├── test ├── .gitignore ├── src │ ├── .gitignore │ ├── Makefile │ ├── go.mod │ └── examples_complete_test.go ├── Makefile.alpine └── Makefile ├── .github ├── ISSUE_TEMPLATE │ ├── question.md │ ├── config.yml │ ├── bug_report.md │ ├── feature_request.md │ ├── bug_report.yml │ └── feature_request.yml ├── mergify.yml ├── banner.png ├── workflows │ ├── release.yml │ ├── scheduled.yml │ ├── chatops.yml │ └── branch.yml ├── renovate.json ├── settings.yml ├── PULL_REQUEST_TEMPLATE.md └── CODEOWNERS ├── versions.tf ├── examples └── complete │ ├── versions.tf │ ├── fixtures.us-east-2.tfvars │ ├── outputs.tf │ ├── variables.tf │ ├── main.tf │ └── context.tf ├── .gitignore ├── atmos.yaml ├── outputs.tf ├── variables.tf ├── main.tf ├── context.tf ├── LICENSE ├── README.yaml └── README.md /test/.gitignore: -------------------------------------------------------------------------------- 1 | .test-harness 2 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/question.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.github/mergify.yml: -------------------------------------------------------------------------------- 1 | extends: .github 2 | -------------------------------------------------------------------------------- /test/src/.gitignore: -------------------------------------------------------------------------------- 1 | .gopath 2 | vendor/ 3 | -------------------------------------------------------------------------------- /.github/banner.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-eks-fargate-profile/HEAD/.github/banner.png -------------------------------------------------------------------------------- /test/Makefile.alpine: -------------------------------------------------------------------------------- 1 | ifneq (,$(wildcard /sbin/apk)) 2 | ## Install all dependencies for alpine 3 | deps:: init 4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse 5 | endif 6 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 5.0.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 3.71.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Local .terraform directories 2 | **/.terraform/* 3 | **/.terraform 4 | **/.terraform.lock.hcl 5 | 6 | # .tfstate files 7 | *.tfstate 8 | *.tfstate.* 9 | 10 | **/.idea 11 | **/*.iml 12 | 13 | **/.build-harness 14 | **/build-harness 15 | 16 | # vim editor 17 | *.swp 18 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: release 3 | on: 4 | release: 5 | types: 6 | - published 7 | 8 | permissions: 9 | id-token: write 10 | contents: write 11 | pull-requests: write 12 | 13 | jobs: 14 | terraform-module: 15 | uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/renovate.json: -------------------------------------------------------------------------------- 1 | { 2 | "extends": [ 3 | "config:base", 4 | ":preserveSemverRanges", 5 | ":rebaseStalePrs" 6 | ], 7 | "baseBranches": ["main"], 8 | "labels": ["auto-update"], 9 | "dependencyDashboardAutoclose": true, 10 | "enabledManagers": ["terraform"], 11 | "terraform": { 12 | "ignorePaths": ["**/context.tf"] 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /.github/settings.yml: -------------------------------------------------------------------------------- 1 | # Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. 2 | _extends: .github 3 | repository: 4 | name: terraform-aws-eks-fargate-profile 5 | description: Terraform module to provision an EKS Fargate Profile 6 | homepage: https://cloudposse.com/accelerate 7 | topics: "" 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.github/workflows/scheduled.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: scheduled 3 | on: 4 | workflow_dispatch: { } # Allows manually trigger this workflow 5 | schedule: 6 | - cron: "0 3 * * *" 7 | 8 | permissions: 9 | pull-requests: write 10 | id-token: write 11 | contents: write 12 | 13 | jobs: 14 | scheduled: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-scheduled.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/workflows/chatops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: chatops 3 | on: 4 | issue_comment: 5 | types: [created] 6 | 7 | permissions: 8 | pull-requests: write 9 | id-token: write 10 | contents: write 11 | statuses: write 12 | 13 | jobs: 14 | test: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-chatops.yml@main 16 | if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/terratest') }} 17 | secrets: inherit 18 | -------------------------------------------------------------------------------- /atmos.yaml: -------------------------------------------------------------------------------- 1 | # Atmos Configuration — powered by https://atmos.tools 2 | # 3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos. 4 | # 5 | # Included features: 6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands 7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate 8 | # 9 | 10 | # Import shared configuration used by all modules 11 | import: 12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml 13 | -------------------------------------------------------------------------------- /.github/workflows/branch.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Branch 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - release/** 8 | types: [opened, synchronize, reopened, labeled, unlabeled] 9 | push: 10 | branches: 11 | - main 12 | - release/v* 13 | paths-ignore: 14 | - '.github/**' 15 | - 'docs/**' 16 | - 'examples/**' 17 | - 'test/**' 18 | - 'README.md' 19 | 20 | permissions: {} 21 | 22 | jobs: 23 | terraform-module: 24 | uses: cloudposse/.github/.github/workflows/shared-terraform-module.yml@main 25 | secrets: inherit 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | 3 | contact_links: 4 | 5 | - name: Community Slack Team 6 | url: https://cloudposse.com/slack/ 7 | about: |- 8 | Please ask and answer questions here. 9 | 10 | - name: Office Hours 11 | url: https://cloudposse.com/office-hours/ 12 | about: |- 13 | Join us every Wednesday for FREE Office Hours (lunch & learn). 14 | 15 | - name: DevOps Accelerator Program 16 | url: https://cloudposse.com/accelerate/ 17 | about: |- 18 | Own your infrastructure in record time. We build it. You drive it. 19 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## what 2 | 3 | 7 | 8 | ## why 9 | 10 | 15 | 16 | ## references 17 | 18 | 22 | -------------------------------------------------------------------------------- /test/src/Makefile: -------------------------------------------------------------------------------- 1 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1) 2 | 3 | .DEFAULT_GOAL : all 4 | 5 | .PHONY: all 6 | ## Default target 7 | all: test 8 | 9 | .PHONY : init 10 | ## Initialize tests 11 | init: 12 | @exit 0 13 | 14 | .PHONY : test 15 | ## Run tests 16 | test: init 17 | go mod download 18 | go test -v -timeout 60m 19 | 20 | ## Run tests in docker container 21 | docker/test: 22 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \ 23 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ 24 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test 25 | 26 | .PHONY : clean 27 | ## Clean up files 28 | clean: 29 | rm -rf $(TF_DATA_DIR) 30 | -------------------------------------------------------------------------------- /examples/complete/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | region = "us-east-2" 2 | 3 | availability_zones = ["us-east-2a", "us-east-2b"] 4 | 5 | vpc_cidr_block = "172.16.0.0/16" 6 | 7 | namespace = "eg" 8 | 9 | stage = "test" 10 | 11 | name = "eks-fargate" 12 | 13 | instance_types = ["t3.small"] 14 | 15 | desired_size = 2 16 | 17 | max_size = 3 18 | 19 | min_size = 2 20 | 21 | disk_size = 20 22 | 23 | kubernetes_namespace = "default" 24 | 25 | kubernetes_labels = {} 26 | 27 | kubernetes_version = "1.31" 28 | 29 | oidc_provider_enabled = true 30 | 31 | enabled_cluster_log_types = ["audit"] 32 | 33 | cluster_log_retention_period = 7 34 | 35 | before_cluster_joining_userdata = <<-EOT 36 | printf "\n\n###\nExample output from before_cluster_joining_userdata\n###\n\n" 37 | EOT 38 | 39 | update_config = [{ max_unavailable = 2 }] 40 | 41 | kubernetes_taints = [ 42 | { 43 | key = "test" 44 | value = null 45 | effect = "PREFER_NO_SCHEDULE" 46 | }] 47 | 48 | iam_role_kubernetes_namespace_delimiter = "@" 49 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: 'bug' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Found a bug? Maybe our [Slack Community](https://slack.cloudposse.com) can help. 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Bug 15 | A clear and concise description of what the bug is. 16 | 17 | ## Expected Behavior 18 | A clear and concise description of what you expected to happen. 19 | 20 | ## Steps to Reproduce 21 | Steps to reproduce the behavior: 22 | 1. Go to '...' 23 | 2. Run '....' 24 | 3. Enter '....' 25 | 4. See error 26 | 27 | ## Screenshots 28 | If applicable, add screenshots or logs to help explain your problem. 29 | 30 | ## Environment (please complete the following information): 31 | 32 | Anything that will help us triage the bug will help. Here are some ideas: 33 | - OS: [e.g. Linux, OSX, WSL, etc] 34 | - Version [e.g. 10.15] 35 | 36 | ## Additional Context 37 | Add any other context about the problem here. -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: 'feature request' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) or visit our [Slack Archive](https://archive.sweetops.com/). 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Feature 15 | 16 | A clear and concise description of what the bug is. 17 | 18 | ## Expected Behavior 19 | 20 | A clear and concise description of what you expected to happen. 21 | 22 | ## Use Case 23 | 24 | Is your feature request related to a problem/challenge you are trying to solve? Please provide some additional context of why this feature or capability will be valuable. 25 | 26 | ## Describe Ideal Solution 27 | 28 | A clear and concise description of what you want to happen. If you don't know, that's okay. 29 | 30 | ## Alternatives Considered 31 | 32 | Explain what alternative solutions or features you've considered. 33 | 34 | ## Additional Context 35 | 36 | Add any other context or screenshots about the feature request here. 37 | -------------------------------------------------------------------------------- /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Use this file to define individuals or teams that are responsible for code in a repository. 2 | # Read more: 3 | # 4 | # Order is important: the last matching pattern has the highest precedence 5 | 6 | # These owners will be the default owners for everything 7 | * @cloudposse/engineering @cloudposse/contributors 8 | 9 | # Cloud Posse must review any changes to Makefiles 10 | **/Makefile @cloudposse/engineering 11 | **/Makefile.* @cloudposse/engineering 12 | 13 | # Cloud Posse must review any changes to GitHub actions 14 | .github/* @cloudposse/engineering 15 | 16 | # Cloud Posse must review any changes to standard context definition, 17 | # but some changes can be rubber-stamped. 18 | **/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 19 | README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 20 | README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 21 | docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 22 | 23 | # Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration 24 | .github/mergify.yml @cloudposse/admins 25 | .github/CODEOWNERS @cloudposse/admins 26 | -------------------------------------------------------------------------------- /test/Makefile: -------------------------------------------------------------------------------- 1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git 2 | TEST_HARNESS_BRANCH ?