1+ locals {
2+ eks_worker_tags =
3+ " k8s.io/cluster-autoscaler/enabled" = " true"
4+ " k8s.io/cluster-autoscaler/${local.name}" = " owned"
5+ }
6+ }
7+
8+ data "aws_ami" "eks_default_bottlerocket" {
9+ most_recent = true
10+ owners = " amazon"
11+
12+ filter {
13+ name = " name"
14+ values = " bottlerocket-aws-k8s-${ var . eks_cluster_version } -x86_64-*"
15+ }
16+ }
17+
118# tfsec:ignore:aws-vpc-no-public-egress-sgr tfsec:ignore:aws-eks-enable-control-plane-logging tfsec:ignore:aws-eks-encrypt-secrets tfsec:ignore:aws-eks-no-public-cluster-access tfsec:ignore:aws-eks-no-public-cluster-access-to-cidr
219module "eks" {
320 source = " terraform-aws-modules/eks/aws"
@@ -72,108 +89,104 @@ module "eks" {
7289 }
7390 }
7491
75- eks_managed_node_group_defaults =
76- ami_type = " AL2_x86_64"
77- disk_size = 100
92+ self_managed_node_group_defaults =
93+ block_device_mappings = {
94+ xvda = {
95+ device_name = " /dev/xvda"
96+ ebs = {
97+ delete_on_termination = true
98+ encrypted = false
99+ volume_size = 100
100+ volume_type = " gp3"
101+ }
102+
103+ }
104+ }
78105 iam_role_additional_policies = var.eks_workers_additional_policies
106+ metadata_options = {
107+ http_endpoint = " enabled"
108+ http_tokens = " required"
109+ http_put_response_hop_limit = 1
110+ instance_metadata_tags = " disabled"
111+ }
79112 }
80113
81- eks_managed_node_groups =
114+ self_managed_node_groups =
82115 spot = {
83- name = " ${ local . name } -spot"
84- iam_role_name = " ${ local . name } -spot"
85- desired_size = var.node_group_spot.desired_capacity
86- max_size = var.node_group_spot.max_capacity
87- min_size = var.node_group_spot.min_capacity
88- instance_types = var.node_group_spot.instance_types
89- capacity_type = var.node_group_spot.capacity_type
90- subnet_ids = module.vpc.private_subnets
91-
92- force_update_version = var.node_group_spot.force_update_version
93-
94- labels = {
95- Environment = local.env
96- nodegroup = " spot"
97- }
98- tags = {
99- Name = " ${ local . name } -spot"
100- }
116+ name = " ${ local . name } -spot"
117+ iam_role_name = " ${ local . name } -spot"
118+ desired_size = var.node_group_spot.desired_capacity
119+ max_size = var.node_group_spot.max_capacity
120+ min_size = var.node_group_spot.min_capacity
121+ subnet_ids = module.vpc.private_subnets
122+
123+ bootstrap_extra_args = " --kubelet-extra-args '--node-labels=eks.amazonaws.com/capacityType=SPOT --node-labels=nodegroup=spot'"
124+ capacity_rebalance = var.node_group_spot.capacity_rebalance
125+ use_mixed_instances_policy = var.node_group_spot.use_mixed_instances_policy
126+ mixed_instances_policy = var.node_group_spot.mixed_instances_policy
127+
128+ tags = local.eks_worker_tags
101129 },
102130 ondemand = {
103- name = " ${ local . name } -ondemand"
104- iam_role_name = " ${ local . name } -ondemand"
105- desired_size = var.node_group_ondemand.desired_capacity
106- max_size = var.node_group_ondemand.max_capacity
107- min_size = var.node_group_ondemand.min_capacity
108- instance_types = var.node_group_ondemand.instance_types
109- capacity_type = var.node_group_ondemand.capacity_type
110- subnet_ids = module.vpc.private_subnets
111-
112- force_update_version = var.node_group_ondemand.force_update_version
113-
114- labels = {
115- Environment = local.env
116- nodegroup = " ondemand"
117- }
118- tags = {
119- Name = " ${ local . name } -ondemand"
120- }
131+ name = " ${ local . name } -ondemand"
132+ iam_role_name = " ${ local . name } -ondemand"
133+ desired_size = var.node_group_ondemand.desired_capacity
134+ max_size = var.node_group_ondemand.max_capacity
135+ min_size = var.node_group_ondemand.min_capacity
136+ instance_type = var.node_group_ondemand.instance_type
137+ subnet_ids = module.vpc.private_subnets
138+
139+ bootstrap_extra_args = " --kubelet-extra-args '--node-labels=eks.amazonaws.com/capacityType=ON_DEMAND --node-labels=nodegroup=ondemand'"
