├── .github └── workflows │ └── terraform.yml ├── .gitignore ├── .releaserc ├── README.md ├── alb-ingress.tf ├── aws-fluent-bit.tf ├── aws-node-termination-handler.tf ├── calico.tf ├── cert-manager.tf ├── cluster-autoscaler.tf ├── cni-metrics-helper.tf ├── data.tf ├── examples ├── terraform │ ├── main.tf │ ├── providers.tf │ └── variables.tf └── terragrunt │ └── README.md ├── external-dns-secondary.tf ├── external-dns.tf ├── fluentd-cloudwatch.tf ├── flux.tf ├── istio-operator.tf ├── karma.tf ├── keycloak.tf ├── kiam.tf ├── kong.tf ├── kube-prometheus.tf ├── locals.tf ├── metrics-server.tf ├── nginx-ingress.tf ├── node-problem-detector.tf ├── priority-class.tf ├── sealed-secrets.tf ├── templates ├── cert-manager-cluster-issuers.yaml └── cni-metrics-helper.yaml ├── variables.tf └── versions.tf /.github/workflows/terraform.yml: -------------------------------------------------------------------------------- 1 | name: 'Terraform' 2 | 3 | on: 4 | push: 5 | branches: 6 | - master 7 | pull_request: 8 | 9 | jobs: 10 | terraform: 11 | name: 'Terraform' 12 | runs-on: ubuntu-latest 13 | steps: 14 | - name: Checkout 15 | uses: actions/checkout@v2 16 | 17 | - name: Setup Kubectl provider 18 | run: | 19 | mkdir -p ~/.terraform.d/plugins 20 | curl -Ls https://api.github.com/repos/gavinbunney/terraform-provider-kubectl/releases/latest | jq -r ".assets[] | select(.browser_download_url | contains(\"$(uname -s | tr A-Z a-z)\")) | select(.browser_download_url | contains(\"amd64\")) | .browser_download_url" | xargs -n 1 curl -Lo ~/.terraform.d/plugins/terraform-provider-kubectl 21 | chmod +x ~/.terraform.d/plugins/terraform-provider-kubectl 22 | 23 | - name: Setup Terraform 24 | uses: hashicorp/setup-terraform@v1 25 | 26 | - name: Terraform Init 27 | run: terraform init -backend=false 28 | 29 | - name: Terraform Format 30 | run: terraform fmt -check 31 | 32 | - name: Terraform Validate 33 | run: terraform validate 34 | env: 35 | AWS_REGION: eu-west-3 36 | 37 | - name: Semantic Release 38 | uses: cycjimmy/semantic-release-action@v2 39 | env: 40 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 41 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .terragrunt-cache 2 | .terraform 3 | -------------------------------------------------------------------------------- /.releaserc: -------------------------------------------------------------------------------- 1 | { 2 | "plugins": [ 3 | "@semantic-release/commit-analyzer", 4 | "@semantic-release/release-notes-generator", 5 | "@semantic-release/github" 6 | ] 7 | } 8 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ARCHIVED 2 | 3 | This repository has moved to [particule](https://github.com/particuleio/terraform-kubernetes-addons) to a more general repository supporting multiple cloud providers. It is also available on [TF registry](https://registry.terraform.io/modules/particuleio/addons/kubernetes/latest) 4 | 5 | # terraform-kubernetes-addons 6 | 7 | [![Build Status](https://github.com/clusterfrak-dynamics/terraform-kubernetes-addons/workflows/Terraform/badge.svg)](https://github.com/clusterfrak-dynamics/terraform-kubernetes-addons/actions?query=workflow%3ATerraform) 8 | [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/terraform-kubernetes-addons) 9 | 10 | ## About 11 | 12 | Provides various addons that are often used on Kubernetes with AWS 13 | 14 | ## Main features 15 | 16 | * Common addons with associated IAM permissions if needed: 17 | * [cluster-autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler): scale worker nodes based on workload. 18 | * [external-dns](https://github.com/kubernetes-incubator/external-dns): sync ingress and service records in route53. 