= master 3 | TEST_HARNESS_PATH = $(realpath .test-harness) 4 | BATS_ARGS ?= --tap 5 | BATS_LOG ?= test.log 6 | 7 | # Define a macro to run the tests 8 | define RUN_TESTS 9 | @echo "Running tests in $(1)" 10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS))) 11 | endef 12 | 13 | default: all 14 | 15 | -include Makefile.* 16 | 17 | ## Provision the test-harnesss 18 | .test-harness: 19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@ 20 | 21 | ## Initialize the tests 22 | init: .test-harness 23 | 24 | ## Install all dependencies (OS specific) 25 | deps:: 26 | @exit 0 27 | 28 | ## Clean up the test harness 29 | clean: 30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH) 31 | 32 | ## Run all tests 33 | all: module examples/complete 34 | 35 | ## Run basic sanity checks against the module itself 36 | module: export TESTS ?= installed lint module-pinning provider-pinning validate terraform-docs input-descriptions output-descriptions 37 | module: deps 38 | $(call RUN_TESTS, ../) 39 | 40 | ## Run tests against example 41 | examples/complete: export TESTS ?= installed lint validate 42 | examples/complete: deps 43 | $(call RUN_TESTS, ../$@) 44 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | output "eks_fargate_profile_role_arn" { 2 | description = "DEPRECATED (use `eks_fargate_pod_execution_role_arn` instead): ARN of the EKS Fargate Profile IAM role" 3 | value = local.fargate_pod_execution_role_enabled ? one(aws_iam_role.default[*].arn) : var.fargate_pod_execution_role_arn 4 | } 5 | 6 | output "eks_fargate_pod_execution_role_arn" { 7 | description = "ARN of the EKS Fargate Pod Execution role" 8 | value = local.fargate_pod_execution_role_enabled ? one(aws_iam_role.default[*].arn) : var.fargate_pod_execution_role_arn 9 | } 10 | 11 | output "eks_fargate_profile_role_name" { 12 | description = "DEPRECATED (use `eks_fargate_pod_execution_role_name` instead): Name of the EKS Fargate Profile IAM role" 13 | value = local.fargate_pod_execution_role_enabled ? one(aws_iam_role.default[*].name) : ( 14 | local.enabled ? one(regex(".*:role/(.+)$", var.fargate_pod_execution_role_arn)[*]) : null 15 | ) 16 | } 17 | 18 | output "eks_fargate_pod_execution_role_name" { 19 | description = "Name of the EKS Fargate Pod Execution role" 20 | value = local.fargate_pod_execution_role_enabled ? one(aws_iam_role.default[*].name) : ( 21 | local.enabled ? one(regex(".*:role/(.+)$", var.fargate_pod_execution_role_arn)[*]) : null 22 | ) 23 | } 24 | 25 | output "eks_fargate_profile_id" { 26 | description = "EKS Cluster name and EKS Fargate Profile name separated by a colon" 27 | value = one(aws_eks_fargate_profile.default[*].id) 28 | } 29 | 30 | output "eks_fargate_profile_arn" { 31 | description = "Amazon Resource Name (ARN) of the EKS Fargate Profile" 32 | value = one(aws_eks_fargate_profile.default[*].arn) 33 | } 34 | 35 | output "eks_fargate_profile_status" { 36 | description = "Status of the EKS Fargate Profile" 37 | value = one(aws_eks_fargate_profile.default[*].status) 38 | } 39 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | description: Create a report to help us improve 4 | labels: ["bug"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Found a bug? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Bug 21 | description: A clear and concise description of what the bug is. 22 | placeholder: What is the bug about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: reproduction-steps 37 | attributes: 38 | label: Steps to Reproduce 39 | description: Steps to reproduce the behavior. 40 | placeholder: How do we reproduce it? 41 | validations: 42 | required: true 43 | 44 | - type: textarea 45 | id: screenshots 46 | attributes: 47 | label: Screenshots 48 | description: If applicable, add screenshots or logs to help explain. 49 | validations: 50 | required: false 51 | 52 | - type: textarea 53 | id: environment 54 | attributes: 55 | label: Environment 56 | description: Anything that will help us triage the bug. 57 | placeholder: | 58 | - OS: [e.g. Linux, OSX, WSL, etc] 59 | - Version [e.g. 10.15] 60 | - Module version 61 | - Terraform version 62 | validations: 63 | required: false 64 | 65 | - type: textarea 66 | id: additional 67 | attributes: 68 | label: Additional Context 69 | description: | 70 | Add any other context about the problem here. 71 | validations: 72 | required: false 73 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | description: Suggest an idea for this project 4 | labels: ["feature request"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Have a question? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Feature 21 | description: A clear and concise description of what the feature is. 22 | placeholder: What is the feature about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: use-case 37 | attributes: 38 | label: Use Case 39 | description: | 40 | Is your feature request related to a problem/challenge you are trying 41 | to solve? 42 | 43 | Please provide some additional context of why this feature or 44 | capability will be valuable. 45 | validations: 46 | required: true 47 | 48 | - type: textarea 49 | id: ideal-solution 50 | attributes: 51 | label: Describe Ideal Solution 52 | description: A clear and concise description of what you want to happen. 53 | validations: 54 | required: true 55 | 56 | - type: textarea 57 | id: alternatives-considered 58 | attributes: 59 | label: Alternatives Considered 60 | description: Explain alternative solutions or features considered. 61 | validations: 62 | required: false 63 | 64 | - type: textarea 65 | id: additional 66 | attributes: 67 | label: Additional Context 68 | description: | 69 | Add any other context about the problem here. 70 | validations: 71 | required: false 72 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "cluster_name" { 2 | type = string 3 | description = "The name of the EKS cluster" 4 | default = "" 5 | } 6 | 7 | variable "subnet_ids" { 8 | type = list(string) 9 | description = "Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: kubernetes.io/cluster/CLUSTER_NAME (where CLUSTER_NAME is replaced with the name of the EKS Cluster)" 10 | default = [] 11 | } 12 | 13 | variable "kubernetes_namespace" { 14 | type = string 15 | description = "Kubernetes namespace for selection" 16 | default = "" 17 | } 18 | 19 | variable "kubernetes_labels" { 20 | type = map(string) 21 | description = "Key-value mapping of Kubernetes labels for selection" 22 | default = {} 23 | } 24 | 25 | variable "iam_role_kubernetes_namespace_delimiter" { 26 | type = string 27 | description = "Delimiter for the Kubernetes namespace in the IAM Role name" 28 | default = "-" 29 | } 30 | 31 | variable "permissions_boundary" { 32 | type = string 33 | description = "If provided, all IAM roles will be created with this permissions boundary attached" 34 | default = null 35 | } 36 | 37 | variable "fargate_profile_name" { 38 | type = string 39 | description = "Fargate profile name. If not provided, will be derived from the context" 40 | default = null 41 | } 42 | 43 | variable "fargate_profile_iam_role_name" { 44 | type = string 45 | description = "DEPRECATED (use `fargate_pod_execution_role_name` instead): Fargate profile IAM role name. If not provided, will be derived from the context" 46 | default = null 47 | } 48 | 49 | variable "fargate_pod_execution_role_name" { 50 | type = string 51 | description = "Fargate Pod Execution Role name. If not provided, will be derived from the context" 52 | default = null 53 | } 54 | 55 | variable "fargate_profile_enabled" { 56 | type = bool 57 | description = "Set false to disable the Fargate Profile creation" 58 | default = true 59 | } 60 | 61 | variable "fargate_pod_execution_role_enabled" { 62 | type = bool 63 | description = "Set false to disable the Fargate Pod Execution Role creation" 64 | default = true 65 | } 66 | 67 | variable "fargate_pod_execution_role_arn" { 68 | type = string 69 | description = "ARN of the Fargate Pod Execution Role. Required if `fargate_pod_execution_role_enabled` is `false`, otherwise ignored." 70 | default = null 71 | } 72 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "Public subnet CIDRs" 4 | } 5 | 6 | output "private_subnet_cidrs" { 7 | value = module.subnets.private_subnet_cidrs 8 | description = "Private subnet CIDRs" 9 | } 10 | 11 | output "vpc_cidr" { 12 | value = module.vpc.vpc_cidr_block 13 | description = "VPC ID" 14 | } 15 | 16 | output "eks_cluster_id" { 17 | description = "The name of the EKS cluster" 18 | value = module.eks_cluster.eks_cluster_id 19 | } 20 | 21 | output "eks_cluster_arn" { 22 | description = "The Amazon Resource Name (ARN) of the EKS cluster" 23 | value = module.eks_cluster.eks_cluster_arn 24 | } 25 | 26 | output "eks_cluster_endpoint" { 27 | description = "The endpoint for the Kubernetes API server" 28 | value = module.eks_cluster.eks_cluster_endpoint 29 | } 30 | 31 | output "eks_cluster_version" { 32 | description = "The Kubernetes server version of the cluster" 33 | value = module.eks_cluster.eks_cluster_version 34 | } 35 | 36 | output "eks_cluster_identity_oidc_issuer" { 37 | description = "The OIDC Identity issuer for the cluster" 38 | value = module.eks_cluster.eks_cluster_identity_oidc_issuer 39 | } 40 | 41 | output "eks_node_group_role_arn" { 42 | description = "ARN of the worker nodes IAM role" 43 | value = module.eks_node_group.eks_node_group_role_arn 44 | } 45 | 46 | output "eks_node_group_role_name" { 47 | description = "Name of the worker nodes IAM role" 48 | value = module.eks_node_group.eks_node_group_role_name 49 | } 50 | 51 | output "eks_node_group_id" { 52 | description = "EKS Cluster name and EKS Node Group name separated by a colon" 53 | value = module.eks_node_group.eks_node_group_id 54 | } 55 | 56 | output "eks_node_group_arn" { 57 | description = "Amazon Resource Name (ARN) of the EKS Node Group" 58 | value = module.eks_node_group.eks_node_group_arn 59 | } 60 | 61 | output "eks_node_group_resources" { 62 | description = "List of objects containing information about underlying resources of the EKS Node Group" 63 | value = module.eks_node_group.eks_node_group_resources 64 | } 65 | 66 | output "eks_node_group_status" { 67 | description = "Status of the EKS Node Group" 68 | value = module.eks_node_group.eks_node_group_status 69 | } 70 | 71 | output "eks_fargate_profile_role_arn" { 72 | description = "ARN of the EKS Fargate Profile IAM role" 73 | value = module.eks_fargate_profile.eks_fargate_profile_role_arn 74 | } 75 | 76 | output "eks_fargate_profile_role_name" { 77 | description = "Name of the EKS Fargate Profile IAM role" 78 | value = module.eks_fargate_profile.eks_fargate_profile_role_name 79 | } 80 | 81 | output "eks_fargate_profile_id" { 82 | description = "EKS Cluster name and EKS Fargate Profile name separated by a colon" 83 | value = module.eks_fargate_profile.eks_fargate_profile_id 84 | } 85 | 86 | output "eks_fargate_profile_arn" { 87 | description = "Amazon Resource Name (ARN) of the EKS Fargate Profile" 88 | value = module.eks_fargate_profile.eks_fargate_profile_arn 89 | } 90 | 91 | output "eks_fargate_profile_status" { 92 | description = "Status of the EKS Fargate Profile" 93 | value = module.eks_fargate_profile.eks_fargate_profile_status 94 | } 95 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | enabled = module.this.enabled 3 | fargate_profile_enabled = var.fargate_profile_enabled && local.enabled 4 | fargate_pod_execution_role_enabled = var.fargate_pod_execution_role_enabled && local.enabled 5 | 6 | tags = try(length(var.cluster_name), 0) == 0 ? module.this.tags : merge( 7 | module.this.tags, 8 | { 9 | "kubernetes.io/cluster/${var.cluster_name}" = "owned" 10 | } 11 | ) 12 | 13 | fargate_pod_execution_role_name = var.fargate_pod_execution_role_name != null ? var.fargate_pod_execution_role_name : var.fargate_profile_iam_role_name 14 | 15 | fargate_profile_name = var.fargate_profile_name != null ? var.fargate_profile_name : module.fargate_profile_label.id 16 | 17 | fargate_profile_iam_role_name = local.fargate_pod_execution_role_name != null ? local.fargate_pod_execution_role_name : ( 18 | local.fargate_profile_enabled ? "${module.role_label.id}${var.iam_role_kubernetes_namespace_delimiter}${var.kubernetes_namespace}" : 19 | module.role_label.id) 20 | } 21 | 22 | module "fargate_profile_label" { 23 | source = "cloudposse/label/null" 24 | version = "0.25.0" 25 | 26 | enabled = local.fargate_profile_enabled 27 | # Append the provided Kubernetes namespace to the Fargate Profile name 28 | attributes = [var.kubernetes_namespace] 29 | id_length_limit = 62 30 | 31 | tags = local.tags 32 | 33 | context = module.this.context 34 | } 35 | 36 | module "role_label" { 37 | source = "cloudposse/label/null" 38 | version = "0.25.0" 39 | 40 | enabled = local.fargate_pod_execution_role_enabled 41 | # Append 'fargate' to the Fargate Role name to specify that the role is for Fargate 42 | attributes = ["fargate"] 43 | id_length_limit = 64 44 | 45 | tags = local.tags 46 | 47 | context = module.this.context 48 | } 49 | 50 | data "aws_partition" "current" { 51 | count = local.enabled ? 1 : 0 52 | } 53 | 54 | data "aws_iam_policy_document" "assume_role" { 55 | count = local.fargate_pod_execution_role_enabled ? 1 : 0 56 | 57 | statement { 58 | effect = "Allow" 59 | actions = ["sts:AssumeRole"] 60 | 61 | principals { 62 | type = "Service" 63 | identifiers = ["eks-fargate-pods.amazonaws.com"] 64 | } 65 | } 66 | } 67 | 68 | resource "aws_iam_role" "default" { 69 | count = local.fargate_pod_execution_role_enabled ? 1 : 0 70 | 71 | name = local.fargate_profile_iam_role_name 72 | assume_role_policy = one(data.aws_iam_policy_document.assume_role[*].json) 73 | tags = module.role_label.tags 74 | permissions_boundary = var.permissions_boundary 75 | } 76 | 77 | resource "aws_iam_role_policy_attachment" "amazon_eks_fargate_pod_execution_role_policy" { 78 | count = local.fargate_pod_execution_role_enabled ? 1 : 0 79 | 80 | policy_arn = "arn:${one(data.aws_partition.current[*].partition)}:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy" 81 | role = one(aws_iam_role.default[*].name) 82 | } 83 | 84 | resource "aws_eks_fargate_profile" "default" { 85 | count = local.fargate_profile_enabled ? 1 : 0 86 | 87 | cluster_name = var.cluster_name 88 | fargate_profile_name = local.fargate_profile_name 89 | pod_execution_role_arn = var.fargate_pod_execution_role_enabled ? one(aws_iam_role.default[*].arn) : var.fargate_pod_execution_role_arn 90 | subnet_ids = var.subnet_ids 91 | tags = module.fargate_profile_label.tags 92 | 93 | selector { 94 | namespace = var.kubernetes_namespace 95 | labels = var.kubernetes_labels 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /test/src/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/cloudposse/terraform-aws-eks-fargate-profile 2 | 3 | go 1.24 4 | 5 | toolchain go1.24.0 6 | 7 | require ( 8 | github.com/aws/aws-sdk-go v1.44.213 9 | github.com/gruntwork-io/terratest v0.41.23 10 | github.com/stretchr/testify v1.8.2 11 | k8s.io/api v0.26.1 12 | k8s.io/apimachinery v0.26.1 13 | k8s.io/client-go v0.26.1 14 | sigs.k8s.io/aws-iam-authenticator v0.6.10 15 | ) 16 | 17 | require ( 18 | cloud.google.com/go v0.105.0 // indirect 19 | cloud.google.com/go/compute v1.12.1 // indirect 20 | cloud.google.com/go/compute/metadata v0.2.1 // indirect 21 | cloud.google.com/go/iam v0.7.0 // indirect 22 | cloud.google.com/go/storage v1.27.0 // indirect 23 | github.com/agext/levenshtein v1.2.3 // indirect 24 | github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect 25 | github.com/beorn7/perks v1.0.1 // indirect 26 | github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect 27 | github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect 28 | github.com/cespare/xxhash/v2 v2.1.2 // indirect 29 | github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect 30 | github.com/davecgh/go-spew v1.1.1 // indirect 31 | github.com/emicklei/go-restful/v3 v3.9.0 // indirect 32 | github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 // indirect 33 | github.com/go-logr/logr v1.2.3 // indirect 34 | github.com/go-openapi/jsonpointer v0.19.5 // indirect 35 | github.com/go-openapi/jsonreference v0.20.0 // indirect 36 | github.com/go-openapi/swag v0.19.14 // indirect 37 | github.com/go-sql-driver/mysql v1.5.0 // indirect 38 | github.com/gofrs/flock v0.8.1 // indirect 39 | github.com/gogo/protobuf v1.3.2 // indirect 40 | github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect 41 | github.com/golang/protobuf v1.5.2 // indirect 42 | github.com/google/gnostic v0.5.7-v3refs // indirect 43 | github.com/google/go-cmp v0.5.9 // indirect 44 | github.com/google/gofuzz v1.1.0 // indirect 45 | github.com/google/uuid v1.3.0 // indirect 46 | github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect 47 | github.com/googleapis/gax-go/v2 v2.7.0 // indirect 48 | github.com/gruntwork-io/go-commons v0.8.0 // indirect 49 | github.com/hashicorp/errwrap v1.0.0 // indirect 50 | github.com/hashicorp/go-cleanhttp v0.5.2 // indirect 51 | github.com/hashicorp/go-getter v1.7.1 // indirect 52 | github.com/hashicorp/go-multierror v1.1.0 // indirect 53 | github.com/hashicorp/go-safetemp v1.0.0 // indirect 54 | github.com/hashicorp/go-version v1.6.0 // indirect 55 | github.com/hashicorp/hcl/v2 v2.9.1 // indirect 56 | github.com/hashicorp/terraform-json v0.13.0 // indirect 57 | github.com/imdario/mergo v0.3.11 // indirect 58 | github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a // indirect 59 | github.com/jmespath/go-jmespath v0.4.0 // indirect 60 | github.com/josharian/intern v1.0.0 // indirect 61 | github.com/json-iterator/go v1.1.12 // indirect 62 | github.com/klauspost/compress v1.15.11 // indirect 63 | github.com/mailru/easyjson v0.7.6 // indirect 64 | github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect 65 | github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect 66 | github.com/mitchellh/go-homedir v1.1.0 // indirect 67 | github.com/mitchellh/go-testing-interface v1.14.1 // indirect 68 | github.com/mitchellh/go-wordwrap v1.0.1 // indirect 69 | github.com/moby/spdystream v0.2.0 // indirect 70 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect 71 | github.com/modern-go/reflect2 v1.0.2 // indirect 72 | github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect 73 | github.com/pmezard/go-difflib v1.0.0 // indirect 74 | github.com/pquerna/otp v1.2.0 // indirect 75 | github.com/prometheus/client_golang v1.14.0 // indirect 76 | github.com/prometheus/client_model v0.3.0 // indirect 77 | github.com/prometheus/common v0.37.0 // indirect 78 | github.com/prometheus/procfs v0.8.0 // indirect 79 | github.com/russross/blackfriday/v2 v2.1.0 // indirect 80 | github.com/sirupsen/logrus v1.8.1 // indirect 81 | github.com/spf13/pflag v1.0.5 // indirect 82 | github.com/tmccombs/hcl2json v0.3.3 // indirect 83 | github.com/ulikunitz/xz v0.5.10 // indirect 84 | github.com/urfave/cli v1.22.2 // indirect 85 | github.com/zclconf/go-cty v1.9.1 // indirect 86 | go.opencensus.io v0.24.0 // indirect 87 | golang.org/x/crypto v0.1.0 // indirect 88 | golang.org/x/net v0.7.0 // indirect 89 | golang.org/x/oauth2 v0.1.0 // indirect 90 | golang.org/x/sys v0.5.0 // indirect 91 | golang.org/x/term v0.5.0 // indirect 92 | golang.org/x/text v0.7.0 // indirect 93 | golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect 94 | golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect 95 | google.golang.org/api v0.103.0 // indirect 96 | google.golang.org/appengine v1.6.7 // indirect 97 | google.golang.org/genproto v0.0.0-20221201164419-0e50fba7f41c // indirect 98 | google.golang.org/grpc v1.51.0 // indirect 99 | google.golang.org/protobuf v1.28.1 // indirect 100 | gopkg.in/inf.v0 v0.9.1 // indirect 101 | gopkg.in/yaml.v2 v2.4.0 // indirect 102 | gopkg.in/yaml.v3 v3.0.1 // indirect 103 | k8s.io/klog/v2 v2.80.1 // indirect 104 | k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect 105 | k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect 106 | sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect 107 | sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect 108 | sigs.k8s.io/yaml v1.3.0 // indirect 109 | ) 110 | -------------------------------------------------------------------------------- /examples/complete/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS Region" 4 | } 5 | 6 | variable "availability_zones" { 7 | type = list(string) 8 | description = "List of availability zones" 9 | } 10 | 11 | variable "vpc_cidr_block" { 12 | type = string 13 | description = "VPC CIDR block" 14 | } 15 | 16 | variable "kubernetes_version" { 17 | type = string 18 | description = "Desired Kubernetes master version. If you do not specify a value, the latest available version is used" 19 | default = null 20 | } 21 | 22 | variable "oidc_provider_enabled" { 23 | type = bool 24 | description = "Create an IAM OIDC identity provider for the cluster, then you can create IAM roles to associate with a service account in the cluster, instead of using kiam or kube2iam. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html" 25 | default = false 26 | } 27 | 28 | variable "kubernetes_namespace" { 29 | type = string 30 | description = "Kubernetes namespace for selection" 31 | } 32 | 33 | variable "kubernetes_labels" { 34 | type = map(string) 35 | description = "Key-value mapping of Kubernetes labels for selection" 36 | } 37 | 38 | variable "desired_size" { 39 | type = number 40 | description = "Desired number of worker nodes" 41 | } 42 | 43 | variable "max_size" { 44 | type = number 45 | description = "The maximum size of the AutoScaling Group" 46 | } 47 | 48 | variable "min_size" { 49 | type = number 50 | description = "The minimum size of the AutoScaling Group" 51 | } 52 | 53 | variable "disk_size" { 54 | type = number 55 | description = "Disk size in GiB for worker nodes. Defaults to 20. Terraform will only perform drift detection if a configuration value is provided" 56 | } 57 | 58 | variable "instance_types" { 59 | type = list(string) 60 | description = "Set of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"]. Terraform will only perform drift detection if a configuration value is provided" 61 | } 62 | 63 | variable "iam_role_kubernetes_namespace_delimiter" { 64 | type = string 65 | description = "Delimiter for the Kubernetes namespace in the IAM Role name" 66 | } 67 | 68 | variable "local_exec_interpreter" { 69 | type = list(string) 70 | description = "shell to use for local_exec" 71 | default = ["/bin/sh", "-c"] 72 | } 73 | 74 | variable "enabled_cluster_log_types" { 75 | type = list(string) 76 | description = "A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`]" 77 | default = [] 78 | } 79 | 80 | variable "cluster_log_retention_period" { 81 | type = number 82 | description = "Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html" 83 | default = 0 84 | } 85 | 86 | variable "kubernetes_taints" { 87 | type = list(object({ 88 | key = string 89 | value = string 90 | effect = string 91 | })) 92 | description = <<-EOT 93 | List of `key`, `value`, `effect` objects representing Kubernetes taints. 