diff --git a/docs/CONFIG-VARS.md b/docs/CONFIG-VARS.md index 68dd0b43..932002b0 100644 --- a/docs/CONFIG-VARS.md +++ b/docs/CONFIG-VARS.md @@ -188,12 +188,13 @@ Custom Policy: |
Name
|
Description
|
Type
|
Default
|
Notes
| | :--- | :--- | :--- | :--- | :--- | | create_static_kubeconfig | Allows the user to create a provider / service account based kube config file | bool | false | A value of `false` will default to using the cloud providers mechanism for generating the kubeconfig file. A value of `true` will create a static kubeconfig which utilizes a `Service Account` and `Cluster Role Binding` to provide credentials. | -| kubernetes_version | The EKS cluster K8S version | string | "1.18" | | +| kubernetes_version | The EKS cluster K8S version | string | "1.19" | | | create_jump_vm | Create bastion host | bool | true| | | create_jump_public_ip | Add public ip to jump VM | bool | true | | | jump_vm_admin | OS Admin User for the Jump VM | string | "jumpuser" | | | jump_rwx_filestore_path | File store mount point on Jump server | string | "/viya-share" | This location cannot include "/mnt" as it's root location. This disk is ephemeral on Ubuntu which is the operating system being used for the Jump/NFS servers. | | tags | Map of common tags to be placed on all AWS resources created by this script | map | { project_name = "viya" } | | +| autoscaling_enabled | Enable Cluster Autoscaling | bool | true | | ## Nodepools diff --git a/files/policies/devops-iac-eks-policy.json b/files/policies/devops-iac-eks-policy.json index 754efdd7..e6b7c78f 100644 --- a/files/policies/devops-iac-eks-policy.json +++ b/files/policies/devops-iac-eks-policy.json @@ -139,6 +139,7 @@ "iam:UntagRole", "iam:TagPolicy", "iam:TagInstanceProfile", + "iam:TagOpenIDConnectProvider", "iam:UpdateAssumeRolePolicy", "iam:UpdateAccessKey", "resource-groups:*", diff --git a/main.tf b/main.tf index 3f33f2c6..0d3d48dd 100644 --- a/main.tf +++ b/main.tf @@ -354,6 +354,7 @@ module "eks" { subnets = module.vpc.private_subnets vpc_id = module.vpc.vpc_id tags = var.tags + enable_irsa = var.autoscaling_enabled manage_worker_iam_resources = var.workers_iam_role_name == null ? true : false workers_role_name = var.workers_iam_role_name @@ -361,7 +362,7 @@ module "eks" { cluster_iam_role_name = var.cluster_iam_role_name workers_group_defaults = { - # tags = var.tags + tags = [ { key = "k8s.io/cluster-autoscaler/${local.cluster_name}", value = "owned", propagate_at_launch = true }, { key = "k8s.io/cluster-autoscaler/enabled", value = "true", propagate_at_launch = true} ] additional_security_group_ids = [local.security_group_id] metadata_http_tokens = "required" metadata_http_put_response_hop_limit = 1 @@ -374,6 +375,16 @@ module "eks" { worker_groups = local.worker_groups } +module "autoscaling" { + source = "./modules/aws_autoscaling" + count = var.autoscaling_enabled ? 1 : 0 + + prefix = var.prefix + cluster_name = local.cluster_name + tags = var.tags + oidc_url = module.eks.cluster_oidc_issuer_url +} + module "kubeconfig" { source = "./modules/kubeconfig" prefix = var.prefix diff --git a/modules/aws_autoscaling/main.tf b/modules/aws_autoscaling/main.tf new file mode 100644 index 00000000..be18d4e5 --- /dev/null +++ b/modules/aws_autoscaling/main.tf @@ -0,0 +1,65 @@ +data "aws_iam_policy_document" "worker_autoscaling" { + statement { + sid = "eksWorkerAutoscalingAll" + effect = "Allow" + + actions = [ + "autoscaling:DescribeAutoScalingGroups", + "autoscaling:DescribeAutoScalingInstances", + "autoscaling:DescribeLaunchConfigurations", + "autoscaling:DescribeTags", + "ec2:DescribeLaunchTemplateVersions", + ] + + resources = ["*"] + } + + statement { + sid = "eksWorkerAutoscalingOwn" + effect = "Allow" + + actions = [ + "autoscaling:SetDesiredCapacity", + "autoscaling:TerminateInstanceInAutoScalingGroup", + "autoscaling:UpdateAutoScalingGroup", + ] + + resources = ["*"] + + condition { + test = "StringEquals" + variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${var.cluster_name}" + values = ["owned"] + } + + condition { + test = "StringEquals" + variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled" + values = ["true"] + } + } +} + +resource "aws_iam_policy" "worker_autoscaling" { + name_prefix = "${var.prefix}-eks-worker-autoscaling" + description = "EKS worker node autoscaling policy for cluster ${var.cluster_name}" + policy = data.aws_iam_policy_document.worker_autoscaling.json + tags = var.tags +} + +module "iam_assumable_role_with_oidc" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc" + version = "4.1.0" + + create_role = true + role_name = "${var.prefix}-cluster-autoscaler" + provider_url = replace(var.oidc_url, "https://", "") + role_policy_arns = [aws_iam_policy.worker_autoscaling.arn] + oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:cluster-autoscaler"] + + tags = { + Role = "${var.prefix}-cluster-autoscaler" + } + +} + diff --git a/modules/aws_autoscaling/output.tf b/modules/aws_autoscaling/output.tf new file mode 100644 index 00000000..88ace2b9 --- /dev/null +++ b/modules/aws_autoscaling/output.tf @@ -0,0 +1,3 @@ +output "autoscaler_account" { + value = module.iam_assumable_role_with_oidc.iam_role_arn +} diff --git a/modules/aws_autoscaling/variables.tf b/modules/aws_autoscaling/variables.tf new file mode 100644 index 00000000..7f2444bd --- /dev/null +++ b/modules/aws_autoscaling/variables.tf @@ -0,0 +1,22 @@ +variable "prefix" { + description = "A prefix used for all AWS Cloud resources created by this script" + type = string + default = null +} + +variable "cluster_name" { + description = "Name of EKS cluster" + type = string + default = null +} + +variable "tags" { + description = "Tags used for autoscaling" + default = null +} + +variable "oidc_url" { + description = "OIDC URL of EKS cluster" + type = string + default = null +} diff --git a/outputs.tf b/outputs.tf index 187a70f3..6f63c3d4 100644 --- a/outputs.tf +++ b/outputs.tf @@ -121,3 +121,7 @@ output "cr_endpoint" { output "cluster_node_pool_mode" { value = var.cluster_node_pool_mode } + +output "autoscaler_account" { + value = var.autoscaling_enabled ? module.autoscaling.0.autoscaler_account : null +} diff --git a/variables.tf b/variables.tf index 91a118fb..bc2af2bf 100644 --- a/variables.tf +++ b/variables.tf @@ -493,4 +493,11 @@ variable "cluster_node_pool_mode" { description = "Flag for predefined cluster node configurations - Values : default, minimal" type = string default = "default" + +} + +variable "autoscaling_enabled" { + description = "Enable autoscaling for your AWS cluster." + type = bool + default = true }