AWS EKS Terraform module

Terraform module which creates Kubernetes cluster resources on AWS EKS.

Features

• Create an EKS cluster
• All node types are supported:
  • Managed Node Groups
  • Self-managed Nodes
  • Fargate
• Support AWS EKS Optimized or Custom AMI
• Create or manage security groups that allow communication and coordination

Important note

Kubernetes is evolving a lot, and each minor version includes new features, fixes, or changes.

Always check Kubernetes Release Notes before updating the major version, and CHANGELOG.md for all changes in this EKS module.

You also need to ensure that your applications and add ons are updated, or workloads could fail after the upgrade is complete. For action, you may need to take before upgrading, see the steps in the EKS documentation.

Usage example

data "aws_eks_cluster" "eks" {
  name = module.eks.cluster_id
}

data "aws_eks_cluster_auth" "eks" {
  name = module.eks.cluster_id
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.eks.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.eks.token
}

module "eks" {
  source          = "terraform-aws-modules/eks/aws"

  cluster_version = "1.21"
  cluster_name    = "my-cluster"
  vpc_id          = "vpc-1234556abcdef"
  subnets         = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]

  worker_groups = [
    {
      instance_type = "m4.large"
      asg_max_size  = 5
    }
  ]
}

There is also a complete example which shows large set of features available in the module.

Submodules

Root module calls these modules which can also be used separately to create independent resources:

• fargate - creates Fargate profiles, see examples/fargate for detailed examples.

Notes

• By default, this module manages the aws-auth configmap for you (manage_aws_auth=true). To avoid the following issue where the EKS creation is ACTIVE but not ready. We implemented a "retry" logic with a fork of the http provider. This fork adds the support of a self-signed CA certificate. The original PR can be found here.

• Setting instance_refresh_enabled = true will recreate your worker nodes without draining them first. It is recommended to install aws-node-termination-handler for proper node draining. Find the complete example here instance_refresh.

Documentation

Official docs

• Amazon Elastic Kubernetes Service (Amazon EKS).

Module docs

• Autoscaling: How to enable worker node autoscaling.
• Enable Docker Bridge Network: How to enable the docker bridge network when using the EKS-optimized AMI, which disables it by default.
• Spot instances: How to use spot instances with this module.
• IAM Permissions: Minimum IAM permissions needed to setup EKS Cluster.
• FAQ: Frequently Asked Questions

Examples

There are detailed examples available for you to see how certain features of this module can be used in a straightforward way. Make sure to check them and run them before opening an issue. Here you can find the list of the minimum IAM Permissions required to create EKS cluster.

• Complete - Create EKS Cluster with all available workers types in various combinations with many of supported features.
• Bottlerocket - Create EKS cluster using Bottlerocket AMI.
• Fargate - Create EKS cluster with Fargate profiles and attach Fargate profiles to an existing EKS cluster.

Contributing

Report issues/questions/feature requests on in the issues section.

Full contributing guidelines are covered here.

Authors

This module has been originally created by Brandon O'Connor, and was maintained by Max Williams, Thierno IB. BARRY and many more contributors listed here!

License

Apache 2 Licensed. See LICENSE for full details.

Requirements

Providers

Modules

Resources

Inputs

[
  "0.0.0.0/0"
]

list(object({
    provider_key_arn = string
    resources        = list(string)
  }))

[
  "0.0.0.0/0"
]

list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))

list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))

[
  "0.0.0.0/0"
]

Outputs