94 | `effect` must be one of `NO_SCHEDULE`, `NO_EXECUTE`, or `PREFER_NO_SCHEDULE`. 95 | `key` and `effect` are required, `value` may be null. 96 | EOT 97 | default = [] 98 | } 99 | 100 | variable "ec2_ssh_key_name" { 101 | type = list(string) 102 | description = "SSH key pair name to use to access the worker nodes" 103 | validation { 104 | condition = ( 105 | length(var.ec2_ssh_key_name) < 2 106 | ) 107 | error_message = "You may not specify more than one `ec2_ssh_key_name`." 108 | } 109 | default = [] 110 | } 111 | 112 | variable "update_config" { 113 | type = list(map(number)) 114 | description = <<-EOT 115 | Configuration for the `eks_node_group` [`update_config` Configuration Block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group#update_config-configuration-block). 116 | Specify exactly one of `max_unavailable` (node count) or `max_unavailable_percentage` (percentage of nodes). 117 | EOT 118 | default = [] 119 | } 120 | 121 | variable "after_cluster_joining_userdata" { 122 | type = list(string) 123 | description = "Additional `bash` commands to execute on each worker node after joining the EKS cluster (after executing the `bootstrap.sh` script). For more info, see https://kubedex.com/90-days-of-aws-eks-in-production" 124 | validation { 125 | condition = ( 126 | length(var.after_cluster_joining_userdata) < 2 127 | ) 128 | error_message = "You may not specify more than one `after_cluster_joining_userdata`." 129 | } 130 | default = [] 131 | } 132 | 133 | variable "ami_type" { 134 | type = string 135 | description = <<-EOT 136 | Type of Amazon Machine Image (AMI) associated with the EKS Node Group. 137 | Defaults to `AL2_x86_64`. Valid values: `AL2_x86_64`, `AL2_x86_64_GPU`, `AL2_ARM_64`, `BOTTLEROCKET_x86_64`, and `BOTTLEROCKET_ARM_64`. 138 | EOT 139 | validation { 140 | condition = ( 141 | contains(["AL2_x86_64", "AL2_x86_64_GPU", "AL2_ARM_64", "BOTTLEROCKET_x86_64", "BOTTLEROCKET_ARM_64"], var.ami_type) 142 | ) 143 | error_message = "Var ami_type must be one of \"AL2_x86_64\", \"AL2_x86_64_GPU\", \"AL2_ARM_64\", \"BOTTLEROCKET_x86_64\", and \"BOTTLEROCKET_ARM_64\"." 144 | } 145 | default = "AL2_x86_64" 146 | } 147 | 148 | variable "ami_release_version" { 149 | type = list(string) 150 | description = "EKS AMI version to use, e.g. \"1.16.13-20200821\" (no \"v\"). Defaults to latest version for Kubernetes version." 151 | validation { 152 | condition = ( 153 | length(var.ami_release_version) == 0 ? true : length(regexall("^\\d+\\.\\d+\\.\\d+-[\\da-z]+$", var.ami_release_version[0])) == 1 154 | ) 155 | error_message = "Var ami_release_version, if supplied, must be like \"1.16.13-20200821\" (no \"v\")." 156 | } 157 | default = [] 158 | } 159 | 160 | variable "before_cluster_joining_userdata" { 161 | type = string 162 | description = "Additional commands to execute on each worker node before joining the EKS cluster (before executing the `bootstrap.sh` script). For more info, see https://kubedex.com/90-days-of-aws-eks-in-production" 163 | default = "" 164 | } 165 | 166 | variable "fargate_profile_name" { 167 | type = string 168 | description = "Fargate profile name. If not provided, will be derived from the context" 169 | default = null 170 | } 171 | 172 | variable "fargate_profile_iam_role_name" { 173 | type = string 174 | description = "Fargate profile IAM role name. If not provided, will be derived from the context" 175 | default = null 176 | } 177 | -------------------------------------------------------------------------------- /examples/complete/main.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } 4 | 5 | module "label" { 6 | source = "cloudposse/label/null" 7 | version = "0.25.0" 8 | 9 | # This is the preferred way to add attributes. It will put "cluster" last 10 | # after any attributes set in `var.attributes` or `context.attributes`. 11 | # In this case, we do not care, because we are only using this instance 12 | # of this module to create tags. 13 | attributes = ["cluster"] 14 | 15 | context = module.this.context 16 | } 17 | 18 | locals { 19 | # The usage of the specific kubernetes.io/cluster/* resource tags below are required 20 | # for EKS and Kubernetes to discover and manage networking resources 21 | # https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html#base-vpc-networking 22 | tags = try(merge(module.label.tags, tomap("kubernetes.io/cluster/${module.label.id}", "shared")), null) 23 | 24 | # Unfortunately, most_recent (https://github.com/cloudposse/terraform-aws-eks-workers/blob/34a43c25624a6efb3ba5d2770a601d7cb3c0d391/main.tf#L141) 25 | # variable does not work as expected, if you are not going to use custom ami you should 26 | # enforce usage of eks_worker_ami_name_filter variable to set the right kubernetes version for EKS workers, 27 | # otherwise will be used the first version of Kubernetes supported by AWS (v1.11) for EKS workers but 28 | # EKS control plane will use the version specified by kubernetes_version variable. 29 | eks_worker_ami_name_filter = "amazon-eks-node-${var.kubernetes_version}*" 30 | 31 | allow_all_ingress_rule = { 32 | key = "allow_all_ingress" 33 | type = "ingress" 34 | from_port = 0 35 | to_port = 0 # [sic] from and to port ignored when protocol is "-1", warning if not zero 36 | protocol = "-1" 37 | description = "Allow all ingress" 38 | cidr_blocks = ["0.0.0.0/0"] 39 | ipv6_cidr_blocks = ["::/0"] 40 | } 41 | 42 | allow_http_ingress_rule = { 43 | key = "http" 44 | type = "ingress" 45 | from_port = 80 46 | to_port = 80 47 | protocol = "tcp" 48 | description = "Allow HTTP ingress" 49 | cidr_blocks = ["0.0.0.0/0"] 50 | ipv6_cidr_blocks = ["::/0"] 51 | } 52 | 53 | extra_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" 54 | } 55 | 56 | module "vpc" { 57 | source = "cloudposse/vpc/aws" 58 | version = "2.1.0" 59 | 60 | ipv4_primary_cidr_block = var.vpc_cidr_block 61 | tags = local.tags 62 | 63 | context = module.this.context 64 | } 65 | 66 | module "subnets" { 67 | source = "cloudposse/dynamic-subnets/aws" 68 | version = "2.4.1" 69 | 70 | availability_zones = var.availability_zones 71 | vpc_id = module.vpc.vpc_id 72 | igw_id = [module.vpc.igw_id] 73 | ipv4_cidr_block = [module.vpc.vpc_cidr_block] 74 | 75 | # Need to create NAT gateway since the Fargate nodes are provisioned only in private subnets, and the nodes need to join the cluster 76 | nat_gateway_enabled = true 77 | max_nats = 1 78 | nat_instance_enabled = false 79 | 80 | route_create_timeout = "5m" 81 | route_delete_timeout = "10m" 82 | 83 | subnet_type_tag_key = "cpco.io/subnet/type" 84 | 85 | tags = local.tags 86 | 87 | context = module.this.context 88 | } 89 | 90 | module "ssh_source_access" { 91 | source = "cloudposse/security-group/aws" 92 | version = "2.2.0" 93 | 94 | attributes = ["ssh", "source"] 95 | security_group_description = "Test source security group ssh access only" 96 | allow_all_egress = true 97 | 98 | rules = [local.allow_all_ingress_rule] 99 | 100 | vpc_id = module.vpc.vpc_id 101 | 102 | context = module.label.context 103 | } 104 | 105 | module "https_sg" { 106 | source = "cloudposse/security-group/aws" 107 | version = "2.2.0" 108 | 109 | attributes = ["http"] 110 | security_group_description = "Allow http access" 111 | allow_all_egress = true 112 | 113 | rules = [local.allow_http_ingress_rule] 114 | 115 | vpc_id = module.vpc.vpc_id 116 | 117 | context = module.label.context 118 | } 119 | 120 | module "eks_cluster" { 121 | source = "cloudposse/eks-cluster/aws" 122 | version = "3.0.0" 123 | 124 | region = var.region 125 | vpc_id = module.vpc.vpc_id 126 | subnet_ids = module.subnets.public_subnet_ids 127 | kubernetes_version = var.kubernetes_version 128 | local_exec_interpreter = var.local_exec_interpreter 129 | oidc_provider_enabled = var.oidc_provider_enabled 130 | enabled_cluster_log_types = var.enabled_cluster_log_types 131 | cluster_log_retention_period = var.cluster_log_retention_period 132 | 133 | # data auth has problems destroying the auth-map 134 | kube_data_auth_enabled = false 135 | kube_exec_auth_enabled = true 136 | 137 | context = module.this.context 138 | } 139 | 140 | module "eks_node_group" { 141 | source = "cloudposse/eks-node-group/aws" 142 | version = "2.10.0" 143 | 144 | subnet_ids = module.this.enabled ? module.subnets.public_subnet_ids : ["filler_string_for_enabled_is_false"] 145 | cluster_name = module.this.enabled ? module.eks_cluster.eks_cluster_id : "disabled" 146 | instance_types = var.instance_types 147 | desired_size = var.desired_size 148 | min_size = var.min_size 149 | max_size = var.max_size 150 | kubernetes_version = [var.kubernetes_version] 151 | kubernetes_labels = merge(var.kubernetes_labels, { attributes = coalesce(join(module.this.delimiter, module.this.attributes), "none") }) 152 | kubernetes_taints = var.kubernetes_taints 153 | ec2_ssh_key_name = var.ec2_ssh_key_name 154 | ssh_access_security_group_ids = [module.ssh_source_access.id] 155 | associated_security_group_ids = [module.ssh_source_access.id, module.https_sg.id] 156 | node_role_policy_arns = [local.extra_policy_arn] 157 | update_config = var.update_config 158 | 159 | after_cluster_joining_userdata = var.after_cluster_joining_userdata 160 | 161 | ami_type = var.ami_type 162 | ami_release_version = var.ami_release_version 163 | 164 | before_cluster_joining_userdata = [var.before_cluster_joining_userdata] 165 | 166 | # Ensure ordering of resource creation to eliminate the race conditions when applying the Kubernetes Auth ConfigMap. 167 | # Do not create Node Group before the EKS cluster is created and the `aws-auth` Kubernetes ConfigMap is applied. 168 | depends_on = [module.eks_cluster, module.eks_cluster.kubernetes_config_map_id] 169 | 170 | create_before_destroy = true 171 | 172 | node_group_terraform_timeouts = [{ 173 | create = "40m" 174 | update = null 175 | delete = "20m" 176 | }] 177 | 178 | context = module.this.context 179 | } 180 | 181 | module "eks_fargate_profile" { 182 | source = "../../" 183 | 184 | subnet_ids = module.this.enabled ? module.subnets.private_subnet_ids : ["filler_string_for_enabled_is_false"] 185 | cluster_name = module.eks_cluster.eks_cluster_id 186 | kubernetes_namespace = var.kubernetes_namespace 187 | kubernetes_labels = var.kubernetes_labels 188 | iam_role_kubernetes_namespace_delimiter = var.iam_role_kubernetes_namespace_delimiter 189 | fargate_profile_name = var.fargate_profile_name 190 | fargate_profile_iam_role_name = var.fargate_profile_iam_role_name 191 | 192 | context = module.this.context 193 | } 194 | 195 | # Verify that when disabled, the module tolerates bad inputs 196 | # No explicit test needed, it is sufficient to verify that the apply does not fail 197 | module "eks_fargate_profile_disabled_profile" { 198 | count = module.this.enabled ? 