu/* diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 8215218..aba06b3 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -13,6 +13,7 @@ versions: s3: v5.14.0 security_group: v6.0.0 vpc: v6.6.1 + ec2: - name: ssm-proxy create: false @@ -21,10 +22,10 @@ ecs: efs: create: false eks: - create: false - cluster_version: 1.32 + create: true + cluster_version: 1.33 sc: - gp3: false + gp3: true efs: false fargate_profile: - name: "core-dns" @@ -34,7 +35,7 @@ eks: "eks.amazonaws.com/component": "coredns" iam: github_oidc: - repos: ["harik8/sandbox:*","harik8/hariprasad.dev:*","harik8/awsing:*"] + repos: ["harik8/manalpetti:*","harik8/hariprasad.dev:*","harik8/awsing:*"] rds: psql: create: false @@ -44,5 +45,5 @@ vpc: create: true cidr: 10.100.0.0/16 nat_gateway: - enable: false + enable: true single: true From 50dd4142aa88c9d6a88f868caf0b619c4a9d7b47 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 00:27:23 +0200 Subject: [PATCH 02/21] deploy --- .github/workflows/tofu.yaml | 2 +- tofu/main.tofu | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tofu.yaml b/.github/workflows/tofu.yaml index 9dfe345..0b9099b 100644 --- a/.github/workflows/tofu.yaml +++ b/.github/workflows/tofu.yaml @@ -20,7 +20,7 @@ permissions: contents: read # This is required for actions/checkout jobs: - TOFU-APPLY: + RELEASE: runs-on: ubuntu-slim steps: diff --git a/tofu/main.tofu b/tofu/main.tofu index c401374..4e8dced 100644 --- a/tofu/main.tofu +++ b/tofu/main.tofu @@ -34,3 +34,4 @@ provider "kubernetes" { args = local.vars.eks.create ? ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--role-arn", "arn:aws:iam::${var.account_id}:role/${var.iac_role}", "--region", var.aws_region] : [] } } + From 623d00a746faf0ff002df1df10864a1e6eef3a09 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 19:05:09 +0200 Subject: [PATCH 03/21] add pause to tofu pipeline --- .github/workflows/tofu.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/tofu.yaml b/.github/workflows/tofu.yaml index 0b9099b..1ead921 100644 --- a/.github/workflows/tofu.yaml +++ b/.github/workflows/tofu.yaml @@ -65,4 +65,5 @@ jobs: tofu init tofu workspace select ${{ vars.TOFU_WORKSPACE }} tofu plan + sleep 10 tofu apply -auto-approve From 01cc321542e095a629bb3602915b2fbb8e905f85 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 19:26:31 +0200 Subject: [PATCH 04/21] fix AMI type --- tofu/eks.tofu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 3c4d239..e31d51c 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -161,7 +161,7 @@ module "eks_managed_node_group" { cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id vpc_security_group_ids = [module.eks.node_security_group_id] - ami_type = "AL2_ARM_64" + ami_type = "AL2023_ARM_64_STANDARD" min_size = 1 max_size = 1 From 37b808174afcf81b1137c2b2a0982c5f37ec6979 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 19:51:40 +0200 Subject: [PATCH 05/21] fix EKS auth --- .github/workflows/tofu.yaml | 6 ------ tofu/eks.tofu | 6 +++--- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/.github/workflows/tofu.yaml b/.github/workflows/tofu.yaml index 1ead921..40d3ec9 100644 --- a/.github/workflows/tofu.yaml +++ b/.github/workflows/tofu.yaml @@ -2,12 +2,6 @@ name: RELEASE on: - push: - branches: - - main - - deploy - paths: - - tofu/* pull_request: branches: - main diff --git a/tofu/eks.tofu b/tofu/eks.tofu index e31d51c..fe68495 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -16,11 +16,11 @@ module "eks" { access_entries = { aws_admin = { kubernetes_groups = [] - user_name = "AWSAdmin" - principal_arn = "arn:aws:iam::${var.account_id}:role/${var.iac_role}" + user_name = "AWSEKSAdmin" + principal_arn = "arn:aws:sts::${var.account_id}:assumed-role/AWSReservedSSO_AdministratorAccess_0ada0c673e6da443/hari.karthigasu", policy_associations = { - aws_admin = { + aws_eks_admin = { policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy" access_scope = { type = "cluster" From d0044aca11b5ded032faa05eae47707e7a305d6b Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 20:22:15 +0200 Subject: [PATCH 06/21] Upgrade EKS