140+ capacity_rebalance = var.node_group_ondemand.capacity_rebalance
141+ use_mixed_instances_policy = var.node_group_ondemand.use_mixed_instances_policy
142+ mixed_instances_policy = var.node_group_ondemand.mixed_instances_policy
143+
144+ tags = local.eks_worker_tags
121145 },
122146 ci = {
123- name = " ${ local . name } -ci"
124- iam_role_name = " ${ local . name } -ci"
125- desired_size = var.node_group_ci.desired_capacity
126- max_size = var.node_group_ci.max_capacity
127- min_size = var.node_group_ci.min_capacity
128- instance_types = var.node_group_ci.instance_types
129- capacity_type = var.node_group_ci.capacity_type
130- subnet_ids = module.vpc.private_subnets
131-
132- force_update_version = var.node_group_ci.force_update_version
133-
134- labels = {
135- Environment = local.env
136- nodegroup = " ci"
137- }
138- tags = {
139- Name = " ${ local . name } -ci"
140- }
141- taints = [
142- {
143- key = " nodegroup"
144- value = " ci"
145- effect = " NO_SCHEDULE"
146- }
147- ]
147+ name = " ${ local . name } -ci"
148+ iam_role_name = " ${ local . name } -ci"
149+ desired_size = var.node_group_ci.desired_capacity
150+ max_size = var.node_group_ci.max_capacity
151+ min_size = var.node_group_ci.min_capacity
152+ subnet_ids = module.vpc.private_subnets
153+
154+ bootstrap_extra_args = " --kubelet-extra-args '--node-labels=eks.amazonaws.com/capacityType=SPOT --node-labels=nodegroup=ci --register-with-taints=nodegroup=ci:NoSchedule'"
155+ capacity_rebalance = var.node_group_ci.capacity_rebalance
156+ use_mixed_instances_policy = var.node_group_ci.use_mixed_instances_policy
157+ mixed_instances_policy = var.node_group_ci.mixed_instances_policy
158+
159+ tags = merge (local. eks_worker_tags , { " k8s.io/cluster-autoscaler/node-template/label/nodegroup" " ci"
148160 },
149161 bottlerocket = {
150- name = " ${ local . name } -bottlerocket"
151- iam_role_name = " ${ local . name } -bottlerocket"
152- desired_size = var.node_group_br.desired_capacity
153- max_size = var.node_group_br.max_capacity
154- min_size = var.node_group_br.min_capacity
155- instance_types = var.node_group_br.instance_types
156- capacity_type = var.node_group_br.capacity_type
157- subnet_ids = module.vpc.private_subnets
158-
159- ami_type = " BOTTLEROCKET_x86_64"
160-
161- force_update_version = var.node_group_br.force_update_version
162-
163- labels = {
164- Environment = local.env
165- nodegroup = " bottlerocket"
166- }
167- taints = [
168- {
169- key = " nodegroup"
170- value = " bottlerocket"
171- effect = " NO_SCHEDULE"
172- }
173- ]
174- tags = {
175- Name = " ${ local . name } -bottlerocket"
176- }
162+ name = " ${ local . name } -bottlerocket"
163+ iam_role_name = " ${ local . name } -bottlerocket"
164+ desired_size = var.node_group_br.desired_capacity
165+ max_size = var.node_group_br.max_capacity
166+ min_size = var.node_group_br.min_capacity
167+ subnet_ids = module.vpc.private_subnets
168+
169+ platform = " bottlerocket"
170+ ami_id = data.aws_ami.eks_default_bottlerocket.id
171+ bootstrap_extra_args = <<- EOT
172+ [settings.host-containers.admin]
173+ enabled = false
174+
175+ [settings.host-containers.control]
176+ enabled = true
177+
178+ [settings.kubernetes.node-labels]
179+ "eks.amazonaws.com/capacityType" = "SPOT"
180+ "nodegroup" = "bottlerocket"
181+
182+ [settings.kubernetes.node-taints]
183+ "nodegroup" = "bottlerocket:NoSchedule"
184+ EOT
185+ capacity_rebalance = var.node_group_br.capacity_rebalance
186+ use_mixed_instances_policy = var.node_group_br.use_mixed_instances_policy
187+ mixed_instances_policy = var.node_group_br.mixed_instances_policy
188+
189+ tags = merge (local. eks_worker_tags , { " k8s.io/cluster-autoscaler/node-template/label/nodegroup" " bottlerocket"
177190 }
178191 }
179192
@@ -194,4 +207,5 @@ module "eks" {
194207 })
195208 }
196209 }
210+
197211}
0 commit comments