0 : 1 199 | source = "../../" 200 | 201 | subnet_ids = null 202 | cluster_name = null 203 | kubernetes_namespace = null 204 | kubernetes_labels = null 205 | iam_role_kubernetes_namespace_delimiter = null 206 | fargate_profile_name = null 207 | fargate_profile_iam_role_name = null 208 | fargate_pod_execution_role_arn = null 209 | 210 | fargate_pod_execution_role_enabled = false 211 | fargate_profile_enabled = true 212 | 213 | context = module.this.context 214 | } 215 | 216 | # Verify that when disabled, the module tolerates bad inputs 217 | module "eks_fargate_profile_disabled_role" { 218 | count = module.this.enabled ? 0 : 1 219 | source = "../../" 220 | 221 | subnet_ids = null 222 | cluster_name = null 223 | kubernetes_namespace = null 224 | kubernetes_labels = null 225 | iam_role_kubernetes_namespace_delimiter = null 226 | fargate_profile_name = null 227 | fargate_profile_iam_role_name = null 228 | fargate_pod_execution_role_arn = null 229 | 230 | fargate_pod_execution_role_enabled = true 231 | fargate_profile_enabled = false 232 | 233 | context = module.this.context 234 | } 235 | 236 | -------------------------------------------------------------------------------- /context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/complete/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2019-2022 Cloud Posse, LLC 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | # 2 | # This is the canonical configuration for the `README.md` 3 | # Run `make readme` to rebuild the `README.md` 4 | # 5 | 6 | # Name of this project 7 | name: terraform-aws-eks-fargate-profile 8 | 9 | # Logo for this project 10 | #logo: docs/logo.png 11 | 12 | # License of this project 13 | license: "APACHE2" 14 | 15 | # Canonical GitHub repo 16 | github_repo: cloudposse/terraform-aws-eks-fargate-profile 17 | 18 | # Badges to display 19 | badges: 20 | - name: Latest Release 21 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-eks-fargate-profile.svg?style=for-the-badge 22 | url: https://github.com/cloudposse/terraform-aws-eks-fargate-profile/releases/latest 23 | - name: Last Updated 24 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-eks-fargate-profile.svg?style=for-the-badge 25 | url: https://github.com/cloudposse/terraform-aws-eks-fargate-profile/commits 26 | - name: Slack Community 27 | image: https://slack.cloudposse.com/for-the-badge.svg 28 | url: https://cloudposse.com/slack 29 | 30 | # List any related terraform modules that this module may be used with or that this module depends on. 31 | related: 32 | - name: "terraform-aws-eks-cluster" 33 | description: "Terraform module to provision an EKS cluster on AWS" 34 | url: "https://github.com/cloudposse/terraform-aws-eks-cluster" 35 | - name: "terraform-aws-eks-node-group" 36 | description: "Terraform module to provision an EKS Node Group" 37 | url: "https://github.com/cloudposse/terraform-aws-eks-node-group" 38 | - name: "terraform-aws-eks-workers" 39 | description: "Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers" 40 | url: "https://github.com/cloudposse/terraform-aws-eks-workers" 41 | - name: "terraform-aws-ec2-autoscale-group" 42 | description: "Terraform module to provision Auto Scaling Group and Launch Template on AWS" 43 | url: "https://github.com/cloudposse/terraform-aws-ec2-autoscale-group" 44 | - name: "terraform-aws-ecs-container-definition" 45 | description: "Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource" 46 | url: "https://github.com/cloudposse/terraform-aws-ecs-container-definition" 47 | - name: "terraform-aws-ecs-alb-service-task" 48 | description: "Terraform module which implements an ECS service which exposes a web service via ALB" 49 | url: "https://github.com/cloudposse/terraform-aws-ecs-alb-service-task" 50 | - name: "terraform-aws-ecs-web-app" 51 | description: "Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more" 52 | url: "https://github.com/cloudposse/terraform-aws-ecs-web-app" 53 | - name: "terraform-aws-ecs-codepipeline" 54 | description: "Terraform module for CI/CD with AWS Code Pipeline and Code Build for ECS" 55 | url: "https://github.com/cloudposse/terraform-aws-ecs-codepipeline" 56 | - name: "terraform-aws-ecs-cloudwatch-autoscaling" 57 | description: "Terraform module to autoscale ECS Service based on CloudWatch metrics" 58 | url: "https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-autoscaling" 59 | - name: "terraform-aws-ecs-cloudwatch-sns-alarms" 60 | description: "Terraform module to create CloudWatch Alarms on ECS Service level metrics" 61 | url: "https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-sns-alarms" 62 | - name: "terraform-aws-ec2-instance" 63 | description: "Terraform module for providing a general purpose EC2 instance" 64 | url: "https://github.com/cloudposse/terraform-aws-ec2-instance" 65 | - name: "terraform-aws-ec2-instance-group" 66 | description: "Terraform module for provisioning multiple general purpose EC2 hosts for stateful applications" 67 | url: "https://github.com/cloudposse/terraform-aws-ec2-instance-group" 68 | 69 | # Short description of this project 70 | description: |- 71 | Terraform module to provision an [AWS Fargate Profile](https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html) 72 | and Fargate Pod Execution Role for [EKS](https://aws.amazon.com/eks/). 73 | 74 | introduction: |- 75 | By default, this module will provision an [AWS Fargate Profile](https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html) 76 | and Fargate Pod Execution Role for [EKS](https://aws.amazon.com/eks/). 77 | 78 | Note that in general, you only need one Fargate Pod Execution Role per AWS account, 79 | and it can be shared across regions. So if you are creating multiple Faragte Profiles, 80 | you can reuse the role created by the first one, or instantiate this module with 81 | `fargate_profile_enabled = false` to create the role separate from the profile. 82 | 83 | usage: |2- 84 | 85 | For a complete example, see [examples/complete](examples/complete). 86 | 87 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) 88 | (which tests and deploys the example on AWS), see [test](test). 89 | 90 | ```hcl 91 | module "label" { 92 | source = "cloudposse/label/null" 93 | version = "0.25.0" 94 | 95 | # This is the preferred way to add attributes. It will put "cluster" last 96 | # after any attributes set in `var.attributes` or `context.attributes`. 97 | # In this case, we do not care, because we are only using this instance 98 | # of this module to create tags. 99 | attributes = ["cluster"] 100 | 101 | context = module.this.context 102 | } 103 | 104 | locals { 105 | tags = try(merge(module.label.tags, tomap("kubernetes.io/cluster/${module.label.id}", "shared")), null) 106 | 107 | eks_worker_ami_name_filter = "amazon-eks-node-${var.kubernetes_version}*" 108 | 109 | allow_all_ingress_rule = { 110 | key = "allow_all_ingress" 111 | type = "ingress" 112 | from_port = 0 113 | to_port = 0 # [sic] from and to port ignored when protocol is "-1", warning if not zero 114 | protocol = "-1" 115 | description = "Allow all ingress" 116 | cidr_blocks = ["0.0.0.0/0"] 117 | ipv6_cidr_blocks = ["::/0"] 118 | } 119 | 120 | allow_http_ingress_rule = { 121 | key = "http" 122 | type = "ingress" 123 | from_port = 80 124 | to_port = 80 125 | protocol = "tcp" 126 | description = "Allow HTTP ingress" 127 | cidr_blocks = ["0.0.0.0/0"] 128 | ipv6_cidr_blocks = ["::/0"] 129 | } 130 | 131 | extra_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" 132 | } 133 | 134 | module "vpc" { 135 | source = "cloudposse/vpc/aws" 136 | version = "1.1.0" 137 | 138 | cidr_block = var.vpc_cidr_block 139 | tags = local.tags 140 | 141 | context = module.this.context 142 | } 143 | 144 | module "subnets" { 145 | source = "cloudposse/dynamic-subnets/aws" 146 | version = "1.0.0" 147 | 148 | availability_zones = var.availability_zones 149 | vpc_id = module.vpc.vpc_id 150 | igw_id = module.vpc.igw_id 151 | cidr_block = module.vpc.vpc_cidr_block 152 | nat_gateway_enabled = true 153 | nat_instance_enabled = false 154 | tags = local.tags 155 | 156 | context = module.this.context 157 | } 158 | 159 | module "ssh_source_access" { 160 | source = "cloudposse/security-group/aws" 161 | version = "1.0.1" 162 | 163 | attributes = ["ssh", "source"] 164 | security_group_description = "Test source security group ssh access only" 165 | create_before_destroy = true 166 | allow_all_egress = true 167 | 168 | rules = [local.allow_all_ingress_rule] 169 | 170 | vpc_id = module.vpc.vpc_id 171 | 172 | context = module.label.context 173 | } 174 | 175 | module "https_sg" { 176 | source = "cloudposse/security-group/aws" 177 | version = "1.0.1" 178 | 179 | attributes = ["http"] 180 | security_group_description = "Allow http access" 181 | create_before_destroy = true 182 | allow_all_egress = true 183 | 184 | rules = [local.allow_http_ingress_rule] 185 | 186 | vpc_id = module.vpc.vpc_id 187 | 188 | context = module.label.context 189 | } 190 | 191 | module "eks_cluster" { 192 | source = "cloudposse/eks-cluster/aws" 193 | version = "2.2.0" 194 | 195 | region = var.region 196 | vpc_id = module.vpc.vpc_id 197 | subnet_ids = module.subnets.public_subnet_ids 198 | kubernetes_version = var.kubernetes_version 199 | local_exec_interpreter = var.local_exec_interpreter 200 | oidc_provider_enabled = var.oidc_provider_enabled 201 | enabled_cluster_log_types = var.enabled_cluster_log_types 202 | cluster_log_retention_period = var.cluster_log_retention_period 203 | 204 | # data auth has problems destroying the auth-map 205 | kube_data_auth_enabled = false 206 | kube_exec_auth_enabled = true 207 | 208 | context = module.this.context 209 | } 210 | 211 | module "eks_node_group" { 212 | source = "cloudposse/eks-node-group/aws" 213 | version = "2.4.0" 214 | 215 | subnet_ids = module.subnets.public_subnet_ids 216 | cluster_name = module.eks_cluster.eks_cluster_id 217 | instance_types = var.instance_types 218 | desired_size = var.desired_size 219 | min_size = var.min_size 220 | max_size = var.max_size 221 | kubernetes_version = [var.kubernetes_version] 222 | kubernetes_labels = merge(var.kubernetes_labels, { attributes = coalesce(join(module.this.delimiter, module.this.attributes), "none") }) 223 | kubernetes_taints = var.kubernetes_taints 224 | ec2_ssh_key_name = var.ec2_ssh_key_name 225 | ssh_access_security_group_ids = [module.ssh_source_access.id] 226 | associated_security_group_ids = [module.ssh_source_access.id, module.https_sg.id] 227 | node_role_policy_arns = [local.extra_policy_arn] 228 | update_config = var.update_config 229 | 230 | after_cluster_joining_userdata = var.after_cluster_joining_userdata 231 | 232 | ami_type = var.ami_type 233 | ami_release_version = var.ami_release_version 234 | 235 | before_cluster_joining_userdata = [var.before_cluster_joining_userdata] 236 | 237 | context = module.this.context 238 | 239 | # Ensure ordering of resource creation to eliminate the race conditions when applying the Kubernetes Auth ConfigMap. 240 | # Do not create Node Group before the EKS cluster is created and the `aws-auth` Kubernetes ConfigMap is applied. 