version --- tofu/eks.tofu | 34 +++++++++++++++++----------------- tofu/vars/vars.yaml | 2 +- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index fe68495..895f064 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -17,7 +17,7 @@ module "eks" { aws_admin = { kubernetes_groups = [] user_name = "AWSEKSAdmin" - principal_arn = "arn:aws:sts::${var.account_id}:assumed-role/AWSReservedSSO_AdministratorAccess_0ada0c673e6da443/hari.karthigasu", + principal_arn = "arn:aws:iam::${var.account_id}:role/aws-reserved/sso.amazonaws.com/${var.aws_region}/AWSReservedSSO_AdministratorAccess_0ada0c673e6da443", policy_associations = { aws_eks_admin = { @@ -34,7 +34,7 @@ module "eks" { coredns = { most_recent = true configuration_values = jsonencode({ - computeType = "Fargate" + computeType = "EC2" autoScaling = { enabled = true minReplicas = 2 @@ -48,21 +48,21 @@ module "eks" { vpc-cni = { most_recent = true } - aws-efs-csi-driver = { - most_recent = true - service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" - configuration_values = jsonencode({ - replicaCount = 1 - tolerations = [ - { - key = "application" - effect = "NoSchedule" - operator = "Equal" - value = "true" - } - ] - }) - } + # aws-efs-csi-driver = { + # most_recent = true + # service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" + # configuration_values = jsonencode({ + # replicaCount = 1 + # tolerations = [ + # { + # key = "application" + # effect = "NoSchedule" + # operator = "Equal" + # value = "true" + # } + # ] + # }) + # } } } diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index aba06b3..855adea 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -23,7 +23,7 @@ efs: create: false eks: create: true - cluster_version: 1.33 + cluster_version: 1.36 sc: gp3: true efs: false From 66d0bd02d10546bda595f901e596005fb7f55b23 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 20:27:26 +0200 Subject: [PATCH 07/21] Upgrade EKS version to 1.34 --- tofu/vars/vars.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 855adea..c3f4839 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -23,7 +23,7 @@ efs: create: false eks: create: true - cluster_version: 1.36 + cluster_version: 1.34 sc: gp3: true efs: false From de5ced4e1172edc36790c254dd80992801fe8e60 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 20:48:34 +0200 Subject: [PATCH 08/21] Upgrade EKS version to 1.35 --- tofu/vars/vars.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index c3f4839..79de2f0 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -23,7 +23,7 @@ efs: create: false eks: create: true - cluster_version: 1.34 + cluster_version: 1.35 sc: gp3: true efs: false From 8c51403a9df136bb4869a982319261d1fe3d9a26 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 21:28:01 +0200 Subject: [PATCH 09/21] Upgrade EKS version to 1.36 --- tofu/vars/vars.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 79de2f0..855adea 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -23,7 +23,7 @@ efs: create: false eks: create: true - cluster_version: 1.35 + cluster_version: 1.36 sc: gp3: true efs: false From 7885c6c1e5f9927e661fd83627ad36f89088153f Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 21:50:05 +0200 Subject: [PATCH 10/21] fix aws-eks-efs-csi addon --- tofu/eks.tofu | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 895f064..c3e1fab 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -48,21 +48,10 @@ module "eks" { vpc-cni = { most_recent = true } - # aws-efs-csi-driver = { - # most_recent = true - # service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" - # configuration_values = jsonencode({ - # replicaCount = 1 - # tolerations = [ - # { - # key = "application" - # effect = "NoSchedule" - # operator = "Equal" - # value = "true" - # } - # ] - # }) - # } + aws-efs-csi-driver = { + most_recent = true + service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" + } } } From ed15d5ba9f7d00fd013211d671ac0c3f581e38f6 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 21:58:40 +0200 Subject: [PATCH 11/21] fix aws-eks-efs-csi addon --- tofu/eks.tofu | 50 +++++++++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 23 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index c3e1fab..892dba9 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -30,29 +30,33 @@ module "eks" { } } - addons = { - coredns = { - most_recent = true - configuration_values = jsonencode({ - computeType = "EC2" - autoScaling = { - enabled = true - minReplicas = 2 - maxReplicas = 2 - } - }) - } - kube-proxy = { - most_recent = true - } - vpc-cni = { - most_recent = true - } - aws-efs-csi-driver = { - most_recent = true - service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" - } - } + addons = merge( + { + coredns = { + most_recent = true + configuration_values = jsonencode({ + computeType = "EC2" + autoScaling = { + enabled = true + minReplicas = 2 + maxReplicas = 2 + } + }) + } + kube-proxy = { + most_recent = true + } + vpc-cni = { + most_recent = true + } + }, + local.vars.efs.create ? { + aws-efs-csi-driver = { + most_recent = true + service_account_role_arn = "arn:aws:iam::${var.account_id}:role/${terraform.workspace}-efs-csi" + } + } : {} + ) } module "fargate_profile" { From cc86c6917aec3d972922b170d42eea1930c6be0c Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:03:27 +0200 Subject: [PATCH 12/21] disable eks --- tofu/vars/vars.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 855adea..9acebd4 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -22,7 +22,7 @@ ecs: efs: create: false eks: - create: true + create: false cluster_version: 1.36 sc: gp3: true @@ -45,5 +45,5 @@ vpc: create: true cidr: 10.100.0.0/16 nat_gateway: - enable: true + enable: false single: true From c386f9b940d84303d8ec95dc152b1ef433d28bff Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:07:09 +0200 Subject: [PATCH 13/21] disable eks --- tofu/vars/vars.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 9acebd4..3f3cf73 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -25,7 +25,7 @@ eks: create: false cluster_version: 1.36 sc: - gp3: true + gp3: false efs: false fargate_profile: - name: "core-dns" From 927dbac9c0d10ee1e72f98868f62300af9c7c1b1 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:12:04 +0200 Subject: [PATCH 14/21] disable eks --- tofu/eks.tofu | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 892dba9..44abf8f 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -99,7 +99,7 @@ resource "aws_security_group_rule" "dns_udp" { resource "kubernetes_storage_class_v1" "gp3" { - count = local.vars.eks.sc.gp3 ? 1 : 0 + count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 metadata { name = "gp3" @@ -120,7 +120,7 @@ resource "kubernetes_storage_class_v1" "gp3" { resource "kubernetes_storage_class_v1" "efs" { - count = local.vars.eks.sc.efs ? 1 : 0 + count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 metadata { name = "efs" From da40c273fbe82ee6c54522fefeb870c6f72a275a Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:18:16 +0200 Subject: [PATCH 15/21] disable eks --- tofu/eks.tofu | 2 -- tofu/main.tofu | 18 +++++++++--------- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 44abf8f..1185fa7 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -98,7 +98,6 @@ resource "aws_security_group_rule" "dns_udp" { } resource "kubernetes_storage_class_v1" "gp3" { - count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 metadata { @@ -119,7 +118,6 @@ resource "kubernetes_storage_class_v1" "gp3" { } resource "kubernetes_storage_class_v1" "efs" { - count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 metadata { diff --git a/tofu/main.tofu b/tofu/main.tofu index 4e8dced..6f9b534 100644 --- a/tofu/main.tofu +++ b/tofu/main.tofu @@ -24,14 +24,14 @@ provider "aws" { } } -provider "kubernetes" { - host = local.vars.eks.create ? module.eks.cluster_endpoint : "https://localhost" - cluster_ca_certificate = local.vars.eks.create ? base64decode(module.eks.cluster_certificate_authority_data) : null +# provider "kubernetes" { +# host = local.vars.eks.create ? module.eks.cluster_endpoint : "https://localhost" +# cluster_ca_certificate = local.vars.eks.create ? base64decode(module.eks.cluster_certificate_authority_data) : null - exec { - api_version = "client.authentication.k8s.io/v1beta1" - command = "aws" - args = local.vars.eks.create ? ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--role-arn", "arn:aws:iam::${var.account_id}:role/${var.iac_role}", "--region", var.aws_region] : [] - } -} +# exec { +# api_version = "client.authentication.k8s.io/v1beta1" +# command = "aws" +# args = local.vars.eks.create ? ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--role-arn", "arn:aws:iam::${var.account_id}:role/${var.iac_role}", "--region", var.aws_region] : [] +# } +# } From 5ecd22c8cd856b4851421d69b0fdddc295bec03b Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:27:25 +0200 Subject: [PATCH 16/21] disable eks --- tofu/eks.tofu | 76 +++++++++++++++++++++++++------------------------- tofu/main.tofu | 18 ++++++------ 2 files changed, 47 insertions(+), 47 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 1185fa7..71d7b15 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -97,44 +97,44 @@ resource "aws_security_group_rule" "dns_udp" { security_group_id = module.eks.cluster_primary_security_group_id } -resource "kubernetes_storage_class_v1" "gp3" { - count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 - - metadata { - name = "gp3" - annotations = { - "storageclass.kubernetes.io/is-default-class" = "true" - } - } - - storage_provisioner = "ebs.csi.aws.com" - volume_binding_mode = "WaitForFirstConsumer" - allow_volume_expansion = false - - parameters = { - type = "gp3" - encrypted = "true" - } -} - -resource "kubernetes_storage_class_v1" "efs" { - count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 - - metadata { - name = "efs" - } - - storage_provisioner = "efs.csi.aws.com" - - parameters = { - provisioningMode = "efs-ap" - fileSystemId = module.efs.id - directoryPerms = "700" - } - - reclaim_policy = "Delete" - volume_binding_mode = "Immediate" -} +# resource "kubernetes_storage_class_v1" "gp3" { +# count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 +# +# metadata { +# name = "gp3" +# annotations = { +# "storageclass.kubernetes.io/is-default-class" = "true" +# } +# } +# +# storage_provisioner = "ebs.csi.aws.com" +# volume_binding_mode = "WaitForFirstConsumer" +# allow_volume_expansion = false +# +# parameters = { +# type = "gp3" +# encrypted = "true" +# } +# } + +# resource "kubernetes_storage_class_v1" "efs" { +# count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 +# +# metadata { +# name = "efs" +# } +# +# storage_provisioner = "efs.csi.aws.com" +# +# parameters = { +# provisioningMode = "efs-ap" +# fileSystemId = module.efs.id +# directoryPerms = "700" +# } +# +# reclaim_policy = "Delete" +# volume_binding_mode = "Immediate" +# } module "eks_managed_node_group" { source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group" diff --git a/tofu/main.tofu b/tofu/main.tofu index 6f9b534..4e8dced 100644 --- a/tofu/main.tofu +++ b/tofu/main.tofu @@ -24,14 +24,14 @@ provider "aws" { } } -# provider "kubernetes" { -# host = local.vars.eks.create ? module.eks.cluster_endpoint : "https://localhost" -# cluster_ca_certificate = local.vars.eks.create ? base64decode(module.eks.cluster_certificate_authority_data) : null +provider "kubernetes" { + host = local.vars.eks.create ? module.eks.cluster_endpoint : "https://localhost" + cluster_ca_certificate = local.vars.eks.create ? base64decode(module.eks.cluster_certificate_authority_data) : null -# exec { -# api_version = "client.authentication.k8s.io/v1beta1" -# command = "aws" -# args = local.vars.eks.create ? ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--role-arn", "arn:aws:iam::${var.account_id}:role/${var.iac_role}", "--region", var.aws_region] : [] -# } -# } + exec { + api_version = "client.authentication.k8s.io/v1beta1" + command = "aws" + args = local.vars.eks.create ? ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--role-arn", "arn:aws:iam::${var.account_id}:role/${var.iac_role}", "--region", var.aws_region] : [] + } +} From 94d250961df860797a0b3de5dee7baf921e55b4c Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 24 Jun 2026 22:31:12 +0200 Subject: [PATCH 17/21] disable eks --- tofu/eks.tofu | 76 +++++++++++++++++++++++++-------------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 71d7b15..1185fa7 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -97,44 +97,44 @@ resource "aws_security_group_rule" "dns_udp" { security_group_id = module.eks.cluster_primary_security_group_id } -# resource "kubernetes_storage_class_v1" "gp3" { -# count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 -# -# metadata { -# name = "gp3" -# annotations = { -# "storageclass.kubernetes.io/is-default-class" = "true" -# } -# } -# -# storage_provisioner = "ebs.csi.aws.com" -# volume_binding_mode = "WaitForFirstConsumer" -# allow_volume_expansion = false -# -# parameters = { -# type = "gp3" -# encrypted = "true" -# } -# } - -# resource "kubernetes_storage_class_v1" "efs" { -# count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 -# -# metadata { -# name = "efs" -# } -# -# storage_provisioner = "efs.csi.aws.com" -# -# parameters = { -# provisioningMode = "efs-ap" -# fileSystemId = module.efs.id -# directoryPerms = "700" -# } -# -# reclaim_policy = "Delete" -# volume_binding_mode = "Immediate" -# } +resource "kubernetes_storage_class_v1" "gp3" { + count = local.vars.eks.create && local.vars.eks.sc.gp3 ? 1 : 0 + + metadata { + name = "gp3" + annotations = { + "storageclass.kubernetes.io/is-default-class" = "true" + } + } + + storage_provisioner = "ebs.csi.aws.com" + volume_binding_mode = "WaitForFirstConsumer" + allow_volume_expansion = false + + parameters = { + type = "gp3" + encrypted = "true" + } +} + +resource "kubernetes_storage_class_v1" "efs" { + count = local.vars.eks.create && local.vars.eks.sc.efs ? 1 : 0 + + metadata { + name = "efs" + } + + storage_provisioner = "efs.csi.aws.com" + + parameters = { + provisioningMode = "efs-ap" + fileSystemId = module.efs.id + directoryPerms = "700" + } + + reclaim_policy = "Delete" + volume_binding_mode = "Immediate" +} module "eks_managed_node_group" { source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group" From 8f1737d1f8fe72f9c432b3f3d63b5c30fbbd19a7 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 8 Jul 2026 08:19:02 +0200 Subject: [PATCH 18/21] DEPLOY: deploy the resources --- tofu/vars/vars.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 3f3cf73..70398af 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -22,7 +22,7 @@ ecs: efs: create: false eks: - create: false + create: true cluster_version: 1.36 sc: gp3: false @@ -45,5 +45,5 @@ vpc: create: true cidr: 10.100.0.0/16 nat_gateway: - enable: false + enable: true single: true From f118e8e201020e75ca0cf36f5e15d0c8b86598b1 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 8 Jul 2026 08:21:12 +0200 Subject: [PATCH 19/21] DEPLOY: deploy the resources --- tofu/outputs.tofu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tofu/outputs.tofu b/tofu/outputs.tofu index 495141b..bb5efd2 100644 --- a/tofu/outputs.tofu +++ b/tofu/outputs.tofu @@ -1,3 +1,3 @@ # output "eks" { # value = module.eks -# } \ No newline at end of file +# } From e270db67d49ec92a4bb53d4d370e47643e1a74f7 Mon Sep 17 00:00:00 2001 From: harik8 Date: Wed, 8 Jul 2026 18:39:45 +0200 Subject: [PATCH 20/21] D-080726: Add fargate profile for gha-runner --- tofu/vars/vars.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 3f3cf73..aa7e3a1 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -33,6 +33,11 @@ eks: - namespace: "kube-system" labels: "eks.amazonaws.com/component": "coredns" + - name: "gha-runners" + selectors: + - namespace: "gha-runner" + labels: + "app.kubernetes.io/name": "gha-runner" iam: github_oidc: repos: ["harik8/manalpetti:*","harik8/hariprasad.dev:*","harik8/awsing:*"] From 44fc1f8b38d31d7f60a28c400e293f54cfb99b38 Mon Sep 17 00:00:00 2001 From: harik8 Date: Sat, 18 Jul 2026 08:06:56 +0200 Subject: [PATCH 21/21] Add NLB --- tofu/eks.tofu | 110 +++++++++++++++++++++++++++++++++++- tofu/nlb.tofu | 134 ++++++++++++++++++++++++++++++++++++++++++++ tofu/outputs.tofu | 10 ++++ tofu/vars/vars.yaml | 8 ++- 4 files changed, 