19 | * [cert-manager](https://github.com/jetstack/cert-manager): automatically generate TLS certificates, supports ACME v2. 20 | * [kiam](https://github.com/uswitch/kiam): prevents pods to access EC2 metadata and enables pods to assume specific AWS IAM roles. 21 | * [nginx-ingress](https://github.com/kubernetes/ingress-nginx): processes *Ingress* object and acts as a HTTP/HTTPS proxy (compatible with cert-manager). 22 | * [metrics-server](https://github.com/kubernetes-incubator/metrics-server): enable metrics API and horizontal pod scaling (HPA). 23 | * [prometheus-operator](https://github.com/coreos/prometheus-operator): Monitoring / Alerting / Dashboards. 24 | * [karma](https://github.com/prymitive/karma): An alertmanager dashboard 25 | * [fluentd-cloudwatch](https://github.com/helm/charts/tree/master/incubator/fluentd-cloudwatch): forwards logs to AWS Cloudwatch. 26 | * [node-problem-detector](https://github.com/kubernetes/node-problem-detector): Forwards node problems to Kubernetes events 27 | * [flux](https://github.com/weaveworks/flux): Continous Delivery with Gitops workflow. 28 | * [sealed-secrets](https://github.com/bitnami-labs/sealed-secrets): Technology agnostic, store secrets on git. 29 | * [istio-operator](https://istio.io): Service mesh for Kubernetes. 30 | * [cni-metrics-helper](https://docs.aws.amazon.com/eks/latest/userguide/cni-metrics-helper.html): Provides cloudwatch metrics for VPC CNI plugins. 31 | * [kong](https://konghq.com/kong): API Gateway ingress controller. 32 | * [keycloak](https://www.keycloak.org/) : Identity and access management 33 | * [alb-ingress](https://github.com/kubernetes-sigs/aws-alb-ingress-controller): Use AWS ALB for ingress ressources. 34 | * [aws-calico](https://github.com/aws/eks-charts/tree/master/stable/aws-calico): Use calico for network policy 35 | * [aws-node-termination-handler](https://github.com/aws/aws-node-termination-handler): Manage spot instance lifecyle 36 | * [aws-for-fluent-bit](https://github.com/aws/aws-for-fluent-bit): Cloudwatch logging with fluent bit instead of fluentd 37 | 38 | ## Requirements 39 | 40 | * [Terraform](https://www.terraform.io/intro/getting-started/install.html) 41 | * [Terragrunt](https://github.com/gruntwork-io/terragrunt#install-terragrunt) 42 | * [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) 43 | * [helm](https://helm.sh/) 44 | * [aws-iam-authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator) 45 | 46 | ## Documentation 47 | 48 | User guides, feature documentation and examples are available [here](https://clusterfrak-dynamics.github.io/teks/) 49 | 50 | ## IAM permissions 51 | 52 | This module can use either [IRSA](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/) which is the recommanded method or [Kiam](https://github.com/uswitch/kiam). 53 | 54 | ## About Kiam 55 | 56 | Kiam prevents pods from accessing EC2 instances IAM role and therefore using the instances role to perform actions on AWS. It also allows pods to assume specific IAM roles if needed. To do so `kiam-agent` acts as an iptables proxy on nodes. It intercepts requests made to EC2 metadata and redirect them to a `kiam-server` that fetches IAM credentials and pass them to pods. 57 | 58 | Kiam is running with an IAM user and use a secret key and a access key (AK/SK). 