241 | depends_on = [module.eks_cluster, module.eks_cluster.kubernetes_config_map_id] 242 | 243 | create_before_destroy = true 244 | 245 | node_group_terraform_timeouts = [{ 246 | create = "40m" 247 | update = null 248 | delete = "20m" 249 | }] 250 | } 251 | 252 | module "eks_fargate_profile" { 253 | source = "cloudposse/eks-fargate-profile/aws" 254 | version = "x.x.x" 255 | 256 | subnet_ids = module.subnets.public_subnet_ids 257 | cluster_name = module.eks_cluster.eks_cluster_id 258 | kubernetes_namespace = var.kubernetes_namespace 259 | kubernetes_labels = var.kubernetes_labels 260 | iam_role_kubernetes_namespace_delimiter = var.iam_role_kubernetes_namespace_delimiter 261 | 262 | context = module.this.context 263 | } 264 | 265 | ``` 266 | 267 | include: [] 268 | contributors: [] 269 | -------------------------------------------------------------------------------- /test/src/examples_complete_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "context" 5 | "encoding/base64" 6 | "fmt" 7 | "github.com/gruntwork-io/terratest/modules/random" 8 | teststructure "github.com/gruntwork-io/terratest/modules/test-structure" 9 | "k8s.io/apimachinery/pkg/util/runtime" 10 | "k8s.io/client-go/rest" 11 | "os" 12 | "strings" 13 | "sync/atomic" 14 | "testing" 15 | "time" 16 | 17 | "github.com/gruntwork-io/terratest/modules/terraform" 18 | "github.com/stretchr/testify/assert" 19 | appsv1 "k8s.io/api/apps/v1" 20 | apiv1 "k8s.io/api/core/v1" 21 | corev1 "k8s.io/api/core/v1" 22 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" 23 | "k8s.io/client-go/informers" 24 | "k8s.io/client-go/kubernetes" 25 | "k8s.io/client-go/tools/cache" 26 | 27 | "sigs.k8s.io/aws-iam-authenticator/pkg/token" 28 | 29 | "github.com/aws/aws-sdk-go/aws" 30 | "github.com/aws/aws-sdk-go/aws/session" 31 | "github.com/aws/aws-sdk-go/service/eks" 32 | ) 33 | 34 | func int32Ptr(i int32) *int32 { return &i } 35 | 36 | func newClientset(cluster *eks.Cluster) (*kubernetes.Clientset, error) { 37 | gen, err := token.NewGenerator(true, false) 38 | if err != nil { 39 | return nil, err 40 | } 41 | opts := &token.GetTokenOptions{ 42 | ClusterID: aws.StringValue(cluster.Name), 43 | } 44 | tok, err := gen.GetWithOptions(opts) 45 | if err != nil { 46 | return nil, err 47 | } 48 | ca, err := base64.StdEncoding.DecodeString(aws.StringValue(cluster.CertificateAuthority.Data)) 49 | if err != nil { 50 | return nil, err 51 | } 52 | clientset, err := kubernetes.NewForConfig( 53 | &rest.Config{ 54 | Host: aws.StringValue(cluster.Endpoint), 55 | BearerToken: tok.Token, 56 | TLSClientConfig: rest.TLSClientConfig{ 57 | CAData: ca, 58 | }, 59 | }, 60 | ) 61 | if err != nil { 62 | return nil, err 63 | } 64 | return clientset, nil 65 | } 66 | 67 | func cleanup(t *testing.T, terraformOptions *terraform.Options, tempTestFolder string) { 68 | terraform.Destroy(t, terraformOptions) 69 | err := os.RemoveAll(tempTestFolder) 70 | assert.NoError(t, err) 71 | } 72 | 73 | // Test the Terraform module in examples/complete using Terratest. 74 | func TestExamplesComplete(t *testing.T) { 75 | t.Parallel() 76 | randID := strings.ToLower(random.UniqueId()) 77 | attributes := []string{randID} 78 | 79 | rootFolder := "../../" 80 | terraformFolderRelativeToRoot := "examples/complete" 81 | varFiles := []string{"fixtures.us-east-2.tfvars"} 82 | 83 | tempTestFolder := teststructure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot) 84 | 85 | terraformOptions := &terraform.Options{ 86 | // The path to where our Terraform code is located 87 | TerraformDir: tempTestFolder, 88 | Upgrade: true, 89 | // Variables to pass to our Terraform code using -var-file options 90 | VarFiles: varFiles, 91 | Vars: map[string]interface{}{ 92 | "attributes": attributes, 93 | "enabled": true, 94 | }, 95 | } 96 | 97 | // At the end of the test, run `terraform destroy` to clean up any resources that were created 98 | defer cleanup(t, terraformOptions, tempTestFolder) 99 | 100 | // If Go runtime crushes, run `terraform destroy` to clean up any resources that were created 101 | defer runtime.HandleCrash(func(i interface{}) { 102 | terraform.Destroy(t, terraformOptions) 103 | }) 104 | 105 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors 106 | terraform.InitAndApply(t, terraformOptions) 107 | 108 | // Run `terraform output` to get the value of an output variable 109 | vpcCidr := terraform.Output(t, terraformOptions, "vpc_cidr") 110 | // Verify we're getting back the outputs we expect 111 | assert.Equal(t, "172.16.0.0/16", vpcCidr) 112 | 113 | // Run `terraform output` to get the value of an output variable 114 | privateSubnetCidrs := terraform.OutputList(t, terraformOptions, "private_subnet_cidrs") 115 | // Verify we're getting back the outputs we expect 116 | assert.Equal(t, []string{"172.16.0.0/19", "172.16.32.0/19"}, privateSubnetCidrs) 117 | 118 | // Run `terraform output` to get the value of an output variable 119 | publicSubnetCidrs := terraform.OutputList(t, terraformOptions, "public_subnet_cidrs") 120 | // Verify we're getting back the outputs we expect 121 | assert.Equal(t, []string{"172.16.96.0/19", "172.16.128.0/19"}, publicSubnetCidrs) 122 | 123 | // Run `terraform output` to get the value of an output variable 124 | eksClusterId := terraform.Output(t, terraformOptions, "eks_cluster_id") 125 | // Verify we're getting back the outputs we expect 126 | assert.Equal(t, "eg-test-eks-fargate-"+randID+"-cluster", eksClusterId) 127 | 128 | // Run `terraform output` to get the value of an output variable 129 | eksNodeGroupId := terraform.Output(t, terraformOptions, "eks_node_group_id") 130 | // Verify we're getting back the outputs we expect 131 | assert.Contains(t, eksNodeGroupId, "eg-test-eks-fargate-"+randID+"-cluster:eg-test-eks-fargate-"+randID+"-workers") 132 | 133 | // Run `terraform output` to get the value of an output variable 134 | eksNodeGroupRoleName := terraform.Output(t, terraformOptions, "eks_node_group_role_name") 135 | // Verify we're getting back the outputs we expect 136 | assert.Equal(t, "eg-test-eks-fargate-"+randID+"-workers", eksNodeGroupRoleName) 137 | 138 | // Run `terraform output` to get the value of an output variable 139 | eksNodeGroupStatus := terraform.Output(t, terraformOptions, "eks_node_group_status") 140 | // Verify we're getting back the outputs we expect 141 | assert.Equal(t, "ACTIVE", eksNodeGroupStatus) 142 | 143 | // Run `terraform output` to get the value of an output variable 144 | eksFargateProfileId := terraform.Output(t, terraformOptions, "eks_fargate_profile_id") 145 | // Verify we're getting back the outputs we expect 146 | assert.Equal(t, "eg-test-eks-fargate-"+randID+"-cluster:eg-test-eks-fargate-"+randID+"-default", eksFargateProfileId) 147 | 148 | // Run `terraform output` to get the value of an output variable 149 | eksFargateProfileRoleName := terraform.Output(t, terraformOptions, "eks_fargate_profile_role_name") 150 | // Verify we're getting back the outputs we expect 151 | assert.Equal(t, "eg-test-eks-fargate-"+randID+"-fargate@default", eksFargateProfileRoleName) 152 | 153 | // Run `terraform output` to get the value of an output variable 154 | eksFargateProfileStatus := terraform.Output(t, terraformOptions, "eks_fargate_profile_status") 155 | // Verify we're getting back the outputs we expect 156 | assert.Equal(t, "ACTIVE", eksFargateProfileStatus) 157 | 158 | // Wait for the worker nodes to join the cluster 159 | // https://github.com/kubernetes/client-go 160 | // https://www.rushtehrani.com/post/using-kubernetes-api 161 | // https://rancher.com/using-kubernetes-api-go-kubecon-2017-session-recap 162 | // https://gianarb.it/blog/kubernetes-shared-informer 163 | // https://stackoverflow.com/questions/60547409/unable-to-obtain-kubeconfig-of-an-aws-eks-cluster-in-go-code/60573982#60573982 164 | fmt.Println("Waiting for worker nodes to join the EKS cluster...") 165 | 166 | clusterName := "eg-test-eks-fargate-" + randID + "-cluster" 167 | region := "us-east-2" 168 | 169 | sess := session.Must(session.NewSession(&aws.Config{ 170 | Region: aws.String(region), 171 | })) 172 | 173 | eksSvc := eks.New(sess) 174 | 175 | input := &eks.DescribeClusterInput{ 176 | Name: aws.String(clusterName), 177 | } 178 | 179 | result, err := eksSvc.DescribeCluster(input) 180 | assert.NoError(t, err) 181 | 182 | clientset, err := newClientset(result.Cluster) 183 | assert.NoError(t, err) 184 | 185 | // Create Kubernetes deployment in the `default` namespace (for which we create a Fargate Profile) 186 | // https://github.com/kubernetes/client-go/blob/master/examples/create-update-delete-deployment/main.go 187 | fmt.Println("Creating Kubernetes deployment 'demo-deployment' in the 'default' namespace...") 188 | deploymentsClient := clientset.AppsV1().Deployments(apiv1.NamespaceDefault) 189 | 190 | deployment := &appsv1.Deployment{ 191 | ObjectMeta: metav1.ObjectMeta{ 192 | Namespace: apiv1.NamespaceDefault, 193 | Name: "demo-deployment", 194 | }, 195 | Spec: appsv1.DeploymentSpec{ 196 | Replicas: int32Ptr(1), 197 | Selector: &metav1.LabelSelector{ 198 | MatchLabels: map[string]string{ 199 | "app": "demo", 200 | }, 201 | }, 202 | Template: apiv1.PodTemplateSpec{ 203 | ObjectMeta: metav1.ObjectMeta{ 204 | Labels: map[string]string{ 205 | "app": "demo", 206 | }, 207 | }, 208 | Spec: apiv1.PodSpec{ 209 | Containers: []apiv1.Container{ 210 | { 211 | Name: "web", 212 | Image: "nginx:1.17", 213 | Ports: []apiv1.ContainerPort{ 214 | { 215 | Name: "http", 216 | Protocol: apiv1.ProtocolTCP, 217 | ContainerPort: 80, 218 | }, 219 | }, 220 | }, 221 | }, 222 | }, 223 | }, 224 | }, 225 | } 226 | 227 | deploymentClient, err := deploymentsClient.Create(context.TODO(), deployment, metav1.CreateOptions{}) 228 | assert.NoError(t, err) 229 | fmt.Printf("Created Kubernetes deployment %q\n", deploymentClient.GetObjectMeta().GetName()) 230 | 231 | factory := informers.NewSharedInformerFactory(clientset, 0) 232 | informer := factory.Core().V1().Nodes().Informer() 233 | stopChannel := make(chan struct{}) 234 | var countOfWorkerNodes uint64 = 0 235 | 236 | informer.AddEventHandler(cache.ResourceEventHandlerFuncs{ 237 | AddFunc: func(obj interface{}) { 238 | node := obj.(*corev1.Node) 239 | fmt.Printf("Node %s has joined the EKS cluster at %s\n", node.Name, node.CreationTimestamp) 240 | atomic.AddUint64(&countOfWorkerNodes, 1) 241 | if countOfWorkerNodes == 3 { 242 | close(stopChannel) 243 | } 244 | }, 245 | }) 246 | 247 | go informer.Run(stopChannel) 248 | 249 | select { 250 | case <-stopChannel: 251 | fmt.Println("All nodes have joined the EKS cluster") 252 | fmt.Printf("Listing deployments in namespace '%q':\n", apiv1.NamespaceDefault) 253 | list, err := deploymentsClient.List(context.TODO(), metav1.ListOptions{}) 254 | assert.NoError(t, err) 255 | 256 | for _, d := range list.Items { 257 | fmt.Printf("* Deployment '%s' has %d replica(s)\n", d.Name, *d.Spec.Replicas) 258 | } 259 | 260 | fmt.Println("Deleting deployment 'demo-deployment' ...") 261 | deletePolicy := metav1.DeletePropagationForeground 262 | err = deploymentsClient.Delete(context.TODO(), "demo-deployment", metav1.DeleteOptions{ 263 | PropagationPolicy: &deletePolicy, 264 | }) 265 | assert.NoError(t, err) 266 | fmt.Println("Deleted deployment 'demo-deployment'") 267 | 268 | case <-time.After(8 * time.Minute): 269 | msg := "NOT all nodes have joined the EKS cluster" 270 | fmt.Println(msg) 271 | assert.Fail(t, msg) 272 | } 273 | } 274 | 275 | func TestExamplesCompleteDisabled(t *testing.T) { 276 | t.Parallel() 277 | randID := strings.ToLower(random.UniqueId()) 278 | attributes := []string{randID} 279 | 280 | rootFolder := "../../" 281 | terraformFolderRelativeToRoot := "examples/complete" 282 | varFiles := []string{"fixtures.us-east-2.tfvars"} 283 | 284 | tempTestFolder := teststructure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot) 285 | 286 | terraformOptions := &terraform.Options{ 287 | // The path to where our Terraform code is located 288 | TerraformDir: tempTestFolder, 289 | Upgrade: true, 290 | // Variables to pass to our Terraform code using -var-file options 291 | VarFiles: varFiles, 292 | Vars: map[string]interface{}{ 293 | "attributes": attributes, 294 | "enabled": false, 295 | }, 296 | } 297 | 298 | // At the end of the test, run `terraform destroy` to clean up any resources that were created 299 | defer cleanup(t, terraformOptions, tempTestFolder) 300 | 301 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors 302 | terraform.InitAndApply(t, terraformOptions) 303 | 304 | // Get all the output and lookup a field. Pass if the field is missing or empty. 305 | eksClusterArn := terraform.OutputAll(t, terraformOptions)["eks_cluster_arn"] 306 | assert.Empty(t, eksClusterArn, "When disabled, module should have no outputs.") 307 | 308 | // Get all the output and lookup a field. Pass if the field is missing or empty. 309 | eksNodeGroupArn := terraform.OutputAll(t, terraformOptions)["eks_node_group_arn"] 310 | assert.Empty(t, eksNodeGroupArn, "When disabled, module should have no outputs.") 311 | 312 | // Get all the output and lookup a field. Pass if the field is missing or empty. 313 | eksFargateProfileArn := terraform.OutputAll(t, terraformOptions)["eks_fargate_profile_arn"] 314 | assert.Empty(t, eksFargateProfileArn, "When disabled, module should have no outputs.") 315 | } 316 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Project Banner