257 insertions(+), 5 deletions(-) create mode 100644 tofu/nlb.tofu diff --git a/tofu/eks.tofu b/tofu/eks.tofu index 1185fa7..a06f5e3 100644 --- a/tofu/eks.tofu +++ b/tofu/eks.tofu @@ -136,13 +136,21 @@ resource "kubernetes_storage_class_v1" "efs" { volume_binding_mode = "Immediate" } -module "eks_managed_node_group" { +# ── Self-managed node groups ────────────────────────────────────────────────── +# Self-managed nodes give full control over the launch template and ASG. +# SPOT is configured via instance_market_options instead of capacity_type. +# The module creates its own IAM role + instance profile and registers an +# access entry so nodes can join the cluster automatically. + +# ── EKS managed node groups ─────────────────────────────────────────────────── + +module "eks_managed_node_group_application" { source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group" version = local.vars.versions.eks create = local.vars.eks.create - name = terraform.workspace + name = "${terraform.workspace}-application" cluster_name = terraform.workspace kubernetes_version = local.vars.eks.cluster_version cluster_service_cidr = module.eks.cluster_service_cidr @@ -161,7 +169,6 @@ module "eks_managed_node_group" { instance_types = ["t4g.small"] capacity_type = "SPOT" - block_device_mappings = { xvda = { device_name = "/dev/xvda" @@ -185,6 +192,103 @@ module "eks_managed_node_group" { } } +module "eks_managed_node_group_ingress_controller" { + source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group" + version = local.vars.versions.eks + + create = local.vars.eks.create + + name = "${terraform.workspace}-ingress" + cluster_name = terraform.workspace + kubernetes_version = local.vars.eks.cluster_version + cluster_service_cidr = module.eks.cluster_service_cidr + + subnet_ids = module.vpc.private_subnets + + cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id + vpc_security_group_ids = [module.eks.node_security_group_id] + + ami_type = "AL2023_ARM_64_STANDARD" + + min_size = 1 + max_size = 1 + desired_size = 1 + + instance_types = ["t4g.small"] + capacity_type = "SPOT" + + block_device_mappings = { + xvda = { + device_name = "/dev/xvda" + ebs = { + volume_type = "gp3" + encrypted = true + } + } + } + + taints = { + dedicated = { + key = "ingress-controller" + value = "true" + effect = "NO_SCHEDULE" + } + } + + iam_role_additional_policies = { + AmazonEBSCSIDriverPolicy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" + } +} + +module "eks_managed_node_group_core_addons" { + source = "terraform-aws-modules/eks/aws//modules/eks-managed-node-group" + version = local.vars.versions.eks + + create = local.vars.eks.create + + name = "${terraform.workspace}-core-addons" + cluster_name = terraform.workspace + kubernetes_version = local.vars.eks.cluster_version + cluster_service_cidr = module.eks.cluster_service_cidr + + subnet_ids = module.vpc.private_subnets + + cluster_primary_security_group_id = module.eks.cluster_primary_security_group_id + vpc_security_group_ids = [module.eks.node_security_group_id] + + ami_type = "AL2023_ARM_64_STANDARD" + + min_size = 1 + max_size = 1 + desired_size = 1 + + instance_types = ["t4g.small"] + capacity_type = "SPOT" + + block_device_mappings = { + xvda = { + device_name = "/dev/xvda" + ebs = { + volume_type = "gp3" + encrypted = true + } + } + } + + taints = { + dedicated = { + key = "core-addons" + value = "true" + effect = "NO_SCHEDULE" + } + } + + iam_role_additional_policies = { + AmazonEBSCSIDriverPolicy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" + } +} + + module "irsa_efs_csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = local.vars.versions.iam diff --git a/tofu/nlb.tofu b/tofu/nlb.tofu new file mode 100644 index 0000000..1c418a2 --- /dev/null +++ b/tofu/nlb.tofu @@ -0,0 +1,134 @@ +resource "aws_security_group" "nlb" { + count = local.vars.nlb.create ? 