Skip to content

NimTechnology

Trình bày các công nghệ CLOUD một cách dễ hiểu.

  • Kubernetes & Container
    • Docker
    • Kubernetes
      • Ingress
    • Helm Chart
    • Isito-EnvoyFilter
    • Apache Kafka
      • Kafka
      • Kafka Connect
      • Lenses
    • Vault
    • Longhorn – Storage
    • VictoriaMetrics
    • MetalLB
    • Kong Gateway
  • CI/CD
    • ArgoCD
    • ArgoWorkflows
    • Spinnaker
    • Jenkins
    • Harbor
    • TeamCity
    • Git
      • Bitbucket
  • Coding
    • Terraform
      • GCP – Google Cloud
      • AWS – Amazon Web Service
    • Golang
    • Laravel
    • Python
    • Jquery & JavaScript
    • Selenium
  • Log & Monitor
    • DataDog
    • Prometheus
    • Grafana
    • ELK
      • Kibana
      • Logstash
  • BareMetal
    • NextCloud
  • Toggle search form

[EKS/Terraform] Installing or Provisioning an EKS cluster through Terraform Module.

Posted on October 17, 2022March 14, 2023 By nim No Comments on [EKS/Terraform] Installing or Provisioning an EKS cluster through Terraform Module.

Hello anh em!

Trước đó mình có hướng dẫn Install EKS cluster bằng terraform resource.
Bạn có thể tham khảo bài viết bên dưới.

[AWS] Create EKS Cluster and EKS Node Groups in Public and Private Subnets


Hôm nay chúng ta sẽ Install 1 cluster eks thông qua terraform module.
Mình sẽ sử dụng module này:
https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest

Và đây là các bạn viết tham khảo:
(main) https://antonputra.com/amazon/create-eks-cluster-using-terraform-modules/
https://infraform.github.io/terraform-elastic-kubernetes/
https://github.com/alexlogy/terraform-eks-cluster
https://alexlogy.io/creating-eks-cluster-in-aws-with-terraform/
https://andrewtarry.com/posts/terraform-eks-alb-setup/
https://no-easy-dev.tistory.com/m/39

Upgrade from v17.x to v18.x
https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/UPGRADE-18.0.md#upgrade-from-v17x-to-v18x
https://billhegazy.com/eks-terraform-module-upgrade-from-v17-to-v18/

Contents

  • Upgrade from v18.x to v19.x
  • 1) Creating VPC to repair to EKS Cluster
  • 2) Create EKS cluster via terraform module
    • 2.1) OpenID Connect Provider and IRSA
    • 2.2) Pods can’t connect the internet or need to be permited all outbound on eks
    • 2.3) Custom block storage for Node Group
    • 2.4) Update output

Upgrade from v18.x to v19.x

and delete all rules in node_security_group_additional_rules

remove node_security_group_ntp_ipv4_cidr_block = ["169.254.169.123/32"]

change cluster_encryption_config

1) Creating VPC to repair to EKS Cluster

Đầu tiên thì mình sẽ create VPC và bạn có thể tham khảo link dưới.
https://bitbucket.org/nimtechnology/aws-terraform/src/master/infra-structure/aws/250887682577/vpc/mdce-metadefender-devops/

Phần này cũng đơn giản là mình tạo VPC và tạo 2 vùng subnet private và subnet public

Ở phần VPC thì bạn cần lưu ý ở chỗ tag

Chỗ này thì cần khai báo đúng tên cluster eks.

"kubernetes.io/role/elb" = 1
==> Tag này thì tạo svc LoadBalancer sẽ cập IP or Domain Public

"kubernetes.io/role/internal-elb" = 1
==> Tag này thì tạo svc LoadBalancer sẽ cập IP or Domain Private.

2) Create EKS cluster via terraform module

Hiện tai project này mình đang provisioning bằng bitbucket pipeline nên mình share qua bitbucket luôn.

https://bitbucket.org/nimtechnology/aws-terraform/src/master/infra-structure/aws/250887682577/eks/mdce-metadefender-devops/

Chúng ta sẽ đi vào từng khai báo

2.1) OpenID Connect Provider and IRSA

enable_irsa: Determines whether to create an OpenID Connect Provider for EKS to enable IRSA
nếu bạn vẫn thấy lạ với khai niệm trên thì có thể lab bài dưới.