5 | 6 | 7 |

Latest ReleaseLast UpdatedSlack CommunityGet Support 8 | 9 |

10 | 11 | 12 | 32 | 33 | Terraform module to provision an [AWS Fargate Profile](https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html) 34 | and Fargate Pod Execution Role for [EKS](https://aws.amazon.com/eks/). 35 | 36 | 37 | > [!TIP] 38 | > #### 👽 Use Atmos with Terraform 39 | > Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform.
40 | > Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift). 41 | > 42 | >
43 | > Watch demo of using Atmos with Terraform 44 | >
45 | > Example of running atmos to manage infrastructure from our Quick Start tutorial. 46 | > 47 | 48 | 49 | ## Introduction 50 | 51 | By default, this module will provision an [AWS Fargate Profile](https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html) 52 | and Fargate Pod Execution Role for [EKS](https://aws.amazon.com/eks/). 53 | 54 | Note that in general, you only need one Fargate Pod Execution Role per AWS account, 55 | and it can be shared across regions. So if you are creating multiple Faragte Profiles, 56 | you can reuse the role created by the first one, or instantiate this module with 57 | `fargate_profile_enabled = false` to create the role separate from the profile. 58 | 59 | 60 | 61 | 62 | ## Usage 63 | 64 | 65 | For a complete example, see [examples/complete](examples/complete). 66 | 67 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) 68 | (which tests and deploys the example on AWS), see [test](test). 69 | 70 | ```hcl 71 | module "label" { 72 | source = "cloudposse/label/null" 73 | version = "0.25.0" 74 | 75 | # This is the preferred way to add attributes. It will put "cluster" last 76 | # after any attributes set in `var.attributes` or `context.attributes`. 77 | # In this case, we do not care, because we are only using this instance 78 | # of this module to create tags. 79 | attributes = ["cluster"] 80 | 81 | context = module.this.context 82 | } 83 | 84 | locals { 85 | tags = try(merge(module.label.tags, tomap("kubernetes.io/cluster/${module.label.id}", "shared")), null) 86 | 87 | eks_worker_ami_name_filter = "amazon-eks-node-${var.kubernetes_version}*" 88 | 89 | allow_all_ingress_rule = { 90 | key = "allow_all_ingress" 91 | type = "ingress" 92 | from_port = 0 93 | to_port = 0 # [sic] from and to port ignored when protocol is "-1", warning if not zero 94 | protocol = "-1" 95 | description = "Allow all ingress" 96 | cidr_blocks = ["0.0.0.0/0"] 97 | ipv6_cidr_blocks = ["::/0"] 98 | } 99 | 100 | allow_http_ingress_rule = { 101 | key = "http" 102 | type = "ingress" 103 | from_port = 80 104 | to_port = 80 105 | protocol = "tcp" 106 | description = "Allow HTTP ingress" 107 | cidr_blocks = ["0.0.0.0/0"] 108 | ipv6_cidr_blocks = ["::/0"] 109 | } 110 | 111 | extra_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" 112 | } 113 | 114 | module "vpc" { 115 | source = "cloudposse/vpc/aws" 116 | version = "1.1.0" 117 | 118 | cidr_block = var.vpc_cidr_block 119 | tags = local.tags 120 | 121 | context = module.this.context 122 | } 123 | 124 | module "subnets" { 125 | source = "cloudposse/dynamic-subnets/aws" 126 | version = "1.0.0" 127 | 128 | availability_zones = var.availability_zones 129 | vpc_id = module.vpc.vpc_id 130 | igw_id = module.vpc.igw_id 131 | cidr_block = module.vpc.vpc_cidr_block 132 | nat_gateway_enabled = true 133 | nat_instance_enabled = false 134 | tags = local.tags 135 | 136 | context = module.this.context 137 | } 138 | 139 | module "ssh_source_access" { 140 | source = "cloudposse/security-group/aws" 141 | version = "1.0.1" 142 | 143 | attributes = ["ssh", "source"] 144 | security_group_description = "Test source security group ssh access only" 145 | create_before_destroy = true 146 | allow_all_egress = true 147 | 148 | rules = [local.allow_all_ingress_rule] 149 | 150 | vpc_id = module.vpc.vpc_id 151 | 152 | context = module.label.context 153 | } 154 | 155 | module "https_sg" { 156 | source = "cloudposse/security-group/aws" 157 | version = "1.0.1" 158 | 159 | attributes = ["http"] 160 | security_group_description = "Allow http access" 161 | create_before_destroy = true 162 | allow_all_egress = true 163 | 164 | rules = [local.allow_http_ingress_rule] 165 | 166 | vpc_id = module.vpc.vpc_id 167 | 168 | context = module.label.context 169 | } 170 | 171 | module "eks_cluster" { 172 | source = "cloudposse/eks-cluster/aws" 173 | version = "2.2.0" 174 | 175 | region = var.region 176 | vpc_id = module.vpc.vpc_id 177 | subnet_ids = module.subnets.public_subnet_ids 178 | kubernetes_version = var.kubernetes_version 179 | local_exec_interpreter = var.local_exec_interpreter 180 | oidc_provider_enabled = var.oidc_provider_enabled 181 | enabled_cluster_log_types = var.enabled_cluster_log_types 182 | cluster_log_retention_period = var.cluster_log_retention_period 183 | 184 | # data auth has problems destroying the auth-map 185 | kube_data_auth_enabled = false 186 | kube_exec_auth_enabled = true 187 | 188 | context = module.this.context 189 | } 190 | 191 | module "eks_node_group" { 192 | source = "cloudposse/eks-node-group/aws" 193 | version = "2.4.0" 194 | 195 | subnet_ids = module.subnets.public_subnet_ids 196 | cluster_name = module.eks_cluster.eks_cluster_id 197 | instance_types = var.instance_types 198 | desired_size = var.desired_size 199 | min_size = var.min_size 200 | max_size = var.max_size 201 | kubernetes_version = [var.kubernetes_version] 202 | kubernetes_labels = merge(var.kubernetes_labels, { attributes = coalesce(join(module.this.delimiter, module.this.attributes), "none") }) 203 | kubernetes_taints = var.kubernetes_taints 204 | ec2_ssh_key_name = var.ec2_ssh_key_name 205 | ssh_access_security_group_ids = [module.ssh_source_access.id] 206 | associated_security_group_ids = [module.ssh_source_access.id, module.https_sg.id] 207 | node_role_policy_arns = [local.extra_policy_arn] 208 | update_config = var.update_config 209 | 210 | after_cluster_joining_userdata = var.after_cluster_joining_userdata 211 | 212 | ami_type = var.ami_type 213 | ami_release_version = var.ami_release_version 214 | 215 | before_cluster_joining_userdata = [var.before_cluster_joining_userdata] 216 | 217 | context = module.this.context 218 | 219 | # Ensure ordering of resource creation to eliminate the race conditions when applying the Kubernetes Auth ConfigMap. 220 | # Do not create Node Group before the EKS cluster is created and the `aws-auth` Kubernetes ConfigMap is applied. 221 | depends_on = [module.eks_cluster, module.eks_cluster.kubernetes_config_map_id] 222 | 223 | create_before_destroy = true 224 | 225 | node_group_terraform_timeouts = [{ 226 | create = "40m" 227 | update = null 228 | delete = "20m" 229 | }] 230 | } 231 | 232 | module "eks_fargate_profile" { 233 | source = "cloudposse/eks-fargate-profile/aws" 234 | version = "x.x.x" 235 | 236 | subnet_ids = module.subnets.public_subnet_ids 237 | cluster_name = module.eks_cluster.eks_cluster_id 238 | kubernetes_namespace = var.kubernetes_namespace 239 | kubernetes_labels = var.kubernetes_labels 240 | iam_role_kubernetes_namespace_delimiter = var.iam_role_kubernetes_namespace_delimiter 241 | 242 | context = module.this.context 243 | } 244 | 245 | ``` 246 | 247 | > [!IMPORTANT] 248 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation 249 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version 250 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic 251 | > approach for updating versions to avoid unexpected changes. 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | ## Requirements 262 | 263 | | Name | Version | 264 | |------|---------| 265 | | [terraform](#requirement\_terraform) | >= 1.0.0 | 266 | | [aws](#requirement\_aws) | >= 5.0.0 | 267 | 268 | ## Providers 269 | 270 | | Name | Version | 271 | |------|---------| 272 | | [aws](#provider\_aws) | >= 5.0.0 | 273 | 274 | ## Modules 275 | 276 | | Name | Source | Version | 277 | |------|--------|---------| 278 | | [fargate\_profile\_label](#module\_fargate\_profile\_label) | cloudposse/label/null | 0.25.0 | 279 | | [role\_label](#module\_role\_label) | cloudposse/label/null | 0.25.0 | 280 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 | 281 | 282 | ## Resources 283 | 284 | | Name | Type | 285 | |------|------| 286 | | [aws_eks_fargate_profile.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_fargate_profile) | resource | 287 | | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | 288 | | [aws_iam_role_policy_attachment.amazon_eks_fargate_pod_execution_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | 289 | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | 290 | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | 291 | 292 | ## Inputs 293 | 294 | | Name | Description | Type | Default | Required | 295 | |------|-------------|------|---------|:--------:| 296 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | 297 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | 298 | | [cluster\_name](#input\_cluster\_name) | The name of the EKS cluster | `string` | `""` | no | 299 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | 300 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | 301 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | 302 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | 303 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | 304 | | [fargate\_pod\_execution\_role\_arn](#input\_fargate\_pod\_execution\_role\_arn) | ARN of the Fargate Pod Execution Role. Required if `fargate_pod_execution_role_enabled` is `false`, otherwise ignored. | `string` | `null` | no | 305 | | [fargate\_pod\_execution\_role\_enabled](#input\_fargate\_pod\_execution\_role\_enabled) | Set false to disable the Fargate Pod Execution Role creation | `bool` | `true` | no | 306 | | [fargate\_pod\_execution\_role\_name](#input\_fargate\_pod\_execution\_role\_name) | Fargate Pod Execution Role name. If not provided, will be derived from the context | `string` | `null` | no | 307 | | [fargate\_profile\_enabled](#input\_fargate\_profile\_enabled) | Set false to disable the Fargate Profile creation | `bool` | `true` | no | 308 | | [fargate\_profile\_iam\_role\_name](#input\_fargate\_profile\_iam\_role\_name) | DEPRECATED (use `fargate_pod_execution_role_name` instead): Fargate profile IAM role name. If not provided, will be derived from the context | `string` | `null` | no | 309 | | [fargate\_profile\_name](#input\_fargate\_profile\_name) | Fargate profile name. If not provided, will be derived from the context | `string` | `null` | no | 310 | | [iam\_role\_kubernetes\_namespace\_delimiter](#input\_iam\_role\_kubernetes\_namespace\_delimiter) | Delimiter for the Kubernetes namespace in the IAM Role name | `string` | `"-"` | no | 311 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | 312 | | [kubernetes\_labels](#input\_kubernetes\_labels) | Key-value mapping of Kubernetes labels for selection | `map(string)` | `{}` | no | 313 | | [kubernetes\_namespace](#input\_kubernetes\_namespace) | Kubernetes namespace for selection | `string` | `""` | no | 314 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | 315 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | 316 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | 317 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | 