1 : 0 + + name_prefix = "${terraform.workspace}-nlb-" + description = "NLB fronting EKS ingress-controller nodes" + vpc_id = module.vpc.vpc_id + + ingress { + description = "HTTP" + from_port = 80 + to_port = 80 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + + ingress { + description = "HTTPS/TLS" + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + + egress { + description = "Outbound to VPC" + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = [local.vars.vpc.cidr] + } + + lifecycle { + create_before_destroy = true + } +} + +# Allow the NLB to reach port 80 on the ingress-controller nodes. +resource "aws_security_group_rule" "nodes_allow_nlb_http" { + count = local.vars.nlb.create ? 1 : 0 + + description = "Allow NLB to reach port 80 on ingress-controller nodes" + type = "ingress" + from_port = 80 + to_port = 80 + protocol = "tcp" + security_group_id = module.eks.node_security_group_id + source_security_group_id = aws_security_group.nlb[0].id +} + +# NLB health check probes originate from the NLB node's private IP, not from +# the NLB security group — so source_security_group_id does not work here. +# Allow port 1042 from the VPC CIDR so health checks can reach HAProxy. +resource "aws_security_group_rule" "nodes_allow_nlb_healthcheck" { + count = local.vars.nlb.create ? 1 : 0 + + description = "Allow NLB health checks on port 1042 from VPC" + type = "ingress" + from_port = 1042 + to_port = 1042 + protocol = "tcp" + security_group_id = module.eks.node_security_group_id + cidr_blocks = [local.vars.vpc.cidr] +} + +module "nlb" { + source = "terraform-aws-modules/alb/aws" + version = local.vars.versions.alb + + create = local.vars.nlb.create + + name = "${terraform.workspace}-public" + load_balancer_type = "network" + vpc_id = module.vpc.vpc_id + subnets = module.vpc.public_subnets + security_groups = local.vars.nlb.create ? [aws_security_group.nlb[0].id] : [] + internal = local.vars.nlb.internal + + enable_cross_zone_load_balancing = true + + target_groups = { + http = { + name = "${terraform.workspace}-http" + protocol = "TCP" + port = 80 + target_type = "instance" + vpc_id = module.vpc.vpc_id + deregistration_delay = 30 + + # Targets are managed by aws_autoscaling_attachment below — + # do not let the module register static targets. + create_attachment = false + + health_check = { + enabled = true + healthy_threshold = 2 + unhealthy_threshold = 2 + interval = 10 + protocol = "HTTP" + port = "1042" + path = "/healthz" + success_codes = "200-299" + } + } + } + + listeners = { + tcp_80 = { + port = 80 + protocol = "TCP" + + forward = { + target_group_key = "http" + } + } + + tls_443 = { + port = 443 + protocol = "TLS" + certificate_arn = "arn:aws:acm:${var.aws_region}:${var.account_id}:certificate/e3edb543-521e-4592-a9aa-4b817dc2c2e9" + ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" + + forward = { + target_group_key = "http" + } + } + } +} + +resource "aws_autoscaling_attachment" "ingress_to_nlb" { + count = local.vars.nlb.create ? 1 : 0 + + autoscaling_group_name = module.eks_managed_node_group_ingress_controller.node_group_resources[0].autoscaling_groups[0].name + lb_target_group_arn = module.nlb.target_groups["http"].arn +} diff --git a/tofu/outputs.tofu b/tofu/outputs.tofu index bb5efd2..7b7258f 100644 --- a/tofu/outputs.tofu +++ b/tofu/outputs.tofu @@ -1,3 +1,13 @@ # output "eks" { # value = module.eks # } + +output "nlb_dns_name" { + description = "NLB DNS name — create a CNAME record pointing to this" + value = local.vars.nlb.create ? module.nlb.dns_name : null +} + +output "nlb_arn" { + description = "NLB ARN" + value = local.vars.nlb.create ? module.nlb.arn : null +} diff --git a/tofu/vars/vars.yaml b/tofu/vars/vars.yaml index 8b61f44..8c1c3cc 100644 --- a/tofu/vars/vars.yaml +++ b/tofu/vars/vars.yaml @@ -1,5 +1,6 @@ --- versions: + alb: v9.13.0 cloudfront: v6.7.0 ec2: v6.4.0 ecs: v7.5.0 @@ -22,7 +23,7 @@ ecs: efs: create: false eks: - create: true + create: false cluster_version: 1.36 sc: gp3: false @@ -41,6 +42,9 @@ eks: iam: github_oidc: repos: ["harik8/manalpetti:*","harik8/hariprasad.dev:*","harik8/awsing:*"] +nlb: + create: false + internal: false rds: psql: create: false @@ -50,5 +54,5 @@ vpc: create: true cidr: 10.100.0.0/16 nat_gateway: - enable: true + enable: false single: true