59 | 60 | ### Addons that require specific IAM permissions 61 | 62 | Some addons interface with AWS API, for example: 63 | 64 | * `cluster-autoscaler` 65 | * `external-dns` 66 | * `cert-manager` 67 | * `virtual-kubelet` 68 | * `cni-metric-helper` 69 | * `flux` 70 | 71 | ## Terraform docs 72 | 73 | ### Providers 74 | 75 | | Name | Version | 76 | |------|---------| 77 | | aws | n/a | 78 | | helm | n/a | 79 | | http | n/a | 80 | | kubectl | n/a | 81 | | kubernetes | n/a | 82 | | random | n/a | 83 | 84 | ### Inputs 85 | 86 | | Name | Description | Type | Default | Required | 87 | |------|-------------|------|---------|:-----:| 88 | | aws | AWS provider customization | `any` | `{}` | no | 89 | | cert\_manager | Customize cert-manager chart, see `cert_manager.tf` for supported values | `any` | `{}` | no | 90 | | cluster-name | Name of the Kubernetes cluster | `string` | `"sample-cluster"` | no | 91 | | cluster\_autoscaler | Customize cluster-autoscaler chart, see `cluster_autoscaler.tf` for supported values | `any` | `{}` | no | 92 | | cni\_metrics\_helper | Customize cni-metrics-helper deployment, see `cni_metrics_helper.tf` for supported values | `any` | `{}` | no | 93 | | eks | EKS cluster inputs | `any` | `{}` | no | 94 | | external\_dns | Customize external-dns chart, see `external_dns.tf` for supported values | `any` | `{}` | no | 95 | | fluentd\_cloudwatch | Customize fluentd-cloudwatch chart, see `fluentd-cloudwatch.tf` for supported values | `any` | `{}` | no | 96 | | flux | Customize fluxcd chart, see `flux.tf` for supported values | `any` | `{}` | no | 97 | | helm\_defaults | Customize default Helm behavior | `any` | `{}` | no | 98 | | istio\_operator | Customize istio operator deployment, see `istio_operator.tf` for supported values | `any` | `{}` | no | 99 | | karma | Customize karma chart, see `karma.tf` for supported values | `any` | `{}` | no | 100 | | keycloak | Customize keycloak chart, see `keycloak.tf` for supported values | `any` | `{}` | no | 101 | | kiam | Customize kiam chart, see `kiam.tf` for supported values | `any` | `{}` | no | 102 | | kong | Customize kong-ingress chart, see `kong.tf` for supported values | `any` | `{}` | no | 103 | | metrics\_server | Customize metrics-server chart, see `metrics_server.tf` for supported values | `any` | `{}` | no | 104 | | nginx\_ingress | Customize nginx-ingress chart, see `nginx-ingress.tf` for supported values | `any` | `{}` | no | 105 | | npd | Customize node-problem-detector chart, see `npd.tf` for supported values | `any` | `{}` | no | 106 | | priority\_class | Customize a priority class for addons | `any` | `{}` | no | 107 | | priority\_class\_ds | Customize a priority class for addons daemonsets | `any` | `{}` | no | 108 | | prometheus\_operator | Customize prometheus-operator chart, see `kube_prometheus.tf` for supported values | `any` | `{}` | no | 109 | | sealed\_secrets | Customize sealed-secrets chart, see `sealed-secrets.tf` for supported values | `any` | `{}` | no | 110 | 111 | ### Outputs 112 | 113 | | Name | Description | 114 | |------|-------------| 115 | | flux-role-arn-irsa | n/a | 116 | | flux-role-arn-kiam | n/a | 117 | | flux-role-name-irsa | n/a | 118 | | flux-role-name-kiam | n/a | 119 | | grafana\_password | n/a | 120 | | kiam-server-role-arn | n/a | 121 | | kiam-server-role-name | n/a | 122 | 123 | -------------------------------------------------------------------------------- /alb-ingress.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | alb_ingress = merge( 3 | local.helm_defaults, 4 | { 5 | name = "aws-alb-ingress-controller" 6 | namespace = "aws-alb-ingress-controller" 7 | chart = "aws-alb-ingress-controller" 8 | repository = "http://storage.googleapis.com/kubernetes-charts-incubator" 9 | service_account_name = "aws-alb-ingress-controller" 10 | create_iam_resources_kiam = false 11 | create_iam_resources_irsa = true 12 | enabled = false 13 | chart_version = "1.0.2" 14 | version = "v1.1.8" 15 | iam_policy_override = "" 16 | default_network_policy = true 17 | }, 18 | var.alb_ingress 19 | ) 20 | 21 | values_alb_ingress = <