[
  "default"
]
| no | 318 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | 319 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | 320 | | [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached | `string` | `null` | no | 321 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | 322 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | 323 | | [subnet\_ids](#input\_subnet\_ids) | Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: kubernetes.io/cluster/CLUSTER\_NAME (where CLUSTER\_NAME is replaced with the name of the EKS Cluster) | `list(string)` | `[]` | no | 324 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | 325 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | 326 | 327 | ## Outputs 328 | 329 | | Name | Description | 330 | |------|-------------| 331 | | [eks\_fargate\_pod\_execution\_role\_arn](#output\_eks\_fargate\_pod\_execution\_role\_arn) | ARN of the EKS Fargate Pod Execution role | 332 | | [eks\_fargate\_pod\_execution\_role\_name](#output\_eks\_fargate\_pod\_execution\_role\_name) | Name of the EKS Fargate Pod Execution role | 333 | | [eks\_fargate\_profile\_arn](#output\_eks\_fargate\_profile\_arn) | Amazon Resource Name (ARN) of the EKS Fargate Profile | 334 | | [eks\_fargate\_profile\_id](#output\_eks\_fargate\_profile\_id) | EKS Cluster name and EKS Fargate Profile name separated by a colon | 335 | | [eks\_fargate\_profile\_role\_arn](#output\_eks\_fargate\_profile\_role\_arn) | DEPRECATED (use `eks_fargate_pod_execution_role_arn` instead): ARN of the EKS Fargate Profile IAM role | 336 | | [eks\_fargate\_profile\_role\_name](#output\_eks\_fargate\_profile\_role\_name) | DEPRECATED (use `eks_fargate_pod_execution_role_name` instead): Name of the EKS Fargate Profile IAM role | 337 | | [eks\_fargate\_profile\_status](#output\_eks\_fargate\_profile\_status) | Status of the EKS Fargate Profile | 338 | 339 | 340 | 341 | 342 | 343 | 344 | 345 | 346 | ## Related Projects 347 | 348 | Check out these related projects. 349 | 350 | - [terraform-aws-eks-cluster](https://github.com/cloudposse/terraform-aws-eks-cluster) - Terraform module to provision an EKS cluster on AWS 351 | - [terraform-aws-eks-node-group](https://github.com/cloudposse/terraform-aws-eks-node-group) - Terraform module to provision an EKS Node Group 352 | - [terraform-aws-eks-workers](https://github.com/cloudposse/terraform-aws-eks-workers) - Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers 353 | - [terraform-aws-ec2-autoscale-group](https://github.com/cloudposse/terraform-aws-ec2-autoscale-group) - Terraform module to provision Auto Scaling Group and Launch Template on AWS 354 | - [terraform-aws-ecs-container-definition](https://github.com/cloudposse/terraform-aws-ecs-container-definition) - Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource 355 | - [terraform-aws-ecs-alb-service-task](https://github.com/cloudposse/terraform-aws-ecs-alb-service-task) - Terraform module which implements an ECS service which exposes a web service via ALB 356 | - [terraform-aws-ecs-web-app](https://github.com/cloudposse/terraform-aws-ecs-web-app) - Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more 357 | - [terraform-aws-ecs-codepipeline](https://github.com/cloudposse/terraform-aws-ecs-codepipeline) - Terraform module for CI/CD with AWS Code Pipeline and Code Build for ECS 358 | - [terraform-aws-ecs-cloudwatch-autoscaling](https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-autoscaling) - Terraform module to autoscale ECS Service based on CloudWatch metrics 359 | - [terraform-aws-ecs-cloudwatch-sns-alarms](https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-sns-alarms) - Terraform module to create CloudWatch Alarms on ECS Service level metrics 360 | - [terraform-aws-ec2-instance](https://github.com/cloudposse/terraform-aws-ec2-instance) - Terraform module for providing a general purpose EC2 instance 361 | - [terraform-aws-ec2-instance-group](https://github.com/cloudposse/terraform-aws-ec2-instance-group) - Terraform module for provisioning multiple general purpose EC2 hosts for stateful applications 362 | 363 | 364 | > [!TIP] 365 | > #### Use Terraform Reference Architectures for AWS 366 | > 367 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. 368 | > 369 | > ✅ We build it together with your team.
370 | > ✅ Your team owns everything.
371 | > ✅ 100% Open Source and backed by fanatical support.
372 | > 373 | > Request Quote 374 | >
📚 Learn More 375 | > 376 | >
377 | > 378 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-eks-fargate-profile&utm_content=commercial_support) for funded startups and enterprises. 379 | > 380 | > *Your team can operate like a pro today.* 381 | > 382 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. 383 | > #### Day-0: Your Foundation for Success 384 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. 385 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. 386 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. 387 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. 388 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. 389 | > 390 | > Request Quote 391 | > 392 | > #### Day-2: Your Operational Mastery 393 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. 394 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. 395 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. 396 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. 397 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. 398 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. 399 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. 400 | > 401 | > Request Quote 402 | > 403 |
404 | 405 | ## ✨ Contributing 406 | 407 | This project is under active development, and we encourage contributions from our community. 408 | 409 | 410 | 411 | Many thanks to our outstanding contributors: 412 | 413 | 414 | 415 | 416 | 417 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-eks-fargate-profile/issues). 418 | 419 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. 420 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-eks-fargate-profile/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). 421 | 2. **Fork** the repo on GitHub 422 | 3. **Clone** the project to your own machine 423 | 4. **Commit** changes to your own branch 424 | 5. **Push** your work back up to your fork 425 | 6. Submit a **Pull Request** so that we can review your changes 426 | 427 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! 428 | 429 | 430 | ## Running Terraform Tests 431 | 432 | We use [Atmos](https://atmos.tools) to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands. 433 | 434 | All tests are located in the [`test/`](test) folder. 435 | 436 | Under the hood, tests are powered by Terratest together with our internal [Test Helpers](https://github.com/cloudposse/test-helpers) library, providing robust infrastructure validation. 437 | 438 | Setup dependencies: 439 | - Install Atmos ([installation guide](https://atmos.tools/install/)) 440 | - Install Go [1.24+ or newer](https://go.dev/doc/install) 441 | - Install Terraform or OpenTofu 442 | 443 | To run tests: 444 | 445 | - Run all tests: 446 | ```sh 447 | atmos test run 448 | ``` 449 | - Clean up test artifacts: 450 | ```sh 451 | atmos test clean 452 | ``` 453 | - Explore additional test options: 454 | ```sh 455 | atmos test --help 456 | ``` 457 | The configuration for test commands is centrally managed. To review what's being imported, see the [`atmos.yaml`](https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml) file. 458 | 459 | Learn more about our [automated testing in our documentation](https://docs.cloudposse.com/community/contribute/automated-testing/) or implementing [custom commands](https://atmos.tools/core-concepts/custom-commands/) with atmos. 460 | 461 | ### 🌎 Slack Community 462 | 463 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-eks-fargate-profile&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. 464 | 465 | ### 📰 Newsletter 466 | 467 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-eks-fargate-profile&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. 468 | Dropped straight into your Inbox every week — and usually a 5-minute read. 469 | 470 | ### 📆 Office Hours 471 | 472 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-eks-fargate-profile&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. 473 | It's **FREE** for everyone! 474 | ## License 475 | 476 | License 477 | 478 |
479 | Preamble to the Apache License, Version 2.0 480 |
481 |
482 | 483 | Complete license is available in the [`LICENSE`](LICENSE) file. 484 | 485 | ```text 486 | Licensed to the Apache Software Foundation (ASF) under one 487 | or more contributor license agreements. See the NOTICE file 488 | distributed with this work for additional information 489 | regarding copyright ownership. The ASF licenses this file 490 | to you under the Apache License, Version 2.0 (the 491 | "License"); you may not use this file except in compliance 492 | with the License. You may obtain a copy of the License at 493 | 494 | https://www.apache.org/licenses/LICENSE-2.0 495 | 496 | Unless required by applicable law or agreed to in writing, 497 | software distributed under the License is distributed on an 498 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 499 | KIND, either express or implied. See the License for the 500 | specific language governing permissions and limitations 501 | under the License. 502 | ``` 503 |
504 | 505 | ## Trademarks 506 | 507 | All other trademarks referenced herein are the property of their respective owners. 508 | 509 | 510 | --- 511 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright) 512 | 513 | 514 | README footer 515 | 516 | Beacon 517 | --------------------------------------------------------------------------------