[AWS] EKS IAM Roles for Service Accounts (IRSA) using Terraform

2.2) Pods can’t connect the internet or need to be permited all outbound on eks

Sau khi bạn đã dựng eks cluster và bạn nhớ rằng mình chưa config terraform cho Security Group mục này cần thiết cho bạn
nếu pod của bạn không thể đi ra ngoài internet thì mục này cần thiết cho bạn

Cấu hình trong eks terraform module.

https://github.com/terraform-aws-modules/terraform-aws-eks/issues/1779#issuecomment-1203398170

https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/examples/complete/main.tf#L81-L99

2.3) Custom block storage for Node Group

Nếu bạn muốn chỉnh một số liên quan đến disk của worker EKS.
encrypt data, volume type,…

module "eks" {
  source       = "terraform-aws-modules/eks/aws"
  version = "18.30.2"
....
....

  eks_managed_node_groups = {
    "general-${var.owners}" = {
      # because HA ArgoCD, we need at least 3 nodes
      desired_size = 3
      min_size     = 3
      max_size     = 10

      block_device_mappings = {
        xvda = {
          device_name = "/dev/xvda"
          ebs = {
            volume_size           = 100
            volume_type           = "gp3"
            iops                  = 3000
            throughput            = 125
            encrypted             = true
            delete_on_termination = true
          }
        }
      }

      labels = {
        role = "general"
      }

      instance_types = ["t3.medium"]
      capacity_type  = "ON_DEMAND"
    }

2.4) Update output

output "cluster_certificate_authority_data" {
  description = "Base64 encoded certificate data required to communicate with the cluster"
  value       = module.eks.cluster_certificate_authority_data
}

output "cluster_endpoint" {
  description = "Base64 encoded certificate data required to communicate with the cluster"
  value       = module.eks.cluster_endpoint
}

output "cluster_id" {
  description = "Base64 encoded certificate data required to communicate with the cluster"
  value       = module.eks.cluster_id
}

output "oidc_provider_arn" {
  description = "Base64 encoded certificate data required to communicate with the cluster"
  value       = module.eks.oidc_provider_arn
}

output "vpc_id" {
  description = "The ID of the VPC is installed EKS Cluster"
  value       = data.terraform_remote_state.eks.outputs.vpc_id
}
AWS - Amazon Web Service

Post navigation

Previous Post: [Terraform] Solve “Redundant ignore_changes element” on EKSmodule
Next Post: [VPC] The difference between public and private subnets in Amazon VPC?

More Related Articles

[Terraform] – Terraform Beginner – Lesson 2: Working with Terraform. AWS - Amazon Web Service
[AWS] Creating EKS windows on AWS and Running windows pods AWS - Amazon Web Service
[Keda] Auto-scaling is so easy when you use Keda AWS - Amazon Web Service
[Terraform] Solve “Redundant ignore_changes element” on EKSmodule AWS - Amazon Web Service
[Redis] ElastiCache-Redis Cross-Region Replication|Global DataStore AWS - Amazon Web Service
[Terraform] Infrastructure Automation With Terraform – Lesson 1: Setup AWS AWS - Amazon Web Service

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Tham Gia Group DevOps nhé!
Để Nim có nhiều động lực ra nhiều bài viết.
Để nhận được những thông báo mới nhất.

Recent Posts

  • [Prometheus/Grafana] Install Prometheus and Grafana on ubuntu. March 27, 2023
  • [Kong Gateway] WebSocket connection failed March 26, 2023
  • [Nextcloud] Can’t download files to have a size bigger than 2Gi on NextCloud – RaspBerry March 24, 2023
  • [Datadog] Using DataDog to monitor all services on kubernetes March 19, 2023
  • [Metrics Server] Failed to make webhook authorizer request: the server could not find the requested resource March 17, 2023

Archives

  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021

Categories

  • BareMetal
    • NextCloud
  • CI/CD
    • ArgoCD
    • ArgoWorkflows
    • Git
      • Bitbucket
    • Harbor
    • Jenkins
    • Spinnaker
    • TeamCity
  • Coding
    • Golang
    • Jquery & JavaScript
    • Laravel
    • Python
    • Selenium
    • Terraform
      • AWS – Amazon Web Service
      • GCP – Google Cloud
  • Kubernetes & Container
    • Apache Kafka
      • Kafka
      • Kafka Connect
      • Lenses
    • Docker
    • Helm Chart
    • Isito-EnvoyFilter
    • Kong Gateway
    • Kubernetes
      • Ingress
    • Longhorn – Storage
    • MetalLB
    • Vault
    • VictoriaMetrics
  • Log & Monitor
    • DataDog
    • ELK
      • Kibana
      • Logstash
    • Grafana
    • Prometheus
  • Uncategorized
  • Admin

Copyright © 2023 NimTechnology.